The Watch

The Pattern No One's Naming

Count the authentication bypass and credential vulnerabilities disclosed this week: Quest KACE SMA, Cisco Webex SSO, Apache Kafka JWT, OAuth2 Proxy, FastGPT NoSQL injection, Sonatype Nexus hard-coded credentials, Spring Security Authorization Server, and Cisco ISE. Eight products, all failing at the most fundamental security control. This is not coincidence — it's an industry-wide pattern.

Two of these carry the maximum possible severity: Quest KACE SMA (CVE-2025-32975, CVSS 10.0) enables complete admin takeover with zero authentication and has been on CISA KEV since April 20. Axios (CVE-2026-40175, CVSS 10.0) allows header injection that exfiltrates cloud metadata — and as the most popular JavaScript HTTP client, it's almost certainly a transitive dependency in your projects.

When your artifact repository has hard-coded credentials, your Kafka cluster accepts forged JWTs, and your SIEM has unauthenticated file read — the attackers don't need zero-days; they need patience and a vulnerability scanner.

The Security Tool Problem

This week's most disturbing sub-pattern: your defensive infrastructure is the vulnerability. CrowdStrike LogScale (CVE-2026-40050, CVSS 9.8) has unauthenticated path traversal allowing anyone to read files from your SIEM. Sonatype Nexus Repository Manager (CVE-2026-5189) has hard-coded credentials across versions 3.0.0 through 3.70.5 — a supply chain security tool with a supply chain vulnerability. Fortinet FortiSandbox has dual CVSS 9.8 vulnerabilities enabling OS command injection and privilege escalation in your sandbox. Trojanized Checkmarx KICS Docker images were exfiltrating every secret in your IaC configs.

The Numbers That Should Drive Your Prioritization

The ASP.NET Core Wrinkle

Microsoft's out-of-band ASP.NET Core patch is particularly treacherous: patching the runtime is explicitly insufficient. Applications that embed the vulnerable library must be fully rebuilt, and all tokens and cookies generated pre-patch must be expired. Your patch management dashboard will show green while applications remain vulnerable. This is a rebuild-and-rotate scenario, not a patch-and-forget scenario.

Cross-Source Insight

Multiple sources converge on the same structural problem: only 5-7% of CVEs are exploited in the wild, but the average remediation gap is 55 days while adversaries exploit in under 1 week. At 110+ new CVEs per day, CVSS-only triage is mathematically unsolvable. Sources agree: EPSS integration is no longer optional — it's the only way to focus on the vulns that matter at this volume.

The Security Scanner Was the Exfiltration Channel

Attackers overwrote official tags in the Checkmarx KICS Docker Hub repository — including v2.1.20, alpine, and a fabricated v2.1.21 — injecting a trojanized binary that generates uncensored IaC scan reports, encrypts and exfiltrates every secret found in your Terraform, CloudFormation, and Kubernetes configs. The tool designed to find your secrets was weaponized to steal them. Organizations using KICS in CI/CD pipelines may have been exfiltrating cloud credentials with every scan run.

This follows the Trivy compromise and Axios vulnerability in rapid succession, confirming that the DevSecOps toolchain itself is now a primary target. Exploit-to-weaponization timelines are shrinking to hours.

The Self-Propagating npm Threat

Two malicious npm packages — 'pgserve' and 'automagik' — were designed to infect every downstream package built using them, creating a worm-like propagation chain through your build pipeline. They steal data, credentials, and secrets, with researchers describing potential for "complete organizational takeover." If either package entered your dependency tree, every build artifact since introduction is compromised.

Sonatype Nexus: Your Artifact Repository Has Hard-Coded Credentials

CVE-2026-5189 affects Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 with hard-coded credentials enabling unauthenticated OS command execution. Your artifact repository is the supply chain control point — it's where you store the packages your CI/CD pipeline trusts implicitly. A compromised Nexus is a compromised build pipeline.

When your IaC scanner exfiltrates secrets, your npm packages self-propagate malware, and your artifact repository has default credentials — the supply chain isn't broken; it's been weaponized.

The Convergence Pattern

Five sources independently flagged the same pattern: supply chain attacks are no longer targeting application code — they're targeting the security and development tools themselves. The attack surface has shifted upstream to the tools developers trust most implicitly.

Container Image Trust Is Broken

The Checkmarx KICS attack exploited a fundamental gap: most CI/CD pipelines pull images by tag, not by digest. Attackers overwrote legitimate tags with trojanized versions. The fix is architectural: implement container image signing and digest-based pinning using Sigstore/Cosign, Kyverno, or OPA Gatekeeper. Deploy admission controllers to reject unsigned or unverified images.

Five Platforms Shipped, Zero Governance Solutions Exist

In a single week: OpenAI launched Workspace Agents with Slack and Salesforce integration for Business/Enterprise tiers. Google unveiled the Gemini Enterprise Agent Platform with a central registry and 200+ model support. Factory shipped Droid — always-on AI agents with their own filesystems and credentials. Block deployed MoneyBot and ManagerBot with autonomous payment authority. Alipay launched AI Pay enabling agent-initiated purchases via OpenClaw protocol. Coinbase is embedding executive-persona agents in Slack.

At RSAC 2026, across 11 main-stage keynotes, no speaker claimed a working solution for AI agent security. Every customer deploying AI agents is in monitor-only mode with no enforcement.

Each workspace agent is a persistent identity with OAuth scopes spanning multiple SaaS applications, capable of reading sensitive data, writing to business channels, and triggering external actions — and your IAM framework doesn't have a category for it.

The Agent Identity Crisis

Google Cloud resellers working implementations explicitly flagged that determining what agents should have access to is an unsolved enterprise challenge. Home Depot disclosed employees have access to four AI providers simultaneously (Google, Anthropic, OpenAI, Microsoft), switching based on quality. That's four providers with different data handling, retention, and training policies — each model switch is a data flow your DLP didn't account for.

Financial Agents Change the Calculus

Block's agents autonomously execute payments, savings, and inventory management. Alipay's agents make purchases. Coinbase has executive-persona agents in Slack providing strategic feedback. The attack surface for each: prompt injection via data the agent ingests, credential persistence through background tokens that outlive sessions, and authority exploitation since Coinbase's agents speak with executive credibility.

The 60% Threshold

Vercel's CTO disclosed that 60% of traffic to their admin/configuration app is bot traffic — AI agents configuring applications on behalf of humans. Your behavioral baselines, anomaly detection, and authentication mechanisms were designed for human interaction patterns. They will fail on legitimate agent traffic and miss attacks that mimic agent patterns.

What the AWS Bedrock AgentCore Failure Teaches

AWS Bedrock AgentCore's starter toolkit generates wildcard IAM permissions by default, enabling a 'God Mode' where compromising one agent grants access to all agents' memories, ECR images, and code interpreters. AWS chose to update documentation rather than change the defaults. Every team that spun up AgentCore has wildcard roles in your account right now. This is the governance gap in microcosm — and Cisco's five new open-source tools (AI BOM, MCP Scanner, A2A Scanner, CodeGuard, DefenseClaw) are the first defensive tooling worth evaluating.