From Firewalls to Frameworks: This Week's Exploits Reach Deep into the AI Stack

This week made one thing clear: attackers are no longer just breaking into networks, they are hunting for the AI infrastructure powering them. CISA expanded its Known Exploited Vulnerabilities catalog with nine new entries, spanning Microsoft SharePoint, WordPress Core, Fortinet FortiSandbox, Check Point, Langflow, and DD-WRT. Two flaws each came from SharePoint, WordPress Core, and FortiSandbox, while Check Point, Langflow, and DD-WRT each contributed one.

Disclosure offered little breathing room this week, as attackers moved just as fast outside the KEV catalog. The ServiceNow AI Platform and the Windmill open-source developer platform both saw confirmed in-the-wild attacks, exploiting unauthenticated access flaws to bypass security controls entirely. Both cases showed that a patch announcement and an active attack can arrive within days of each other.

The malware landscape told an even sharper story of AI infrastructure squarely in the crosshairs. Qilin ransomware affiliates exploited a Palo Alto Networks PAN-OS GlobalProtect flaw to take over entire networks, XLab uncovered the Go-based NadMesh botnet built for the AI service era, and UTA0533 chained SonicWall SMA zero-days to deploy KNUCKLEBALL and ORANGETAIL. Sysdig capped it off by detailing JADEPUFFER, an agentic threat actor that evolved into deploying ransomware purpose-built to destroy AI models through a Langflow exploit.

Key points:

• CISA added nine vulnerabilities to its KEV catalog
• ServiceNow AI Platform and Windmill both saw confirmed in the wild exploitation
• Qilin affiliates exploited a Palo Alto Networks PAN-OS GlobalProtect flaw
• XLab uncovered NadMesh, a Go based botnet built to scan, exploit, and harvest AI service credentials
• UTA0533 chained two SonicWall SMA zero days to deploy the KNUCKLEBALL loader and ORANGETAIL webshell
• JADEPUFFER evolved from data theft extortion to deploying ENCFORGE, ransomware

Several high-impact vulnerabilities are currently trending across the cybersecurity community, demanding immediate attention and patch prioritization. Monitoring these emerging and widely discussed threats provides valuable insights, enabling organizations to make informed security decisions and strengthen their overall defense posture.

CVE-2026-0770 - Inclusion of Functionality from Untrusted Control Sphere vulnerability in Langflow

An inclusion of functionality from untrusted control sphere vulnerability existed in Langflow, an open-source visual framework for building LLM-powered applications through a drag-and-drop interface, allowing remote attackers to execute arbitrary code on affected installations. According to ZDI, the flaw let a remote, unauthenticated attacker achieve arbitrary code execution by abusing the application's handling of the exec_globals parameter in the /validate endpoint, where the insecure inclusion of resources from an untrusted control sphere allowed attacker-controlled input to influence the execution environment. By supplying a specially crafted request, an attacker manipulated the validation logic to execute arbitrary code on the underlying host with root privileges, as Langflow neither sanitized nor restricted the resources supplied through the parameter, incorporating attacker-controlled global variables and functions directly into the code execution context. At the time of writing, a fix was available, though the vendor had not published clear patch guidance or explicitly identified the patched version, and users were advised to upgrade to the latest Langflow release. The vulnerability was recently added to CISA KEV catalog.

CVE-2026-6875 - Sandbox Escape vulnerability in ServiceNow  

An Unauthenticated Sandbox-Escape vulnerability exists in ServiceNow AI Platform, allowing arbitrary code execution without authentication. Active exploitation was detected by Defused Cyber, which reported threat actors exploiting the flaw in the wild via HTTP POST requests to the pre-authentication endpoint /assessment_thanks.do, later confirming the captured payload matched the proof-of-concept published by Searchlight Cyber, the firm that discovered and reported the issue to ServiceNow on April 1, 2026, and noted it allowed full compromise of the instance and connected proxy servers. ServiceNow released patches throughout June across the Brazil, Australia, Zurich, and Yokohama release branches, and is further restricting the code permitted to run in sandbox contexts. Given the active exploitation, self-hosted customers are advised to apply the available patches without delay.

CVE-2026-16232 - Improper Authentication vulnerability in Check Point SmartConsole

An improper authentication vulnerability existed in Check Point SmartConsole, allowing an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges, effectively bypassing the login on Check Point Management. Confirmed as actively exploited, the flaw affected Security Management and Multi-Domain Management, with impacted releases including R81.10, R81.20, R82, and R82.10, as well as certain older versions. Exposure was narrow and materialized only where Management sat directly on the internet without IP restrictions, and Check Point reported that the observed attacks struck only a small number of customers running specific configurations. Check Point discovered the issue internally during a routine BLAST security review of its own products. Remediation required installing the jumbo hotfix released on July 22, 2026, with full details and indicators of compromise provided in the vendor's official advisory, and the vulnerability was recently added to CISA KEV catalog.

CVE-2026-25089 - OS Command Injection vulnerability in Fortinet FortiSandbox

An OS command injection vulnerability existed in Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS, allowing an unauthenticated attacker to execute unauthorized commands through specifically crafted HTTP requests. According to SecPod, the flaw arose when the FortiSandbox Web UI failed to properly neutralize special elements in user-supplied input before using it to construct an OS command, so an attacker could inject arbitrary commands by embedding operators such as semicolons (;), pipes (|), or command substitution ($()) within a malicious HTTP request, after which the injected commands executed with the privileges of the Web UI service and often led to full root or system compromise. The attack began with reconnaissance for internet-facing FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS Web UI instances running a vulnerable version, followed by a crafted request sent directly to the Web UI endpoint with no authentication or user interaction required; because the interface did not sanitize the injected operators, the underlying operating system received and executed the attacker's commands, granting remote command execution without any credentials. From that foothold, an attacker could move laterally into internal networks, exfiltrate submitted samples and analysis reports, disable malware-detection capabilities, deploy ransomware, recruit the appliance into a botnet, or reach other sensitive internal systems - an especially severe outcome given that the flaw undermined core sandboxing infrastructure at the heart of an organization's threat-detection stack. The vulnerability affected FortiSandbox 5.0, FortiSandbox 4.4, FortiSandbox Cloud 5.0, and FortiSandbox PaaS 5.0, and Fortinet resolved it with the release of FortiSandbox versions 5.0.6 and 4.4.9 along with FortiSandbox Cloud version 5.0.6. The vulnerability was recently added to the CISA KEV catalog.

CVE-2026-29059 - Unauthenticated Path Traversal vulnerability in Windmill

An Unauthenticated Path Traversal vulnerability existed in Windmill, an open-source developer platform, within the get_log_file endpoint (/api/w/{workspace}/jobs_u/get_log_file/{filename}). The filename parameter was concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using directory-traversal sequences, according to an advisory Windmill published in March 2026. The primary sensitive value exposed by the flaw was the SUPERADMIN_SECRET environment variable, readable via the process-1 environment file; when set, this secret could be used as a bearer token to authenticate as a superadmin and execute arbitrary code through the job preview API. However, SUPERADMIN_SECRET was not configured by default, so for standalone Windmill instances lacking that setting, the impact remained limited to arbitrary file read. Windmill addressed the issue in version 1.603.3, released in January 2026, by adding sanitization checks to the filename parameter to prevent directory traversal. Active exploitation of this flaw was detected by VulnCheck, with exploitation efforts directed against the get_log_file endpoint to extract sensitive information from the /etc/passwd file. The firm identified approximately 170 vulnerable systems exposed across 24 countries.

CVE-2026-39808 - OS Command Injection vulnerability in Fortinet FortiSandbox

An OS Command Injection vulnerability existed in Fortinet FortiSandbox, Fortinet's advanced threat-protection appliance that detonates suspicious files and URLs flagged by firewalls, mail gateways, and endpoints inside an isolated environment to identify zero-day malware. The flaw allowed an unauthenticated attacker to execute unauthorized code or commands through crafted HTTP requests, and according to CrowdSec, it resided in the /fortisandbox/job-detail/tracer-behavior endpoint, where shell metacharacters injected into the jid parameter were passed to an underlying operating-system process without proper sanitization, allowing attacker-supplied commands to run with system-level privileges. Successful exploitation was confirmed through follow-up requests to /ng/<filename>.txt that verified file creation and command execution, and researchers demonstrated that the flaw could be chained with other FortiSandbox issues to achieve unauthenticated, root-level remote code execution - the most severe outcome possible for an appliance of this kind, with a proof-of-concept demonstrating RCE publicly available on GitHub. The vulnerability affected versions 4.4.0 through 4.4.8, and Fortinet resolved it with the release of version 4.4.9. With working exploit code circulating, the flaw was recently added to the CISA KEV catalog.

CVE-2026-50522 - Deserialization of Untrusted Data vulnerability in Microsoft SharePoint

A deserialization of untrusted data vulnerability existed in Microsoft SharePoint, allowing an unauthorized attacker to execute code over a network against on-premises deployments of SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. According to watchTowr, active exploitation followed the release of a public proof-of-concept exploit, with attackers pulling SharePoint machine keys via a single request to maintain persistent access, prompting a warning that patching alone was insufficient and that credentials on any exposed assets should be rotated. Defused Cyber further disclosed that threat actors were likely delivering a .NET deserialization payload to a SharePoint sign-in endpoint, noting that the captured requests carried no authentication material and matched the unauthenticated profile of the flaw. Microsoft addressed the vulnerability in its July 2026 Patch Tuesday security updates, released on July 14, 2026, and affected organizations were advised to apply the relevant SharePoint updates without delay. The vulnerability was recently added to CISA KEV catalog, reinforcing the urgency of remediation.

CVE-2026-58644 - Deserialization of Untrusted Data vulnerability in Microsoft SharePoint

A Deserialization of Untrusted Data vulnerability existed in Microsoft SharePoint, allowing an attacker to execute code over a network. According to Microsoft, the flaw was a remote code execution vulnerability in which an attacker authenticated as at least a Site Owner could write and inject arbitrary code to execute it remotely on the SharePoint Server, and Microsoft acknowledged active exploitation as a zero-day, confirming that attackers had exploited the flaw in the wild before a patch was available. According to CISA, the active exploitation extended across a chain of vulnerabilities - CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644 - that together enabled threat actors to gain unauthorized access to on-premises SharePoint Server instances by establishing remote code execution and then conducting post-exploitation activity such as stealing Internet Information Services (IIS) machine keys and performing deserialization techniques to achieve persistence and deploy malware. CISA advised organizations to monitor affected SharePoint Servers closely for signs of exploitation or unusual activity, and no details regarding the threat actors involved or the specific techniques used were currently known. The vulnerability affected SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, and Microsoft resolved it in a security update as part of its July 2026 Patch Tuesday release. The vulnerability was recently added to the CISA KEV catalog.

CVE-2026-60137 - SQL Injection vulnerability in WordPress Core

A SQL injection vulnerability existed in WordPress Core, arising in the author__not_in parameter of WP_Query when untrusted, non-array input reached the query without proper sanitization before the database layer. This flaw was the payload of the "WP2Shell" chain, the component that actually compromised data, but in isolation it was reachable only by an authenticated user, as a blocklist confined it to authenticated contexts. Chained with the batch-endpoint route-confusion flaw (CVE-2026-63030), which stripped away that authentication requirement, the injection became remotely triggerable by an anonymous attacker against a default WordPress installation. According to Akamai, once the gate was removed, an attacker routed an attacker-controlled value into a query unescaped and extracted arbitrary database contents pre-authentication, and from there the injection was leveraged through WordPress's object caching and post-processing to escalate toward code execution. The distinct exploit behavior of this flaw was most visible in the two circulating variants VulnCheck identified: an information-disclosure variant that dumped database contents directly through the injection, and a full remote-code-execution variant that created a rogue administrator without needing to crack any password hash. PatchStack began reporting exploitation shortly before 7 PM ET on July 17, and VulnCheck confirmed active exploitation against production systems as of July 20. WordPress resolved the vulnerability across the patched releases 6.8.6, 6.9.5, and 7.0.2 the broader version range reflecting that this injection affected the 6.8.x branch as well and with public proof-of-concept code available, the flaw was recently added to the CISA KEV catalog.

CVE-2026-63030 - Interpretation Conflict vulnerability in WordPress Core

An interpretation conflict vulnerability existed in WordPress Core, specifically in the REST API batch endpoint, which let clients bundle several API operations into a single request. According to Akamai, a handler-alignment flaw allowed an attacker to have a request validated against one route but executed against a different one, desynchronizing validation from execution and bypassing the parameter sanitization the rest of the REST API relied on. This flaw was the enabler of the pre-authentication chain nicknamed "WP2Shell," disclosed on July 17, 2026 and discovered by Searchlight Cyber: on its own it did not compromise data, but it removed the authentication gate that would otherwise contain the accompanying SQL injection (CVE-2026-60137), converting an authenticated-only weakness into a fully unauthenticated attack path. By making authenticated endpoints reachable without credentials, the route confusion allowed an adversary to assume an administrative context, provision a rogue privileged account, install a malicious plugin, and ultimately achieve remote code execution. Because this endpoint was the single door into the chain, Akamai noted that blocking the initial malicious request disrupted the entire sequence before escalation. PatchStack began reporting exploitation shortly before 7 PM ET on July 17, and VulnCheck's Canary Intelligence network observed active exploitation against production systems as of July 20, verifying more than two dozen public proof-of-concept exploits by July 19. WordPress resolved the vulnerability in the patched releases 6.9.5 and 7.0.2, and with public exploit code available, the flaw was recently added to the CISA KEV catalog.

CVE-2021-27137 - Stack-Based Buffer Overflow vulnerability in DD-WRT

A Stack-Based Buffer Overflow vulnerability in DD-WRT, a Linux-based framework for wireless routers and access points that runs on a wide range of models, allowing an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger code execution. According to SSD Secure Disclosure, UPnP shipped disabled by default and listened only on internal interfaces, so exploitation first required the service to be enabled, after which a remote attacker on the same LAN triggered the overflow by sending an overly long uuid value into the handler, where an unbounded copy into a 128-byte buffer allowed the overwrite. The proof-of-concept sent a crafted SSDP M-SEARCH request to UDP port 1900 with an oversized ST:uuid field consisting of 164 bytes of padding followed by a return-address placeholder, crashing the UPnP service seconds after execution, while escalation beyond the crash depended on platform mitigations such as ASLR. DD-WRT resolved the flaw in changeset 45724 by replacing the unsafe strcpy in the UPnP/SSDP handler (router/upnp/src/ssdp.c) with a bounds-checked copy, and affected versions covered changeset 45723 or prior. Exploited very recently by the Gafgyt variant C0XMO botnet, the vulnerability was subsequently added to the CISA KEV catalog.

Cytellite telemetry captured active exploit attempts and mass scanning campaigns against exposed services globally. The data highlights which vulnerabilities are under attack and provides source IPs and payloads to authorized teams for detailed threat analysis and validation.

Active malware campaigns exploited specific vulnerabilities to deliver payloads and carry out post-exploitation actions. Each targeted vulnerability is proactively monitored, manually analysed, and mapped to MITRE ATT&CK tactics and techniques. Insights are derived from the LOVI vulnerability intelligence platform, which aggregates and curates data from multiple sources, OSINT groups, blogs, and data leak sites.

Qilin Affiliates Exploit Palo Alto Firewall Flaw to Take Over Entire Networks

According to Arctic Wolf, in June 2026 the firm investigated several separate break-ins where attackers used CVE-2026-0257, an authentication-bypass flaw in Palo Alto Networks PAN-OS GlobalProtect, as the way in, and then moved quickly toward deploying Qilin ransomware across entire company networks. The attackers exploited the bug to bypass VPN login entirely and connect as if they had valid credentials, often from systems calling themselves "kali," a hint they used Kali Linux as their attack machine. Once inside, the attackers set up several ways to keep their access alive, including a matching pattern in the Windows registry, and installed extra remote-access tools such as AnyDesk, Ngrok, and LogMeIn so they would not lose their foothold even if one method got blocked or the flaw got patched. They then stole passwords by pulling memory from the LSASS process and by copying the entire Active Directory database using a built-in Windows tool, giving them the keys to every account in the company. With those stolen logins, they explored the network, used tools like PsExec and NetExec to spread to other computers, and in some cases pulled sensitive files out to cloud storage services like MEGA before locking anything, matching a double-extortion style. Before setting off the ransomware, they wiped out Windows event logs and turned off Microsoft Defender's real-time protection so the attack would be harder to trace. Finally, they placed the ransomware file, always named win.exe, inside the folder C:\PerfLogs, a location most security tools do not watch closely, and ran it with a password so it could not be easily analyzed if caught. The result was files across the network getting encrypted, with some victims also having their data stolen and threatened with public leaks, consistent with how the Qilin ransomware-as-a-service group runs its operation through multiple different criminal affiliates using the same toolkit.

NadMesh Botnet: A New Breed of Threat Built for AI Services and MCP Environments

According to Xlab, in early July 2026 the company observed a Go-based botnet pushing bot samples onto the internet at scale, which it named NadMesh after the "n4d mesh controller" string found in the malware's own source code. NadMesh combined scanning, exploitation, and credential and AI-service intelligence harvesting into a single autonomous platform rather than behaving as a one-off worm outbreak, and it operated as a continuously iterated, productized threat aimed squarely at AI infrastructure and the MCP ecosystem. The botnet ran an autonomous scanning engine covering 90-plus built-in cloud-provider address ranges, carried more than 20 exploitation vectors delivering remote code execution across Redis, Docker, MCP, Kubernetes, and other exposed services, and specifically harvested ComfyUI, Ollama, and similar AI-service IP addresses via Shodan, assigning them the highest scan priority. It maintained a built-in web panel with conversion-funnel statistics for observable operations, achieved redundant persistence through an SSH public-key backdoor, an agent process, and a cron watchdog running in parallel, and used polymorphic builds combining Garble obfuscation, UPX packing, and random padding so every agent carried a unique hash. Once it compromised a host, NadMesh harvested cloud credentials, Kubernetes service-account tokens, AI model access, and exploitable MCP tool endpoints, giving the operator a foothold for lateral movement, credential theft, and further propagation. The impact fell primarily on organizations running internet-facing AI and DevOps infrastructure - including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio deployments, alongside exposed Redis, Docker, Kubernetes, and Elasticsearch services - placing cloud-native and AI-service operators squarely in the botnet's highest-priority targeting.

UTA0533 Chains SonicWall SMA Zero-Days to Deploy KNUCKLEBALL and ORANGETAIL

According to Volexity, in early July 2026 the firm investigated a compromise of a customer's SonicWall Secure Mobile Access (SMA) VPN appliances and found that a threat actor tracked as UTA0533 exploited a chain of multiple zero-day vulnerabilities in the devices, meaning the attacker used the flaws before SonicWall publicly disclosed or patched them on July 14, 2026, with the earliest evidence of compromise dating back to June 22, 2026. The attacker first abused CVE-2026-15409, an unauthenticated bypass in the SMA's /wsproxy interface, to tunnel through the appliance and reach normally internal-only services, then used CVE-2026-15410, a path-traversal flaw in the appliance's hotfix-removal function, to execute attacker-supplied code as root and fully take over the device. Once inside, the attacker dropped a privilege-escalation utility called ROOTRUN and a loader malware named KNUCKLEBALL, which injected two hidden Java payloads directly into the appliance's memory: an HTTP proxy tool called Suo5 and a custom webshell named ORANGETAIL, both reachable through disguised web addresses and hidden behind a special browser-identifier check so casual scans would not notice them. With this access, UTA0533 sniffed internal network traffic to steal login credentials and attempted to move further into the victim's network using stolen usernames and passwords, though the attacker had limited success spreading beyond the compromised SMA devices. The two flaws were recently added to the CISA KEV catalog, and organizations running SonicWall SMA 1000-series appliances (models 6210, 7210, and 8200v) are advised to apply the hotfix versions 12.4.3-03453 or 12.5.0-02835 and check for the indicators of compromise Volexity has published.

JADEPUFFER Evolves: Agentic Ransomware Built to Destroy AI Model Infrastructure

According to Sysdig, JADEPUFFER, an agentic threat actor, evolved from data-theft extortion to deploying ransomware purpose-built to destroy AI infrastructure. The operator exploited CVE-2025-3248, a missing-authentication vulnerability in Langflow's /api/v1/validate/code endpoint, to execute arbitrary Python code on the host without authentication, gaining the initial foothold used across all documented campaigns. From this foothold, the operator escalated from improvised Python scripts and MySQL's native encryption function to staging ENCFORGE, a compiled, UPX-packed Go ransomware binary deployed as lockd, built specifically to target AI and machine-learning infrastructure. ENCFORGE targeted roughly 180 file extensions spanning model checkpoints, vector databases, training datasets, and embedding indices, encrypting files using AES-256-CTR combined with an embedded RSA-2048 public key, then renaming affected files with a .locked extension. The operator demonstrated autonomous, self-correcting behavior throughout the intrusion, building and iterating six Python scripts in just over five minutes to construct a Docker-socket-based container-escape mechanism after an initial binary fetch failed, ultimately copying the ransomware binary across the namespace boundary and executing it directly on the host. The extortion contact embedded in ENCFORGE matched the contact disclosed in the operator's prior campaign, confirming continuity of the same threat actor with a materially upgraded toolkit. Sysdig emphasized that this shift carried outsized business impact, since encrypted AI model artifacts could not be restored the way conventional files could, with rebuilding a single production model costing between $75,000 and $500,000 in compute and engineering time.

Open-Source Software (OSS) vulnerabilities are security weaknesses discovered in publicly available codebases that can be exploited across widely used libraries, frameworks, and tools, often impacting thousands of downstream applications.

PRE-NVD vulnerabilities refer to security flaws that are discovered, discussed, or even exploited in the wild before their official inclusion in the National Vulnerability Database (NVD). These early-stage vulnerabilities often emerge through threat actor chatter, exploit proof-of-concepts, and technical disclosures shared across social media platforms and underground forums, signaling potential exploitation risks before public awareness.

Together, this week's activity showed that attackers are moving faster than patch cycles across both traditional enterprise systems and emerging AI infrastructure, leaving organizations with a narrowing window to respond. From KEV-listed flaws to fresh botnets and agentic ransomware, the common thread was clear: exposure anywhere in the stack, from firewalls to AI frameworks, invites exploitation. Staying ahead of this pace requires continuous, prioritized visibility into emerging threats rather than periodic review. Loginsoft's Vulnerability Intelligence service delivers exactly that, helping organizations track, prioritize, and act on threats like these before they turn into breaches.

FAQs

1) What is Langflow?

Langflow is an open-source, visual framework for building LLM-powered applications. It lets users construct and prototype AI workflows through a drag-and-drop interface, connecting components such as models, prompts, and data sources into functional flows.  

2) What is Cisco IOS?

FortiSandbox is Fortinet's advanced threat protection appliance, built to catch what traditional security tools miss. The appliance receives suspicious files and URLs flagged by firewalls, mail gateways, and endpoints across the network, then detonates them in an isolated, controlled environment to observe behavior and identify zero-day malware before reaching end users. Due to the sensitive analysis work involved, SOC analysts, security engineers, and IT teams within larger organizations typically operate FortiSandbox, and the appliance occupies a highly trusted position at the core of the security stack, making any compromise particularly consequential.

3) Does inclusion in the CISA KEV catalog mean exploitation is widespread?

Not necessarily widespread - but confirmed. KEV inclusion indicates verified in-the-wild exploitation. While the scale may vary, the operational reality is that threat actors possess working exploits, making patch prioritization urgent regardless of observed targeting volume.

4) How does LOVI help organizations manage vulnerabilities effectively?

Loginsoft Vulnerability Intelligence empowers you to efficiently prioritize and respond to potential vulnerabilities by focusing on those actively exploited in the wild. LOVI correlates vulnerability data with real-world threat activity to reduce noise and improve decision-making. This approach enables faster remediation and stronger security posture.

5) What is Cytellite?

Cytellite is a Loginsoft security intelligence platform that provides real-time visibility into emerging threats through a global sensor network. It delivers actionable IP intelligence to help organizations detect, analyze, and respond to attacks quickly. By correlating threat data with live activity, Cytellite strengthens resilience across dynamic threat landscapes.