ClarityBeta

Security & Threat Intelligence

The Watch

4 min read · 900 words · 3 moves to watch
The Signal

Oracle Payments and two Microsoft EoP flaws are being exploited now.

CVE-2026-46817 allows unauthenticated full takeover of Oracle EBS Payments; federal deadline is July 18. AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164) just landed in KEV. Patch those three before touching the 622-CVE queue, then hunt — exploitation started before the fixes shipped.

In Play

  1. New KEV Fires: Oracle Payments + Microsoft Identity

    CVE-2026-46817 grants unauthenticated full takeover of Oracle EBS Payments; CISA deadline July 18. Two Microsoft EoP flaws — AD FS (56155) and SharePoint (56164, CVSS 5.3) — are exploited in the wild despite 'moderate/important' ratings. Severity labels mislead; exploitation status is the triage key.

    Ask Clarity

  2. Your MCP Servers Are Now Internet Background Radiation

    Attackers scan internet-wide for MCP servers, LLM endpoints, and AI-assistant configs — surfaced from just 14 days of logs on one low-traffic host. Payloads exist: MCP Kubernetes argument injection (CVE-2026-61459, 9.8) takes over clusters; Flowise ships hardcoded JWT secrets (CVE-2026-56271); Agent Data Injection weaponizes GitHub comments into command execution.

    Ask Clarity

  3. AI Collapses N-Day and Ransomware Economics

    Hacktron chained a Chrome sandbox escape from public V8 commits for ~$1,597 (2.1B tokens). FulcrumSec uses AI to triage stolen data and price ransom — a $25M demand on Novo Nordisk after grading its pipeline as 3-5 years of competitor R&D. Intrusion stays boring; monetization and weaponization are now industrialized.

    Ask Clarity

  4. OT and Endpoint Blind Spots With No Patch

    A CVSS 10.0 JWT auth-bypass hit Siemens Opcenter X (CVE-2026-56451). On endpoints: LegacyHive defeats fully-patched July 2026 Windows with no CVE, WasmForge compiles Rubeus/Seatbelt to WASM to bypass .NET-hooked EDR, and khaos-c2 tunnels through Teams and GitHub Gist. Detection engineering, not patching, is the only lever.

    Ask Clarity

Deep Dives

Three KEV Fires That Beat Your CVSS Sort

The most dangerous flaw this cycle is rated 5.3, and the one with a federal clock isn't Microsoft's — triage by exploitation evidence or lose the race.

The severity queue is the trap. CVE-2026-56164, the SharePoint elevation-of-privilege bug, scores a CVSS of 5.3 and is already being exploited in the wild. AD FS EoP CVE-2026-56155 rates 7.8. Both are in the CISA KEV catalog, and exploitation predates the patch in both cases. Remediation removes the vulnerability, not the intruder already inside. AD FS abuse looks like anomalous token issuance and unexpected privilege grants. SharePoint abuse looks like webshells and rogue app-pool activity.

The louder signal isn't from Microsoft. CVE-2026-46817, in Oracle Payments within E-Business Suite, is unauthenticated, reachable over HTTP, and delivers a full takeover of a payment-processing component. It's confirmed exploited. The federal deadline is July 18. That's a two-day remediation window, about as plain a statement as you get that this is being weaponized at scale. If cardholder data touches that instance, PCI-DSS breach obligations attach the moment exposure is confirmed.

What changed

These are separate fires from the SonicWall SMA1000 zero-days. The pattern holds across sources: reachability plus exploitation status outranks CVSS. Microsoft shipped a record 622 CVEs this cycle, 1,049 counting Chromium, and patching that volume in chronological order guarantees the exploited items get fixed last.

The smart move

Sequence by exploitation status, not severity score. KEV and exploited items first: Oracle EBS, AD FS, SharePoint. Then reachable critical RCEs. Then everything else under standard SLA. Treat every exposed Oracle EBS instance as breached until a compromise assessment of payment flows, admin accounts, and outbound traffic says otherwise. A patch closing a CVE does not close an incident.

A 5.3 flaw is burning while the queue sorts by 9.8. Exploitation evidence is the only triage key that survives contact.

What to do

  1. Patch Oracle EBS Payments (CVE-2026-46817) before the July 18 deadline and run a compromise assessment on payment flows and admin accounts, treating exposed instances as breached

  2. Emergency-patch AD FS (56155) and SharePoint (56164), then hunt for anomalous token issuance and privilege grants that predate the fix

The AI Perimeter You Deployed Without a Security Review

Attackers enumerate MCP servers and LLM configs as routine internet noise, and the first weaponized payloads already ship as defaults.

The reconnaissance data is the tell. MCP-server and AI-assistant-config scanning surfaced from 14 days of logs on a single low-traffic host, mixed with .env probing and Git-config fishing. That's pervasive background radiation, not targeting. The attack surface predates anyone's monitoring for it.

The payloads aren't theoretical. CVE-2026-61459 (MCP Server Kubernetes) is argument injection that redirects tool commands to a malicious API server and compromises the whole cluster, CVSS 9.8. Flowise ships hardcoded default JWT secrets (CVE-2026-56271), a clean auth bypass. Agent Data Injection turns any untrusted text an agent reads, a GitHub PR comment, a product review, into command execution under the victim's credentials. WAF and SAST see nothing here. The payload is natural language, and coding agents typically hold standing repo write, package-manager rights, and CI secrets.

Where sources converge

Multiple independent reports describe the same shape: MCP connectors, Jira-to-agent delegation, and VS Code 1.129's '!'-prefixed shell execution all create action-execution primitives reachable from injectable inputs. OpenAI's own hardening cut prompt-injection failures 6x, confirming the rate is non-zero even at the frontier. The pattern recurs across products. Patching one CVE won't stop the next.

The smart move

AI infrastructure needs DMZ-grade discipline. Most organizations haven't mapped their MCP servers or LLM endpoints, let alone the coding-agent integrations sitting on top of them. Standing credentials remain the default where scoped, ephemeral tokens would close most of that exposure. Human-in-the-loop review is largely absent on agent actions that execute commands or merge into protected branches. Agent tool-call chains rarely reach the SIEM, and most SOCs have zero telemetry here.

Every exposed MCP or LLM endpoint is a live perimeter asset under scan, and its most dangerous exploit is a sentence that most SOCs never log.

What to do

  1. Inventory all MCP servers, LLM endpoints, and AI-assistant configs with external reachability this sprint; remove exposure, patch MCP-Kubernetes and Flowise, and add WAF/log detection for MCP-recon scanning

  2. Strip standing credentials from AI coding agents and enforce human approval on command execution and protected-branch merges; treat all agent-ingested external text as untrusted input

When a $1,597 Exploit Reprices Your Patch SLA

AI moved from finding bugs to weaponizing N-days and pricing stolen IP — the intrusion stayed boring while monetization got industrialized.

Two data points collapse the assumptions behind slow patching. Hacktron showed a model (GPT-5.6 Sol Ultra) chaining a type-confusion and use-after-free into a working Chrome sandbox escape starting from nothing but public V8 fix commits — 2.1 billion tokens, 14,062 requests, ~$1,597. Separately, an autonomous hackbot found 126 vulnerabilities in five months at an 89% confirmation rate, net-profitable after token costs. The window from public patch commit to weaponized N-day is now hours, not weeks.

Ransomware economics shifted in parallel, and that's where the money is. FulcrumSec breaks in through the same three boring doors — exposed credentials, unpatched apps, misconfigured buckets — then uses AI to triage terabytes and pinpoint the highest-leverage IP. On Novo Nordisk it claimed 1.3TB across 700,717 files, graded the haul as 3-5 years of competitor R&D, and opened at $25M. DragonForce uses LLMs to manufacture legal and reporting-deadline pressure, weaponizing your own compliance obligations.

The pattern across sources

The AI advantage has migrated from intrusion to monetization and weaponization. Agentic ransomware that runs end-to-end (JADEPUFFER) still botches payout — it destroyed keys and pasted the Bitcoin docs' example wallet. Established crews own the business side; AI just makes data appraisal and the N-day math cheap.

The smart move

Rewrite patch SLAs around hours for internet-facing High/Critical, and pair every high-severity deployment with immediate post-disclosure threat hunting, not passive monitoring. The detection payoff is at exfil: tune egress DLP for terabyte-scale reads and mass file enumeration — AI can't appraise what it never staged out.

The break-in is still exposed creds and unpatched apps; AI now turns that commodity breach into a $25M strategic IP loss before your monthly window closes.

What to do

  1. Rewrite patch-management SLAs to assume N-day weaponization within hours and pair every high-severity deployment with active threat hunting this quarter

  2. Tune egress DLP for terabyte-scale reads and mass file enumeration, and pre-brief counsel on AI-manufactured legal/reporting coercion

The bottom line

Stop sorting by CVSS; sort by proof-of-exploitation, then extend that evidence-first discipline to the AI infrastructure you never DMZ'd — inventory it, scope its credentials, and instrument it before the scanners finish the job.