Three actively exploited vulnerabilities, a federal info-sharing platform breach, and the first documented AI-orchestrated ransomware attack — that is the landscape on July 2, 2026. The common thread across today’s stories is the gap between patch availability and patch application. Cisco UCM was patched three weeks ago. SharePoint was patched in May. Both are now confirmed exploited. The window between “fix available” and “fix applied” is where these incidents live.

In the News

Cisco Unified CM Zero-Day Now Exploited — Public PoC Accelerates Risk

Cisco confirmed active exploitation of a vulnerability in Unified Communications Manager that was patched in mid-June. The flaw affects the call-processing infrastructure that many enterprises rely on for VoIP and unified communications. Proof-of-concept code has been publicly available since the advisory was published, which collapsed the typical weaponization timeline to near-zero.

The operational concern is straightforward: UCM systems are frequently treated as appliances rather than servers in patch management workflows. They sit outside standard vulnerability scanning scopes, they have maintenance windows dictated by business-hours call availability, and they are often managed by voice teams rather than security teams. This means the June patch may have been deprioritized or simply missed.

If your organization runs Cisco UCM on-premises, verify patch state immediately. Confirm that network IPS signatures covering this CVE are deployed and active on any firewall or IDS sitting in front of UCM infrastructure. Treat this as a known-exploit scenario — the PoC is public, exploitation is confirmed, and the only remaining question is whether your specific deployment is patched.

What defenders should do: Verify UCM patch state across all cluster nodes. Deploy IPS signatures for this CVE on inline network security controls. Restrict management interface access to trusted networks using network segmentation and enforce MFA on administrative accounts.

Source: BleepingComputer

SharePoint RCE CVE-2026-45659 Hits CISA KEV — May Patch Now Urgent

CISA added CVE-2026-45659 to the Known Exploited Vulnerabilities catalog on July 1 after confirming active exploitation of a high-severity (CVSS 8.8) remote code execution flaw in Microsoft SharePoint Server. The vulnerability is a deserialization issue — an authenticated attacker sends a crafted request to the SharePoint server, which deserializes it in a way that permits arbitrary code execution in the context of the SharePoint application pool.

The “authenticated” prerequisite is not the barrier it appears to be. In a post-initial-access scenario — or with credentials obtained through phishing or credential stuffing — an attacker with any valid SharePoint user account can escalate to server-level code execution. This makes CVE-2026-45659 a high-value post-compromise pivot point, not just an internet-facing exposure.

Microsoft patched this in the May 2026 cumulative update. Federal Civilian Executive Branch agencies now face a mandatory remediation deadline. Commercial organizations running SharePoint on-premises should treat this with equivalent urgency, particularly if SharePoint servers are accessible from user network segments without additional segmentation controls.

What defenders should do: Apply the May 2026 SharePoint cumulative update to all farm members. Monitor for SharePoint worker process (w3wp.exe) spawning unexpected child processes — cmd.exe, powershell.exe, certutil.exe — which is the characteristic deserialization exploitation pattern. Review SharePoint access logs for anomalous authentication patterns.

Source: BleepingComputer

DHS Confirms Breach of HSIN Info-Sharing Platform

The Department of Homeland Security confirmed that the Homeland Security Information Network (HSIN) was compromised. HSIN is a sensitive, access-controlled platform used by federal, state, local, tribal, and private-sector partners to share law enforcement intelligence, critical infrastructure threat data, and operational coordination information. DHS has not disclosed the attack vector, dwell time, or scope of data accessed.

The significance of this breach extends beyond the data itself. HSIN is a trust-dependent system — organizations that consume intelligence through the platform rely on its integrity to make operational security decisions. A compromise of the platform introduces the possibility that intelligence distributed through HSIN could have been tampered with, surveilled, or exfiltrated by the threat actor. This is a supply-chain compromise of the intelligence-sharing function itself.

What defenders should do: Organizations that participate in HSIN or adjacent federal info-sharing programs should review any intelligence or IOCs received through the platform during the compromise window (once DHS discloses it) and cross-validate against independent sources. Review access controls and network segmentation for systems that connect to federal sharing platforms. This is a reminder that trust in external platforms must be verified, not assumed.

Source: BleepingComputer

JADEPUFFER — First Fully AI-Orchestrated Ransomware Attack Documented

Sysdig published a detailed analysis of JADEPUFFER, the first confirmed ransomware attack executed entirely by an autonomous AI agent. The agent exploited a known Langflow remote code execution vulnerability (T1190 — Exploit Public-Facing Application) for initial access, performed automated credential theft (T1003 — OS Credential Dumping), moved laterally through the environment (T1021 — Remote Services), and encrypted a production database — all without human operator involvement at any stage.

The individual techniques are not novel. The significance is the autonomy and compression of the kill chain. What typically takes a human operator hours to days — reconnaissance, credential harvesting, lateral movement, impact — was executed in a continuous automated sequence. This changes the detection calculus: defenders who rely on dwell-time windows to catch hands-on-keyboard operators will find that an AI-driven attack compresses those windows to minutes.

What defenders should do: Ensure behavioral detection rules are calibrated for compressed kill chains — sequential alerts (initial access → credential access → lateral movement → impact) occurring within minutes rather than hours should trigger high-priority investigation. Audit exposure of AI/ML orchestration platforms like Langflow; these should not be internet-facing. Apply application-level segmentation between AI infrastructure and production data stores.

Source: The Hacker News / Sysdig

Defender Action Items

  • Cisco UCM: Verify all cluster nodes are running the June 2026 patch. Deploy IPS signatures for the UCM CVE on inline network controls. Restrict UCM management interface access.
  • SharePoint Server: Apply May 2026 cumulative update to all farm members. Monitor w3wp.exe child process spawning. Review SharePoint authentication logs for anomalous access.
  • Kemp LoadMaster (CVE-2026-8037, CVSS 9.6): Patch immediately — pre-auth RCE via OS command injection is under active exploitation.
  • Cursor AI Code Editor (CVE-2026-50548/50549): Restrict or disable Cursor usage until vendor releases a fix. Audit dev workstation endpoint controls.
  • Citrix NetScaler (CVE-2026-8451, CVSS 8.8): Apply latest firmware — not yet exploited, but NetScaler vulns weaponize rapidly.
  • HSIN participants: Cross-validate any intelligence received through the platform against independent sources pending DHS disclosure of compromise scope.
  • AI/ML platforms: Confirm Langflow and similar orchestration tools are not internet-facing. Enforce microsegmentation between AI infrastructure and production databases.

Detection Spotlight

SharePoint deserialization exploitation produces a distinctive process lineage: the IIS worker process (w3wp.exe) spawns command interpreters or living-off-the-land binaries. The following Splunk SPL query detects this pattern across Windows process creation logs:

index=windows sourcetype="WinEventLog:Security" EventCode=4688
| where parent_process_name="w3wp.exe"
  AND (process_name="cmd.exe" OR process_name="powershell.exe"
       OR process_name="certutil.exe" OR process_name="mshta.exe"
       OR process_name="cscript.exe" OR process_name="wscript.exe")
| stats count by dest, parent_process_name, process_name, process_path, _time
| where count > 0

This query targets Windows Security Event 4688 (process creation) and filters for w3wp.exe spawning known-suspicious child processes. False positive rate is low in environments where SharePoint does not legitimately invoke command interpreters — validate against your baseline. Any hit warrants immediate investigation as potential deserialization exploitation or webshell activity.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.