A CVSS 9.4 unauthenticated RCE in GitLab’s GraphQL API puts every self-hosted CI/CD pipeline in the blast radius. Meanwhile, CISA confirms ransomware operators are chaining a Windows Task Host privilege-escalation flaw they have had months to patch — and a single attacker infrastructure has quietly scraped 3.6 million Azure account records from Fortune 500 Salesforce and ServiceNow portals. Three different failure modes, one common thread: the assets defenders forget to inventory are the ones attackers find first.

In the News

GitLab CVE-2026-19478: Unauthenticated RCE via GraphQL API

GitLab has patched a critical vulnerability (CVE-2026-19478, CVSS 9.4) in CE/EE that allows unauthenticated attackers to execute arbitrary code and delete public projects through the GraphQL API. The flaw requires no authentication — any internet-facing GitLab instance with public projects is exploitable.

The attack vector matters more than the CVSS score here. GitLab is not just a code repository; it is CI/CD infrastructure. An attacker who can execute code on a GitLab server can inject malicious steps into build pipelines, poison artifacts, or exfiltrate secrets stored in CI/CD variables. This is the same supply-chain attack surface that has driven major incidents over the past two years — from compromised build systems to poisoned dependencies.

No exploitation has been observed in the wild yet. That window is closing. Unauthenticated RCE vulnerabilities in internet-facing developer infrastructure have historically short dwell times between disclosure and weaponization. Organizations running self-hosted GitLab should treat this as a same-day patch item. If immediate patching is not possible, restrict network access to the GraphQL API endpoint and audit public project settings.

What defenders should do: Patch GitLab CE/EE immediately. If patching is delayed, restrict access to the GraphQL API endpoint at the network layer. Audit all public projects and CI/CD pipeline configurations for unauthorized modifications. Review CI/CD pipeline security controls and ensure pipeline secrets are not accessible to unauthenticated API calls.

CISA Confirms Ransomware Gangs Exploiting Windows Task Host Flaw

CISA has added a Windows Task Host privilege-escalation vulnerability to the Known Exploited Vulnerabilities catalog after confirming active exploitation by ransomware operators. The flaw, first disclosed in April 2026, allows escalation from standard-user context to SYSTEM — the highest privilege level on a Windows host.

Ransomware groups are chaining this with initial-access vectors (phishing, compromised credentials, exposed RDP) to escalate privileges before deploying encryptors. The pattern is now well-established: initial access through a commodity vector, privilege escalation through an unpatched local flaw, lateral movement via credential dumping and SMB, domain compromise, and encryption. The Task Host bug fills the privilege-escalation gap in that chain.

The timeline tells the story. The vulnerability was flagged in April. It is now August, and ransomware gangs are using it operationally. Every month between disclosure and patch deployment is a month the attacker had the advantage. Organizations still running a 30-day patch cycle for Windows endpoints are structurally behind.

What defenders should do: Patch all Windows endpoints immediately. Monitor for SYSTEM-level process creation from unexpected parent processes — specifically Task Host (taskhost.exe) spawning cmd.exe, PowerShell, or other interpreters. Review EDR behavioral detection policies for privilege-escalation patterns. Validate that endpoint detection coverage extends to the specific escalation mechanism.

City Forum Campaign Scrapes 3.6M Azure Records from Customer Portals

A threat actor operating from a single IP address (158.220.87.79) has systematically scraped Salesforce and ServiceNow customer-facing portals to exfiltrate 3.6 million Azure account records across Fortune 500 organizations. The campaign, tracked as “City Forum,” has been active since at least 2025.

The mechanism is not a zero-day. It is a configuration gap. Salesforce and ServiceNow customer portals support guest-user access and API integrations that, when misconfigured, expose internal records to unauthenticated or low-privilege queries. The attacker did not break in — they walked through doors that were left open. Guest-access permissions, overly broad API scopes, and missing rate-limiting allowed systematic data exfiltration at scale.

This is a cloud-IAM problem that most organizations do not know they have. Customer-facing portal configurations are rarely included in security posture assessments, and SaaS platform settings sit outside the scope of most vulnerability scanners. The 3.6 million records were not stolen through malware or exploits — they were available to anyone who asked the right API questions.

What defenders should do: Audit guest-user permissions on all Salesforce and ServiceNow portals. Review API integration scopes for overly permissive access. Implement rate-limiting on customer-facing portal APIs. Block IP 158.220.87.79 at the network perimeter and in SaaS platform IP-allowlists. Search network and SaaS logs for prior connections to this IP.

Fortinet Acquires Virtue AI for AI-Model Security

Fortinet has acquired Virtue AI, a startup focused on protecting agentic AI systems and enforcing LLM guardrails. The acquisition embeds AI-model protection — prompt injection defense, model-output validation, and agentic-system access controls — directly into Fortinet’s NGFW and SASE portfolio.

This is a competitive-landscape item, not a customer-action item. But the signal matters: a major NGFW/SASE vendor is now positioning GenAI security as a platform differentiator. Expect every security vendor to be asked “what do you do about AI risk?” in renewal conversations through the end of the year. The organizations that can articulate a clear answer — with specific controls mapped to specific AI risk scenarios — will hold position in competitive deals.

Defender Action Items

  • GitLab CE/EE: Patch CVE-2026-19478 immediately. Restrict GraphQL API access at the network layer if patching is delayed. Audit public project CI/CD configurations for unauthorized modifications.
  • Windows estate: Patch the Task Host privilege-escalation flaw. Monitor for taskhost.exe spawning shell processes. Validate EDR behavioral policies cover this escalation pattern.
  • Salesforce/ServiceNow portals: Audit guest-user permissions and API integration scopes. Block 158.220.87.79. Search logs for historical connections to this IP.
  • WordPress (Forminator plugin): Update to patched version — CVE-2026-15748 (CVSS 9.8) allows unauthenticated file upload to RCE. 300k+ sites affected.
  • Edge devices / IoT: Review Evooo1Bot indicators — Mirai variant turning routers and edge gateways into SOCKS5 proxies with credential-theft modules.

Detection Queries

The following Splunk SPL query detects potential Windows Task Host privilege-escalation attempts by identifying taskhost.exe spawning interactive shells — a behavioral pattern consistent with the exploitation chain CISA flagged:

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
ParentImage="*\\taskhost.exe"
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
| stats count by Computer, User, ParentImage, Image, CommandLine, _time
| where count > 0

This query targets Sysmon Event ID 1 (process creation) and filters for shell processes spawned by taskhost.exe. False positive rate is low in most environments — legitimate Task Host operations rarely spawn interactive interpreters. Tune by excluding known scheduled-task command lines specific to your environment. Correlate hits with patch-status data to prioritize investigation on unpatched hosts.

For the City Forum scraping campaign, a simple network-layer check:

index=firewall OR index=proxy dest_ip="158.220.87.79"
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_port
| sort -count

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.