The Watch

The architecture sets the remediation cost. Passportal decrypts vaults server-side rather than end-to-end, so vault contents are recoverable by anyone holding a valid token. The extension flaw was disclosed by James Arnott and is tracked as CVE-2026-15580. It is a browser-extension messaging failure of the familiar class: main-world and iframe contexts are not meaningfully isolated. Any site the user visited could request tokens and receive them. So could any iframe inside it, including a third-party ad tag.

N-able's PSIRT remediated within roughly one to three days of disclosure. That is genuinely fast. It does not change the exposure arithmetic. A patch stops issuance. It does not revoke. Both access and refresh tokens went out, which is why the window runs up to 100 days instead of ending at the next session expiry, and why live TOTP retrieval is in scope alongside stored passwords.

The multiplication factor is the customer list, not the CVSS

Passportal is concentrated among managed service providers. The population of affected vaults is therefore not the population of affected browsers. One MSP technician's leaked token can enumerate credentials for every downstream tenant that provider administers. That includes organizations running the extension nowhere at all. This is the rare case where full exposure coexists with zero affected assets in local inventory.

Where the compliance trap sits

An extension inventory showing 3.49.6 everywhere is the artifact that will be presented as remediation evidence. It demonstrates nothing about whether harvested tokens were invalidated. Any control narrative for credential management resting on "patched within SLA" breaks here, because the SLA clock and the risk clock are measuring different things. The closure record should carry rotation completion, not a version number.

The procurement consequence

SANS NewsBites frames the root cause as vendor architecture rather than a coding defect. That is the durable lesson. A credential store that can decrypt on its own servers holds a skeleton key with a vendor's name on it, and every bearer token it issues is functionally a copy of that key. Client-side-only decryption belongs in the gating criteria for secrets and credential management tooling, next to SOC 2 scope and breach-notification SLAs.

Patching the password manager does not close this. The leaked vault tokens stay valid, which makes this a credential-rotation exercise wearing a patch cycle's clothing.

Two caveats worth logging. Exploitation in the wild has not been reported. The 100-day figure describes token validity, not confirmed dwell time. Neither changes the rotation decision, because a negative cannot be proven against tokens nobody can see.

The cryptography held. The schema did not. The AEAD envelope providers wrap around reasoning traces authenticates block content, model name and model version. It does not authenticate the account that produced the block, or the conversation it belonged to. Those fields are absent from the authenticated portion. A valid envelope therefore functions as a universal bearer artifact across users, sessions and models. No patch applies, because nothing is broken in the sense a CVE describes.

The extraction chain requires no privileged access. Query a flagship model with something benign, discard the visible answer, keep the encrypted block, then open a fresh conversation with a weaker same-family model and ask it to transcribe the attached reasoning. Refusal training on the flagship never engaged, because the flagship was never asked anything harmful. Anti-distillation defences sit almost entirely in the expensive models. The cheap siblings tuned for cost and speed accept their relatives' blocks. A model family is only as secure as its least-protected member.

The number that sets priority

The research team pulled 6,708 public agent trajectories from GitHub and Hugging Face and decoded 315,320 reasoning blocks. Recovered from genuine user sessions: 62 API keys, 33 passwords, 24 access tokens, 7 private keys, 30 personal email addresses. 328 sessions leaked at least one item, a 4.9% base rate. Perfect scrubbing of visible text would not have moved that key count. All 62 API keys would still be there, because sanitisation operates on plaintext and nobody can read the envelope, including its owner.

Why this reaches internal repos too

A coding agent told to remove hardcoded credentials must first read those credentials, and they transit the reasoning trace before any answer exists. The highest-confidence leaks are the remediation tickets, not the careless ones. GitHub and Hugging Face secret scanning are structurally blind here. So is a pre-commit hook, unless the three field names go in as custom patterns.

Second-order vector worth naming for the SOC: a planted block carrying instructions to upload PowerPoint files was ported into an unrelated slide-editing session, and the generated script performed both the edit and the upload. Resuming a published agent trajectory is now an untrusted-code decision. The payload is invisible to human review.

Our agent logs are unredacted credential stores that neither we nor GitHub's scanner can read, and anyone who copies one decodes it for cents.

Confidence caveat: this is one research group's July-August 2026 snapshot, provider schemes were inferred from behaviour rather than documentation, and fidelity was validated across 120 programming problems. Some behaviour may already be patched. The credential exposure is not conditional on any of that.

Start with the latency, because the latency is the finding. CVE-2026-21962 is an improper access control flaw in Oracle HTTP Server and the WebLogic Proxy Plug-in. CVSS 10.0. Fixed in the January 2026 Critical Patch Update, KEV-listed, federal deadline August 27. CISA reports attackers using it to reach corporate environments and to steal or modify data. Exploitation in August against a January fix means the adversary is harvesting organisations running seven-month-old middleware. Nobody here is facing a zero-day.

The rest of the KEV batch reads the same way. TrueConf Server CVE-2026-72529, missing authentication, 9.8, deadline August 23. CVE-2026-73570 in Zimbra, OS command injection, 8.9, fixed in 10.1.20, deadline August 24. Both dates expired before the advisories reached most desks. TrueConf CVE-2026-72530 at 9.0 runs to September 3. At the other end of the curve, a SharePoint chain including CVE-2026-55040 moved from public proof-of-concept to in-the-wild exploitation inside a week. Disclosure-to-exploitation is shortening and patch-to-application is not. Manual change management sits between the two.

Where the three reads agree, and where one dissents

SANS NewsBites, Risky.Biz and The Hacker News independently rank the Oracle middleware item as the top action. All three describe it as pre-authenticated and confirmed exploited. The Hacker News flags a gap in its own source material: no CVE identifier, no affected version ranges, so validate scope against the KEV feed and Oracle's advisory before opening change tickets. That is a sourcing note, not a dispute over severity.

The authentication half

Two items in this batch involve no software vulnerability at all. Mirage2FA, a commercial phishing-as-a-service kit, has worked through roughly 4,500 US and EU organisations between 2024 and 2026, relaying legitimate Microsoft 365 login flows and taking post-MFA sessions. The miniOrange SAML 2.0 SSO plugin for WordPress carries two unauthenticated bypasses under active exploitation, both allowing sign-in as any user, administrators included. The pattern across both: authentication is not being broken, it is being routed around. Stolen sessions in one case, forged assertions in the other.

Operationally, any compliance narrative that reads "MFA enforced, therefore account takeover mitigated" is factually wrong. Password-plus-OTP is a bypass available on subscription. That is what a four-figure victim count looks like.

The prioritisation signal came from the KEV catalogue, not from a model. Patch the internet-facing middleware, then retire password-plus-OTP for privileged identities.