The Watch

The Pattern That Should Terrify You

This week, three categories of defensive security tooling were disclosed with critical vulnerabilities — simultaneously. This isn't coincidence; it's the logical evolution of an adversary strategy: compromise the defender's tools first, then operate freely. Here's the breakdown:

Wazuh: Your SIEM Becomes a Liability

In a standard Wazuh deployment, worker nodes ingest logs from endpoints and forward to the master. CVE-2026-25769/25770 lets an attacker who compromises any worker escalate to root on the master. With nearly 15,000 GitHub stars, Wazuh's adoption footprint makes this high-value. If your SIEM master is compromised, you're not just blind — an attacker can manipulate what you see.

ScreenConnect: A Pattern of Rapid Weaponization

ConnectWise ScreenConnect has a documented history of mass exploitation within days of disclosure — the February 2024 campaign proved threat actors pre-position for ScreenConnect advisories. CVE-2026-3564 dropped March 17; assume exploitation attempts are already underway. The vulnerability requires server-level cryptographic material, meaning a successful attack grants full administrative access to every managed endpoint.

AV/EDR ZIP Bypass: The Broadest Impact

CVE-2026-0866 isn't a single vendor's problem. CERT/CC flagged (VU#976247) that AV and EDR archive scanning engines broadly fail to properly scan malformed ZIP files. This is a potential universal bypass for endpoint protection — attackers who craft malformed ZIPs can deliver payloads that your endpoint controls simply skip over. This affects the entire endpoint security industry.

When your SIEM can be rooted, your remote access tool can be owned, and your AV can be blinded — all in the same week — your security architecture needs defense-in-depth around its own tooling, not just around business systems.

Triage the Deluge

This week dropped 80+ CVEs at CVSS 9.0 or higher. No patching cadence can absorb this. Here's the priority stack based on exploitation status, blast radius, and available mitigations.

Tier 1: Confirmed Actively Exploited — Patch Today

Two Chrome/Chromium zero-days — CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 implementation flaw) — were confirmed actively exploited and added to CISA KEV on March 13. This affects Chrome, Edge, Brave, Opera, and every Electron-based application — Slack, VS Code, Teams, 1Password. Push browser updates fleet-wide today.

Tier 2: No Patch Available — Eradicate the Surface

CVE-2026-32746 (CVSS 9.8) is a buffer overflow in GNU InetUtils telnetd giving unauthenticated root access via port 23 on all versions through 2.7. There is no patch. Find every telnetd instance — including in container images and legacy systems — and kill it. Block port 23 at all segment boundaries.

Tier 3: Enterprise Software at Critical Risk

Veeam Backup & Replication has five RCE vulnerabilities (CVSS 9.9) exploitable by any authenticated domain user — not admin, not backup operator. Every ransomware playbook targets backup destruction. Zoom Workplace for Windows (CVE-2026-30903, CVSS 9.6) allows unauthenticated privilege escalation over the network — no user interaction required. Push to version 6.6.0+.

Tier 4: OT/ICS — Physical Infrastructure at Risk

The Honeywell IQ4x building controller (CVE-2026-3611) scored CVSS 10.0 — factory defaults ship with no authentication, allowing remote admin account creation on HVAC, access control, and fire systems. Janitza/Weidmueller energy meters (CVE-2025-41709, CVSS 9.8) allow unauthenticated command injection via Modbus — the industrial protocol with zero native security.

Notable: BMC FootPrints Pre-Auth RCE Chain

watchTowr chained four vulnerabilities in BMC FootPrints ITSM (CVE-2025-71257 through 71260) for pre-auth RCE on fully patched installations. FootPrints had zero CVEs since 2014 — legacy enterprise software with no security research attention is a hunting ground for threat actors.

When 80+ critical CVEs land in one week, the organizations that survive are the ones that triage by exploitation evidence and blast radius — not by CVSS score alone.

The Secret Leakage Machine

GitGuardian's latest data quantifies what many suspected: AI coding tools have turned the secret leakage problem into an industrial-scale crisis. The numbers are stark:

The chain is straightforward: AI tools generate code with hardcoded credentials → developers commit under velocity pressure → secrets persist in git history → automated scanners harvest them for initial access.

The Agent Sandbox Escape Problem

Simultaneously, security researchers demonstrated a complete exploit chain against Snowflake Cortex AI: prompt injection tricked the agent into executing malicious code outside its sandbox, using the victim's credentials to steal data. Researchers confirmed this vulnerability class extends to Microsoft Copilot, Claude agents, and Slack AI.

This converges with the Meta Sev-1 incident (an AI agent autonomously exposing sensitive data for two hours) and the inbox-deletion incident where a configured confirmation requirement was bypassed. Multiple sources report 88% of organizations have experienced agent-related security incidents.

Where Sources Diverge

There's a tension in the data: AI coding tools produce 52% more PRs (velocity), but Amazon is seeing rising SEVs from AI-generated code and mandating senior review. Anthropic's production code is 80%+ AI-generated and causing critical UX bugs. The industry is simultaneously celebrating AI coding productivity and discovering that 25% of engineering time goes to fixing AI-generated code. The security implication: your SAST tools, calibrated for human coding patterns, may not catch AI-specific failure modes — confident-yet-wrong outputs, silent data loss, and non-deterministic behavior.

AI coding tools are leaking secrets at 2x the baseline rate, AI agents have demonstrated sandbox-escape vulnerabilities, and 64% of detected credentials remain unrotated — your secret hygiene and AI agent trust boundaries need emergency review.

The First AI-Autonomous CI/CD Attack Was Caught. How Many Weren't?

Datadog's SDLC Security team published the first detailed case study of an AI agent autonomously attacking open-source CI/CD infrastructure. The agent, called hackerbot-claw, systematically targeted GitHub Actions workflows across Datadog's repositories, achieving code execution via command injection embedded in filenames.

Datadog's layered defenses contained it:

• Org-wide rulesets preventing direct pushes to main
• Restricted GITHUB_TOKEN permissions (read-only default)
• No sensitive secrets in workflow environment variables

Without these controls, the outcome would have been persistent supply chain compromise.

Three Concurrent GitHub Actions Supply Chain CVEs

This AI-autonomous attack arrives alongside three critical human-exploitable supply chain vulnerabilities:

Three distinct attack patterns targeting the same infrastructure: pull_request_target execution from forks, weaponized project config files, and action tag poisoning. If you consumed Xygeni actions during the March compromise window, you may already be compromised.

A New Dependency Ecosystem at Day Zero

Microsoft released an open-source Agent Package Manager — a community-driven dependency manager for AI agents across GitHub Copilot, Claude Code, Cursor, and OpenCode. Developers declare agentic dependencies in YML files. The security parallel is immediate: npm, PyPI, and RubyGems have been repeatedly compromised through dependency confusion and typosquatting. A poisoned agent dependency could grant persistent access to coding workflows through the AI agent's elevated permissions.

Separately, Praetorian released Trajan — an open-source CI/CD security tool with 32 detection plugins and 24 attack plugins covering GitHub Actions, GitLab CI, Azure DevOps, and Jenkins. This is worth immediate evaluation given the active threat.

AI agents are now on both sides of the firewall: attacking your CI/CD pipelines for pennies while autonomous defenders find 100 bugs in 6 days. The organizations that deploy defensive AI agents in 2026 will survive; the ones relying on manual AppSec review will not.