ClarityBeta

Security & Threat Intelligence

The Watch

8 min read · 1,551 words · 4 moves to watch
The Signal

Two VPN vendors, exploited in parallel.

Palo Alto GlobalProtect carries CVE-2026-0257, an auth bypass, now KEV-listed and under active exploitation. FortiClient EMS carries CVE-2026-35616, chained to drop the EKZ infostealer through legitimate IPsec tunnels within seconds of connection.

In Play

  1. Dual VPN Vendor Active Exploitation

    GlobalProtect CVE-2026-0257 auth bypass is KEV-listed with active exploitation confirmed by Rapid7. FortiClient EMS CVE-2026-35616 weaponizes fortitray.exe to deliver EKZ infostealer post-IPsec connect. Both products sit at the edge by design. Both give attackers credential access before anything else.

    Ask Clarity

  2. Critical RCEs in Developer/AI Infrastructure — No Patches Available

    Gogs has a 9.4 RCE with a public Metasploit module and no patch. Flowise CVE-2026-40933 (CVSS 9.9) gives root RCE via chatflow import in containers. npm package codexui-android is actively stealing OpenAI Codex tokens. All three have public exploit code and affect developer-controlled infrastructure with weak SOC visibility.

    Ask Clarity

  3. NVD Backlog Doubled — Vulnerability Prioritization Degraded

    Commerce IG confirms NIST's NVD backlog has more than doubled since mid-2024. CVE enrichment (CPE strings, CVSS vectors) is inconsistent. NIST's remediation plan targets late July 2026 — treat as aspirational. Any scanner, SBOM tool, or SLA keyed to NVD CVSS is triaging blind on a growing slice of the vulnerability landscape.

    Ask Clarity

  4. AI Agent Traffic Explodes — Detection and Governance Gaps Widen

    AI agent traffic grew 7,851% YoY per HUMAN's analysis. Anthropic shipped Dynamic Workflows enabling 1,000-agent fan-out from a single prompt. Conway platform leak reveals .cnw.zip extension and persistent agent containers. AWS Bedrock AgentCore sandboxes exploitable as S3-based C2 channels. Bot defenses, IAM, and DLP were not designed for this traffic class.

    Ask Clarity

  5. Deepfake and Phishing Controls Structurally Breaking

    SynthID watermarking publicly reverse-engineered on Reddit — both stripping and forging are demonstrated. Phishing from legitimate Microsoft sender addresses passes SPF/DKIM/DMARC cleanly. LLMReaper Chrome extension exfiltrates AI conversations with zero special permissions. Three trust signals defenders relied on are now unreliable.

    Ask Clarity

Deep Dives

Two VPN Vendors Actively Exploited — Patch and Hunt Before Close of Business

The Situation

Two enterprise VPN vendors are under active exploitation at the same time. Palo Alto GlobalProtect (CVE-2026-0257) is an authentication bypass. CISA added it to the KEV catalog. FortiClient EMS (CVE-2026-35616) is being chained to turn VPN tunnels into malware delivery channels. Both products sit on the internet by design. Both yield credential access. Both have patches.

Edge VPN appliances have been the preferred ingress for ransomware affiliates and state-aligned intrusion sets for several years running. Treating either of these as a one-off would be a mistake the calendar does not support.

GlobalProtect (CVE-2026-0257)

Rapid7 confirmed in-the-wild exploitation. The flaw is an authentication bypass on the GlobalProtect portal, which most enterprises expose to the internet on purpose. Pre-auth access to the VPN gateway gets the attacker network reachability, often with line of sight to the firewall management plane. Palo Alto rated it medium severity. CVSS-only SLAs will deprioritize it. Pre-auth bypass on a perimeter VPN is critical-class regardless of what the CVSS string says.

Prior pattern: CVE-2024-3400 (memory corruption) and CVE-2024-0012 (management-plane bypass). Chinese-nexus clusters UNC5325 and UNC5221 weaponized both into RCE chains within days of disclosure. Same urgency applies.

FortiClient EMS (CVE-2026-35616)

The more novel of the two. Attackers modify EMS configs and VPN policies. Seconds after an IPsec tunnel establishes to a FortiGate, fortitray.exe launches malicious batch scripts. The payload is base64-encoded PowerShell pulling the EKZ infostealer disguised as FortiEndpoint_Patch.exe. Chromium and Firefox credentials, cards, and cookies are exfiltrated to an attacker VPS over HTTP, then wiped locally. Detection signal: the log sequence 'Certificate not found in request header' followed by 'Certificate user: fortinet-ca2 … successfully updated'.

Cross-Source Pattern

Four independent sources flagged GlobalProtect. One source provided deep technical detail on FortiClient EMS. The convergence is clear: the VPN perimeter is the highest-value initial-access primitive on offer this week. Fortinet is now twice in 18 months a security-tool-as-attack-vector story. Palo Alto has absorbed repeated high-severity flaws over the last 24 months. Vendor concentration risk in VPN and endpoint warrants board-level attention at renewal.

Detection Guidance

IndicatorSourceAction
GlobalProtect auth without MFA challengePAN-OS logsHunt 90 days; correlate with new admin accounts and config exports
fortitray.exe spawning batch/PowerShellEDR telemetryAlert immediately; pivot to parent process chain
FortiEndpoint_Patch.exe on diskEndpoint scanIsolate host; investigate credential theft scope
Outbound to 185.177.239.255:443Network logsBlocklist; investigate all connecting hosts

What to do

  1. Patch all internet-facing GlobalProtect portals/gateways to latest PAN-OS hotfix within 24 hours; if blocked, restrict portal to known source IPs or disable entirely

  2. Hunt FortiClient EMS for exploitation indicators: search logs for the certificate-update sequence, audit fortitray.exe child processes for batch/PowerShell spawns, and check for FortiEndpoint_Patch.exe artifacts

  3. Rotate all credentials that transited FortiClient EMS or GlobalProtect during the vulnerability window and force MFA re-enrollment

  4. Document Palo Alto and Fortinet concentration risk and brief the vendor-risk team on ZTNA alternative shortlists for next renewal cycle

Three Critical RCEs in Developer/AI Infrastructure — Public Exploits, No Patches for Gogs

The Exposure Set

Three critical-class vulnerabilities published the same week. All three sit on developer and AI infrastructure, where SOC visibility is thinnest and supply-chain blast radius is widest.

VulnerabilityCVSSPatch StatusExploit MaturityBlast Radius
Gogs Merge() injection9.4No patch existsPublic Metasploit module (Rapid7)Any logged-in user → RCE on Win/Linux/macOS
Flowise MCP CVE-2026-409339.9Disclosed with PoCPublic PoC (Obsidian Security)Root RCE on import; containers often root
codexui-android (npm)N/A (supply chain)Actively exfiltratingLive campaignOpenAI Codex/API tokens → billing, code access

Why These Matter More Than Their CVSSs Suggest

Gogs is self-hosted Git. Adoption clusters in air-gapped and cost-sensitive environments. A public Metasploit module exists. There is no upstream patch. Any authenticated user gets RCE. The real exposure is shadow deployments on port 3000, the ones nobody inventoried. Continued operation post-disclosure is indefensible.

Flowise is a LangChain-compatible AI orchestration platform. The RCE fires on chatflow import. One crafted JSON file, root on the host. Platform engineering and data-science teams run it in containers, frequently as root, frequently with egress. Treat it as an unsecured Jenkins for the AI stack.

codexui-android is an npm typosquat of a plausible-sounding Codex remote-UI package. Post-install, it exfiltrates OpenAI Codex authentication tokens. The target set rotated from crypto wallets to AI tokens. AI tokens buy compute, code-gen capacity, and lateral access into private repos. That is where the value moved.

npm remains the path of least resistance for credential theft. The target set rotated from crypto to AI tokens because AI tokens buy compute and downstream repo access. This campaign will not be the last.

Adjacent: CIFSwitch Linux Privilege Escalation

Local-to-root privesc via unverified cifs.spnego key requests. Affected: Linux Mint, CentOS Stream 9, Rocky 9, Alma 9, Kali, and SLES 15 SP7. On multi-tenant hosts, or anything reachable from a low-privilege workload, a foothold becomes root. Unpatched at disclosure.

The Shared Pattern

Four bugs, four under-monitored surfaces: self-hosted Git, AI orchestration, developer package managers, and the kernel CIFS subsystem. None of this requires a sophisticated actor. Public exploits, default configurations, and shadow deployments are doing the work.

What to do

  1. Inventory all Gogs instances via internal port scan for default port 3000; disable user registration, repo creation, and 'Rebase before merging' immediately; plan migration to Gitea or GitLab within 30 days

  2. Grep every package-lock.json, yarn.lock, and pnpm-lock.yaml for codexui-android within 4 hours; any hit triggers workstation reimage, OpenAI token rotation, and org audit log review

  3. Inventory Flowise deployments across data-science and platform-engineering subnets; verify container user is non-root; disable chatflow import or gate behind authenticated review; block egress until patched

  4. Establish a recurring typosquat watchlist for AI-tooling namespaces (codex*, openai*, anthropic*, mcp*, claude*) in SCA and require 2-of-2 human review for any new dependency in those namespaces

NVD Is Broken — Your Vulnerability Prioritization Is Operating on Incomplete Data

What Happened

The Commerce Department Inspector General has now confirmed what vulnerability management teams have been saying since mid-2024: NIST's National Vulnerability Database is broken. The backlog of unenriched CVEs has more than doubled. NIST and CISA are duplicating effort. Manual CPE and CVSS enrichment is inconsistent across the dataset. NIST concurred with the findings and committed to a remediation plan by late July 2026.

NVD is not an active exploit. It is a blind spot multiplier. While teams chase the CVEs that did get enriched, the unscored backlog is where opportunistic actors find the unpatched library three layers deep in a container image.

Why This Matters Operationally

The dependency chain is the problem. SOCs, scanners, SBOM tools, and compliance evidence all consume NVD-enriched records to:

  • Match CPE strings to assets in inventory
  • Assign CVSS scores for patch prioritization SLAs
  • Generate FedRAMP/SOC 2/PCI evidence for auditors
  • Trigger automatic ticketing on CPE match

When enrichment degrades, prioritization runs on incomplete data. Metrics like '% of critical CVEs patched in 30 days' report a number that no longer means what it used to. The failure mode is silent. Systems that should ticket do not ticket, and nobody notices until audit.

The Compensating Controls

NVD has not been the strongest prioritization signal for two years. CISA KEV (exploitation-in-the-wild) has been more actionable for most of that period. The diversification path is straightforward:

SourceWhat It ProvidesCoverage Gap vs. NVD
CISA KEVConfirmed exploitationOnly ~1,100 CVEs total; no scoring
GitHub Advisory DBPackage-level advisoriesOSS-focused; limited binary/firmware
OSV.devMulti-ecosystem vuln dataCommunity-maintained; variable speed
VulnCheck (commercial)Enrichment + exploitation intelPaid; requires budget approval

The Compliance Dimension

SOC 2 and FedRAMP auditors will eventually ask about NVD reliance. Document multi-source enrichment now, not under audit pressure. If a compliance report says '100% of criticals patched in 7 days' and NIST has not scored half the CVEs, that number is fiction. Update the control narrative proactively.

SLA Policy Change Needed

If 'Critical CVSS' patches in 7 days, define the rule when CVSS is missing. The conservative posture: default-to-critical for unscored CVEs on internet-exposed assets. The permissive posture is how the next audit finding gets written.

What to do

  1. Audit which vulnerability management, SBOM, and SCA tools in your stack depend on NVD-enriched data (CPE, CVSS v3.1) and document gaps where CVEs are unscored or unmatched

  2. Add CISA KEV, GitHub Advisory Database, OSV.dev, and a commercial enrichment feed as parallel inputs to your prioritization pipeline within 30 days

  3. Define a policy for unscored CVEs on internet-exposed assets — default-to-critical until enrichment arrives — and update patch SLA documentation accordingly

  4. Brief GRC/audit team that NVD-derived CVSS scores in compliance reports may be incomplete; document compensating controls in SOC 2/FedRAMP/PCI evidence narratives

AI Agent Attack Surface: From 7,851% Traffic Growth to 1,000-Agent Weaponization

The Quantified Shift

Seven sources, one conclusion: AI agents are operational, and the defensive stack is not. HUMAN's 2026 benchmark puts AI agent traffic up 7,851% year-over-year, with automated traffic growing eight times faster than human. Attackers are already using agent traffic for fraud, scraping, and account takeover.

Three New Capabilities Expanding the Surface

1. Anthropic Dynamic Workflows (1,000-agent fan-out)

Shipped with Opus 4.8. Gated behind an Enterprise admin toggle, which is the vendor's own threat assessment in toggle form. One prompt spawns 16 concurrent and 1,000 total subagents, each with MCP infrastructure access. A prompt injection in any document the orchestrator reads becomes a thousand-agent action before a human sees a log line. Anthropic shipped it off by default. Read that as the disclosure.

2. Conway Platform (.cnw.zip)

Publicly: nothing. Per leaked Anthropic code: a persistent, container-isolated, webhook-triggered agent platform with a novel .cnw.zip file extension. Three subsystems. Orbit handles Slack and Gmail. Operon handles data pipelines. BugCrawl modifies code autonomously. No email gateway, EDR, or DLP currently recognizes the file type.

3. S3-Based C2 Against AWS Bedrock AgentCore

Researchers demonstrated a bidirectional reverse shell using S3 buckets and presigned URLs against AgentCore code interpreters. The technique survives the DNS exfiltration fixes vendors already shipped. Presigned-URL traffic to a global S3 endpoint reads as legitimate sandbox behavior, because that is what it is.

The 84% developer AI adoption against 3% trust in output is the gap. The attack surface is unreviewed AI-generated code moving into pipelines designed for a workforce that no longer exists.

Where Sources Agree and Diverge

All seven sources agree that agentic AI has outpaced governance. They disagree on timing. Some frame this as disasters waiting to happen. Others document active exploitation via S3 C2 and container escapes. The working assumption is present tense. The techniques are demonstrated. The defensive gaps are documented. The adoption curve does the rest.

The Governance Gap

Non-human identities — Copilot, Scout, Devin, Cursor, Grok Build, internal agents — are now a fast-growing identity class with broad permissions and minimal audit logging. Most IAM programs have not inventoried them. Most SIEMs cannot distinguish agent SQL from human SQL. The 28-hour AWS US-EAST-1 outage this month dropped SIEM, IdP, and EDR for any stack with single-region dependencies. Replace that gap with 1,000 ungoverned agents and the failure mode is no longer hypothetical.

What to do

  1. Verify Anthropic Enterprise Dynamic Workflows enablement status across all tenants and confirm it remains off-by-default; restrict 'ultracode' mode to named, risk-accepted workspaces

  2. Add .cnw.zip to email gateway, web proxy, and EDR file-extension blocklists/quarantine rules immediately — treat like .iso or .one until sanctioned

  3. Audit AWS Bedrock AgentCore deployments for S3 egress posture; enforce VPC mode and restrictive S3 gateway endpoint policies that deny global bucket access and presigned-URL retrieval

  4. Launch a Non-Human Identity governance workstream: inventory every agent identity in production, map entitlements, require system-of-record-backed JIT scopes and 90-day access reviews

The bottom line

Two VPN vendors are actively exploited in the wild (GlobalProtect auth bypass is KEV-listed, FortiClient EMS is delivering infostealers through legitimate tunnels), three critical-class RCEs with public exploit code have no patches in developer/AI infrastructure, NVD's vulnerability enrichment backlog has officially doubled making your CVSS-based prioritization unreliable, and AI agent traffic grew 7,851% while the tools that govern those agents can now fan out to 1,000 concurrent actors from a single compromised prompt — patch the edge, quarantine Gogs and Flowise, diversify away from NVD, and inventory your non-human identities before the calendar answers for you.