>> Read this brief on krypteiasec.com

Look at what got exploited this month and stop sorting it into "AI" and "not AI." A SonicWall appliance with a missing authorization check on an internal service, a SharePoint server with missing authentication on a critical function, an Oracle Payments endpoint that calls an internal Java function without checking who is asking, and a Langflow AI builder that runs another user's flow because it never confirmed ownership are the same vulnerability wearing four different logos. Every one is a privileged component sitting at a trust boundary that forgot to ask "are you allowed to do this." The GitLost disclosure is the punchline: GitHub's own AI agent leaked a private repository because someone wrote the word "additionally" in a public issue, which is authorization failure by social engineering rather than by code. The lesson for this week is uncomfortable but simple. Your AI agent frameworks are internet-facing appliances now, and they deserve the same exposure inventory, patch cadence, and least-privilege scoping you already apply to a VPN concentrator. If you cannot name every Langflow, GitHub Agentic Workflow, and MCP server in your estate by Friday, that is the gap an opportunistic actor monetized in June while you were still calling it a science project. Treat authorization on agent tool-calls as the new perimeter, because attackers already do .

Rapid7's MDR team discovered two zero-days under active exploitation in SonicWall SMA1000 remote-access appliances. CVE-2026-15409 is a critical unauthenticated server-side request forgery flaw carrying a CVSS score of 10.0, letting an attacker open a websocket-based tunnel to arbitrary localhost-only services. CVE-2026-15410 (CVSS 7.2) is a command injection weakness in the Appliance Management Console that permits code execution as root through a malicious path-traversal remove_hotfix workflow against the internal service on port 8188.

Chained together, an unauthenticated attacker reaches an internal-only service and then executes operating-system commands as root. SonicWall confirmed exploitation in the wild and reported attackers deploying custom malware. Affected products are the SMA1000 6210, 7210, and 8200v. Patches are available in versions 12.4.3-03453 and 12.5.0-02835. Both CVEs are in CISA KEV .

CVE-2026-56164 is a missing-authentication vulnerability in on-premises SharePoint Server 2016, 2019, and Subscription Edition that lets an unauthenticated attacker escalate privileges over the network with no user interaction. Microsoft assigned CVSS 5.3, but the National Vulnerability Database independently scored it 9.8 Critical , a gap defenders should not let the lower vendor number obscure.

It was discovered by Mandiant incident responders and Google's FLARE team inside active attacks, where adversaries chained it with earlier SharePoint weaknesses to steal IIS machine keys, establish persistence, and deploy malware. Fixed in the July Patch Tuesday; CISA set a July 17 federal remediation deadline.

CVE-2026-56155 is an actively exploited elevation-of-privilege flaw in AD FS caused by insufficient granularity of access control. A compromised low-privilege account can climb to administrator rights inside an organization's identity infrastructure. Because AD FS brokers federated authentication, a successful escalation here undermines trust in every downstream application relying on it. It was added to CISA KEV on July 14 and patched the same week.

CVE-2026-55255 is an Insecure Direct Object Reference vulnerability in the Langflow AI application builder, residing in the /api/v1/responses endpoint and affecting all versions before 1.9.2. The endpoint resolves a flow object directly from a supplied identifier without confirming the caller owns it or holds execution rights, so an authenticated attacker can execute other users' flows.

The Sysdig Threat Research Team documented exploitation starting June 25 , observing a multi-stage loader that injects a custom Langflow component to shell out and pull a second-stage implant. Activity is consistent with botnet enrollment, cryptomining, and harvesting of cloud credentials including AWS keys and database secrets. Rated CVSS 9.9. CISA ordered federal agencies to patch by July 10 .

CVE-2026-46817 (CVSS 9.8) is an improper-privilege-management and authentication flaw in the File Transmission component of Oracle Payments that enables unauthenticated takeover of susceptible instances. The exploit targets the ibytransmit endpoint and calls an internal Oracle Java function directly to read files from the server.

First in-the-wild exploitation was recorded June 27, 2026 on Oracle E-Business honeypots , roughly six weeks after Oracle's May patch and before any public proof-of-concept existed. Affected versions run from 12.2.3 through 12.2.15. Added to CISA KEV on July 15 .

CVE-2025-54253 is a CVSS 10.0 misconfiguration in Adobe Experience Manager that chains an authentication bypass to remote code execution via Struts2 devmode, granting full control of the affected system. CISA added it to KEV in the July 7 batch. In parallel, Adobe's July release patched 88 unique CVEs across 12 bulletins , and the ColdFusion path-traversal flaw CVE-2026-48282 came under active exploitation within hours of disclosure.

A third Microsoft zero-day, CVE-2026-50661 in Windows BitLocker , was publicly disclosed with no confirmed in-the-wild exploitation. It requires physical access to bypass full-disk encryption and reach data. Lower urgency than the two exploited zero-days above, but material for high-value-endpoint and travel-laptop threat models.

The through-line of this month is that AI agent surfaces are being exploited with the same techniques defenders spent a decade learning to stop on classic infrastructure. Missing authorization, missing authentication, and untrusted-input-to-privileged-action are back, this time inside the agent runtime.

Noma Labs disclosed GitLost on July 6, 2026 , a prompt-injection technique that makes GitHub Agentic Workflows leak private repository contents through a public issue . GitHub Agentic Workflows, first released in February 2026, combine GitHub Actions automation with an AI agent such as Copilot or Anthropic's Claude, configured with permissions to read repositories and call tools.

An unauthenticated attacker only had to file a plausible issue in a public repository while the workflow's agent held broader read access. Noma's proof-of-concept requested the README.md from both a public and a private repo in the same organization. Researchers found that placing the word " additionally " before the private-file request slipped past guardrails and caused the agent to divulge private contents via the add- tool. The Hacker News and The Register frame this as an architectural agent-risk pattern rather than a patchable bug: untrusted text plus private-data access plus a public output channel equals an exfiltration path. This is the prompt injection lethal-trifecta made concrete.

Industry telemetry continues to rank prompt injection as the defining AI security crisis of 2026 , with reporting of a sharp year-over-year rise in attacks. OWASP data cited by Help Net Security shows prompt injection still drives most agentic AI security failures reaching production. The working defenses are containment patterns: least privilege on agent tools, human approval for risky actions, and sandboxed execution. See agentic red teaming for how to test these controls before an adversary does.

Microsoft researchers demonstrated a path in Semantic Kernel where prompt injection escalates to host-level remote code execution , with a single prompt launching calc.exe on the device running the AI agent. Combined with the Langflow exploitation above, the message is that agent frameworks with tool-execution capability are code-execution surfaces and must be treated as such.

A backdoor sat on PyPI for roughly three hours in March 2026 and was pulled down nearly 47,000 times, compromising LiteLLM , the language-model gateway used by CrewAI, DSPy, Microsoft GraphRAG, and dozens of other frameworks. A gateway component sitting between agents and models is a high-leverage target, and MCP security discipline should extend to every dependency in the agent stack.

Nation-state operators continued to compress dwell time and blur attribution in 2026. Reporting summarized by Hive Security notes that Russia, China, North Korea, and Iran have each expanded operational tempo, with mean time from initial access to exfiltration reported as low as 72 minutes in the fastest campaigns.

The operational pattern that matters for defenders: state actors are increasingly renting or mimicking ransomware-as-a-service tooling to disguise espionage as opportunistic crime, which means attribution based on tooling alone is now unreliable.

Coca-Cola disclosed in a July 16 Form 8-K that its dairy subsidiary fairlife identified unauthorized third-party access to production-related systems in a ransomware event, temporarily suspending US production while confirming product safety was not impacted. The Anubis ransomware group claimed responsibility, saying it encrypted Fairlife's Nutanix systems and exfiltrated 1TB of data, with a leak deadline set for the morning of July 27. Anubis is a financially motivated ransomware-as-a-service operation that surfaced in late 2024 with code resembling the earlier Sphinx malware.

The Conduent breach expanded sharply, with healthcare breach reporting placing the affected population above 62.2 million individuals , exposing Social Security numbers, medical information, and health insurance data.