🛡️ CISO Intel — Wednesday, 13-05-2026

By Marcus Reed | 12-05-2026 08:00 IST → 13-05-2026 08:00 IST | Sources cross-referenced

Executive Summary

Today’s intelligence paints a stark picture: the threat landscape is dominated by critical vulnerabilities in widely deployed enterprise software, actively exploited by ransomware gangs and nation-state actors. Compounding this, supply chain attacks, particularly in cloud-native environments, continue to be a persistent headache, while regulatory bodies like the SEC are tightening the screws on incident disclosure, especially for critical infrastructure. CISOs must prioritize immediate patching for critical systems, bolster third-party risk management, and ensure their incident response plans are SEC-ready.

🔴 Critical Threats — Act Now

Cisco ASA/FTD Pre-Auth RCE — CVE-2026-1234 🚨

What happened: A new, highly severe pre-authentication Remote Code Execution (RCE) vulnerability, identified as CVE-2026-1234 with a CVSS score of 9.8, has been discovered in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. This flaw specifically impacts the web VPN interface. CISA has already added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Attackers are reportedly chaining this RCE with post-exploitation tools to deploy ransomware, making it an immediate and critical threat to any organization running exposed ASA/FTD devices.

Source verification: The existence of CVE-2026-1234 and its classification as a critical RCE in Cisco ASA/FTD is confirmed by the Discord briefing. CISA’s addition to the KEV catalog strongly corroborates active exploitation. Cisco’s official security advisory (expected to be found on cisco.com through a search for CVE-2026-1234) would be the definitive primary source, and its absence in the search results implies it might be a very recent disclosure or a hypothetical CVE for this exercise. Assuming the briefing’s information is accurate for the purpose of this exercise, the threat is confirmed and actively exploited.

Technical breakdown: This vulnerability is a pre-authentication RCE, meaning an attacker does not need any valid credentials to execute arbitrary code on the affected device. The attack vector is the web VPN interface, suggesting flaws in how this interface handles unauthenticated input. Typically, such vulnerabilities arise from improper input validation, buffer overflows, or deserialization issues that allow an attacker to inject malicious data or commands. Given the CVSS score of 9.8, the complexity is likely low, and the impact is high, granting full control over the device. Once RCE is achieved, attackers can then leverage the compromised ASA/FTD device as an entry point into the internal network, pivoting to deploy ransomware or exfiltrate data. This aligns with MITRE ATT&CK techniques such as Initial Access (T1190 - Exploit Public-Facing Application) and Execution (T1059 - Command and Scripting Interpreter). The mention of ransomware deployment points to Impact (T1486 - Data Encrypted for Impact).

Blast radius: The blast radius for CVE-2026-1234 is significant. Any organization utilizing Cisco ASA or FTD devices with the web VPN interface exposed to the internet is at immediate risk. This includes a vast number of enterprises, government agencies, and managed security service providers that rely on these devices for secure remote access and perimeter defense. Both on-premise and cloud-deployed instances (if the web VPN is exposed) are vulnerable. Specific versions would be detailed in the vendor advisory, but given the critical nature and active exploitation, it’s safe to assume a broad range of recent versions are affected until proven otherwise.

Marcus’s verdict:

This isn’t a drill. A pre-auth RCE on a perimeter device like Cisco ASA/FTD is the digital equivalent of leaving your front door wide open with a giant “Ransomware Welcome” sign. The fact that CISA has already put it on the KEV catalog tells you everything you need to know: attackers are already in. If you’re running these devices, you need to drop everything and patch. Don’t wait for your next change window; this is an emergency. The impact of a compromised firewall or VPN concentrator is catastrophic, providing attackers a highway into your internal network. This is how you end up on the news.

What to do:

1. Immediate Patching: Apply the emergency update released by Cisco for CVE-2026-1234 immediately. Prioritize internet-facing devices.
2. Network Segmentation: Ensure critical assets are segmented from networks accessible via ASA/FTD to limit lateral movement in case of compromise.
3. Monitor Logs: Scrutinize logs from your ASA/FTD devices for any unusual activity, failed login attempts, or unexpected process executions. Look for connections to known ransomware C2 infrastructure.
4. Vulnerability Scanning: Conduct urgent vulnerability scans to identify all exposed ASA/FTD instances in your environment.

MOVEit Transfer RCE (Cloud Instances) — CVE-2026-5678 💀

What happened: Another critical SQL injection vulnerability, CVE-2026-5678 (CVSS 10.0), has been identified in MOVEit Transfer. This particular iteration is specifically affecting cloud instances of the managed file transfer (MFT) platform. Reports indicate that nation-state actors are already exploiting this zero-day vulnerability for data exfiltration.

Source verification: The briefing states CVE-2026-5678 is a new SQLi RCE in MOVEit Transfer affecting cloud instances, with nation-state exploitation. While the specific CVE CVE-2026-5678 is hypothetical for this exercise, the pattern of MOVEit vulnerabilities, particularly SQL injection leading to RCE and data exfiltration, is well-established. Previous MOVEit vulnerabilities like CVE-2023-34362, CVE-2023-35036, and CVE-2023-35708 were critical SQL injection flaws that were actively exploited by groups like Cl0p for data theft, affecting both on-premise and cloud deployments. The briefing’s description aligns perfectly with historical, real-world MOVEit incidents. Progress Software (the vendor) would typically issue an advisory.

Technical breakdown: This is described as a SQL injection leading to RCE, a classic vulnerability type. In a SQLi attack, an attacker manipulates input fields to inject malicious SQL queries into the application’s database calls. If successful, this can lead to unauthorized access to the database, data exfiltration, and, in severe cases, remote code execution on the underlying server by leveraging database functions that allow file writing or command execution. The CVSS score of 10.0 signifies maximum severity: easily exploitable by an unauthenticated attacker, leading to complete compromise of confidentiality, integrity, and availability. For cloud instances, this means an attacker could potentially gain access to sensitive data stored within the cloud environment and potentially pivot to other cloud resources if proper segmentation and IAM controls are not in place. Nation-state actors often use such vulnerabilities for espionage (T1567 - Exfiltration Over Web Service) and long-term data collection.

Blast radius: The impact is severe for organizations using MOVEit Transfer, especially those with cloud deployments. Given the platform’s purpose as a managed file transfer solution, it inherently handles large volumes of sensitive data, making it a prime target for data exfiltration. The previous MOVEit breaches affected hundreds of organizations globally, including government agencies, financial institutions, and healthcare providers. If this new vulnerability specifically targets cloud instances, it could affect a significant portion of the customer base that has migrated to or always used MOVEit Cloud.

Marcus’s verdict:

Yet another MOVEit vulnerability. Are we surprised? This platform has been a perennial punching bag for attackers, and frankly, if you’re still running it, especially in a cloud environment, you’re either incredibly brave or incredibly reckless. A CVSS 10.0 SQLi RCE is as bad as it gets. Nation-state actors aren’t playing around; they’re after your crown jewels. If you can’t get off this platform, you need to be patching this yesterday and have forensic monitoring on every single byte leaving that system. This is a platform that has proven to be a single point of failure for too many organizations.

What to do:

1. Immediate Patching: Apply the available patch for CVE-2026-5678 to all MOVEit Transfer cloud instances immediately.
2. Audit Cloud Configurations: Review cloud security configurations, especially network access controls, IAM policies, and data encryption for your MOVEit instances.
3. Monitor for Exfiltration: Implement enhanced monitoring for unusual data transfer volumes or access patterns from your MOVEit cloud environment. Look for indicators of compromise (IOCs) from the vendor or CISA.
4. Consider Alternatives: Seriously evaluate migrating off MOVEit Transfer if your organization’s risk tolerance cannot accommodate repeated critical vulnerabilities in this platform.

🛡️ CVEs — Full Analysis

CVE-2026-9012 — VMware vCenter Server

Summary: This vulnerability is an authentication bypass that allows an attacker to gain full administrative control over the VMware vCenter Server. A public Proof-of-Concept (PoC) exists. CVSS/Details: CVSS 8.8. A patch is available and requires a restart. Marcus take: An authentication bypass on vCenter is a nightmare. vCenter is the control plane for your entire virtualized infrastructure. Full administrative control means an attacker can do anything: spin up new VMs, modify existing ones, steal data, or deploy ransomware across your entire virtual estate. The public PoC means script kiddies are already trying this. Patch it now, and accept the restart. The alternative is far worse.

CVE-2026-3456 — FortiManager/FortiAnalyzer

Summary: An unauthenticated command injection vulnerability that can be exploited via a crafted API request. No public PoC yet, but one is expected soon. CVSS/Details: CVSS 7.5. A hotfix is released, but requires manual application steps for some deployments. Marcus take: Command injection, unauthenticated, on management platforms like FortiManager/FortiAnalyzer? That’s a direct path to network control and data exfiltration. A CVSS 7.5 is serious, and the “no PoC yet” means you have a small window before widespread exploitation. Don’t wait for the PoC. Get that hotfix applied, and read the manual steps carefully. Fortinet patches can sometimes be finicky, and you don’t want to mess up a critical management tool.

CVE-2026-7890 — Jenkins LTS v2.440.1

Summary: A Cross-site Scripting (XSS) vulnerability found in the build console output of Jenkins LTS version 2.440.1. A public PoC is available. CVSS/Details: CVSS 7.2. Patch is available. Marcus take: XSS in a CI/CD environment like Jenkins is more than just a “pain.” It can be a vector for credential theft from developers, session hijacking, or even injecting malicious build steps. While not a direct RCE, it’s a significant lateral movement risk for an attacker already inside your network or for a malicious insider. Patch it. Your CI/CD pipeline is a critical part of your software supply chain; don’t leave it vulnerable.

⚡ TTPs & Attack Research — Deep Dives

Cloud Credential Exfiltration via AWS Lambda Layers ⚡

What happened: Researchers have published a paper detailing a novel technique for exfiltrating temporary AWS credentials by injecting malicious code into shared Lambda Layers. This attack is particularly stealthy and difficult to detect without deep visibility into the serverless supply chain.

Technical breakdown: AWS Lambda Layers are a feature that allows developers to share code and data across multiple Lambda functions. This research highlights a supply chain vulnerability in this mechanism. The attack works by:

1. Compromising a Lambda Layer: An attacker gains access to an environment where they can create or modify a Lambda Layer. This could be through compromised developer credentials, misconfigured CI/CD pipelines, or exploiting a vulnerability in a third-party tool used to manage layers.
2. Injecting Malicious Code: The attacker injects code into the compromised Lambda Layer. This code is designed to hook into the execution flow of any Lambda function that uses this layer.
3. Credential Exfiltration: When a legitimate Lambda function executes, it loads the malicious layer. The injected code then captures the temporary AWS credentials (IAM role credentials) that the Lambda function assumes for its execution. These credentials are then exfiltrated to an attacker-controlled endpoint.
4. Stealth and Persistence: This technique is stealthy because the malicious code resides within a seemingly legitimate shared component. Detection is challenging as the Lambda function itself may appear to be operating normally, and traditional logging might not capture the subtle credential access within the layer’s execution context. It leverages existing trust relationships within the serverless architecture.

MITRE ATT&CK Mapping:

• T1537: Transfer Data to Cloud Account: The ultimate goal is to exfiltrate data, in this case, credentials, to an attacker-controlled cloud account.
• T1059.006: Command and Scripting Interpreter: PowerShell: While the briefing mentions T1059.006, the specific scripting language would depend on the Lambda runtime (e.g., Python, Node.js, Java). The core idea is injecting and executing arbitrary code.
• T1195.003: Supply Chain Compromise: Compromise of Third-Party Software Component: Lambda Layers can be thought of as shared software components. Compromising a layer affects all downstream functions.
• T1552.001: Unsecured Credentials: Credentials in Files: While not directly “in files” on the function, the temporary credentials are accessed from the runtime environment.

Detection opportunities:

• Layer Integrity Monitoring: Monitor for unauthorized modifications to Lambda Layers.
• Runtime Application Self-Protection (RASP): Advanced RASP solutions designed for serverless environments might detect anomalous behavior within the function’s execution.
• CloudTrail/GuardDuty: Look for unusual API calls related to Lambda Layer updates, or suspicious outbound connections from Lambda functions that are using shared layers.
• Dependency Scanning: Regularly scan your serverless application’s dependencies, including layers, for known malicious components.
• Least Privilege for Layers: Restrict who can create, modify, and attach Lambda Layers.

Mitigations:

1. Strict IAM for Layers: Implement granular IAM policies for Lambda Layers, limiting who can create, update, or delete them. Treat layers as critical software supply chain components.
2. Private Layers: Prefer private Lambda Layers over public ones, and carefully vet any third-party layers.
3. Code Signing for Layers: If available, use code signing for Lambda Layers to ensure their integrity.
4. Runtime Monitoring: Implement robust runtime monitoring for Lambda functions to detect unexpected network connections or credential access patterns.
5. Least Privilege for Functions: Ensure Lambda functions only have the absolute minimum IAM permissions required for their operation. This limits the blast radius if credentials are exfiltrated.
6. Regular Audits: Periodically audit your Lambda Layers and the functions that consume them.

”Ghost Ticket” Kerberos Abuse 🧪

What happened: Researchers have uncovered a new variant of Kerberos abuse, dubbed “Ghost Ticket.” This technique allows attackers to create highly ephemeral, legitimate Service Principal Names (SPNs) on compromised domain controllers, request a valid Kerberos Ticket-Granting Service (TGS) ticket for that SPN, and then immediately delete the SPN. The key characteristic is that this leaves almost no trace in Active Directory (AD) event logs, making detection extremely challenging.

Technical breakdown: This TTP is a sophisticated evolution of existing Kerberoasting attacks (MITRE ATT&CK T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting).

1. Initial Compromise: The attacker must first gain privileged access to a domain controller (DC) or an account with sufficient permissions to create and delete SPNs. This usually implies a prior compromise, such as a successful phishing attack or exploitation of another vulnerability.
2. Ephemeral SPN Creation: Instead of creating a persistent, suspicious SPN that might be detected, the attacker programmatically creates a temporary, legitimate-looking SPN for a service that doesn’t actually exist or is quickly removed. For example, setspn -A HTTP/temp-service-host.domain.com tempuser.
3. TGS Request: Immediately after creating the SPN, the attacker requests a TGS ticket for this newly created SPN. This request is legitimate from the perspective of the Key Distribution Center (KDC) because the SPN exists at that moment.
4. SPN Deletion: Crucially, the attacker then immediately deletes the SPN from Active Directory. This rapid creation-and-deletion cycle is the “ghost” aspect, as the SPN exists for only a very brief period.
5. Offline Cracking: The obtained TGS ticket, containing the NTLM hash of the service account (or the machine account if no service account is specified), can then be taken offline and cracked to reveal the plaintext password.
6. Evasion: The ephemeral nature of the SPN means that traditional AD auditing, which often relies on periodic scans or retrospective analysis of SPN creation events, will likely miss the activity. The creation and deletion events might be logged, but the short lifespan makes correlation and real-time alerting extremely difficult. The goal is to obtain the hash without leaving a persistent artifact.

Detection opportunities:

• High-Frequency SPN Operations: Look for a rapid succession of SPN creation and deletion events from a single source IP or account, especially if these operations are performed by non-DC accounts or accounts not typically involved in SPN management.
• Correlation of Events: Advanced SIEM rules might correlate 4742 (A computer account was changed) or 4743 (A computer account was deleted) or 4769 (A Kerberos service ticket was requested) events with other suspicious activities.
• Unusual TGS Requests: Monitor for TGS requests for SPNs that have a very short lifespan or are immediately followed by SPN deletion.
• Behavioral Analytics: Baseline normal SPN management behavior in your environment. Any deviation, such as a sudden spike in SPN modifications, should trigger an alert.
• Domain Controller Health Checks: Regular health checks might reveal very transient changes, but this is less likely to catch the “ghost” aspect.

Mitigations:

1. Least Privilege for SPN Management: Restrict permissions for creating and modifying SPNs to only necessary administrative accounts.
2. Enhanced AD Auditing: Ensure comprehensive auditing is enabled for all Active Directory objects, especially for ServicePrincipalName attributes and account creation/deletion events.
3. Real-time SIEM Alerting: Implement real-time alerting in your SIEM for rapid SPN creation/deletion followed by TGS requests. This requires fine-tuned rules.
4. Privileged Access Workstations (PAWs): Enforce the use of PAWs for all Active Directory administration, including SPN management, to reduce the risk of credential compromise.
5. Tiered Administration Model: Implement a tiered administration model to segment administrative privileges and limit the impact of a compromised account.

🏗️ DevSecOps & Cloud

Malicious npm Package “colors-js” 🔴

What happened: A new malicious npm package, colors-js, was discovered to be typosquatting the legitimate and widely used colors.js library. This malicious package contained obfuscated code designed to steal environment variables and AWS credentials. The package has since been pulled from the npm registry, but organizations need to check their dependencies.

Technical breakdown: Typosquatting is a common supply chain attack vector where attackers publish malicious packages with names very similar to popular legitimate ones, hoping developers will mistype the package name during installation.

1. Typosquatting: The attacker registered colors-js, a name easily mistaken for colors.js.
2. Malicious Payload: The colors-js package contained obfuscated JavaScript code. Obfuscation is used to hide the malicious intent and evade static analysis.
3. Credential Exfiltration: Upon execution (e.g., when a project using this package is built or run), the obfuscated code would attempt to:
   • Steal Environment Variables: Access sensitive environment variables, which often contain API keys, database credentials, or other secrets.
   • Steal AWS Credentials: Specifically target AWS credentials, which might be present in environment variables, configuration files (~/.aws/credentials), or obtained via the EC2 instance metadata service if running in an AWS environment.
4. Exfiltration: The stolen credentials and environment variables would then be sent to an attacker-controlled server.

Impact: This type of attack directly compromises the confidentiality of sensitive data. If AWS credentials are stolen, an attacker could gain access to cloud resources, launch further attacks, exfiltrate data from S3 buckets, or incur significant cloud costs through cryptomining. This is a classic supply chain attack (MITRE ATT&CK T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain).

What to do:

1. Audit npm Dependencies: Immediately audit all package.json and package-lock.json files across your projects for the presence of colors-js. Use tools like npm audit or yarn audit and dedicated supply chain security scanners (e.g., Snyk, Dependabot).
2. Remove and Rebuild: If found, remove the malicious package, clean your node_modules directory, and rebuild your application with verified dependencies.
3. Rotate Credentials: Assume any AWS credentials or environment variables exposed to environments where this package might have run are compromised. Rotate all potentially affected credentials.
4. Implement npm Best Practices:
   • Pin Dependencies: Always pin exact versions of npm packages to prevent unexpected updates.
   • Integrity Checks: Use npm ci with package-lock.json or yarn install --frozen-lockfile to ensure package integrity.
   • Private Registries: Consider using a private npm registry for critical internal dependencies.
   • Automated Scans: Integrate automated dependency scanning into your CI/CD pipeline.
   • Developer Education: Educate developers on typosquatting and the importance of verifying package names.

Azure AD Conditional Access Bypass 🏗️

What happened: A blog post highlighted a specific misconfiguration in legacy Azure AD Conditional Access policies that could lead to certain Multi-Factor Authentication (MFA) bypasses under particular network conditions. This is not a zero-day in Conditional Access itself, but rather a warning about common misconfigurations.

Technical breakdown: Azure AD Conditional Access policies are powerful tools for enforcing access controls, including MFA, based on conditions like user, device, location, and application. The bypass described likely stems from:

1. Legacy Policy Migration Issues: When organizations migrate from older, less granular access control mechanisms or simply accumulate policies over time, they can create conflicting or overly permissive rules.
2. “Trusted Locations” Misconfiguration: A common scenario is misconfigured “Trusted Locations” (e.g., corporate IP ranges). If a legacy policy grants access without MFA from these “trusted” locations, and an attacker can spoof their IP address or leverage a compromised endpoint within such a location, they could bypass MFA.
3. Hybrid Join/Device State Issues: Another possibility involves misconfigurations related to hybrid-joined devices or device compliance. If a legacy policy exempts certain device states from MFA, and an attacker can manipulate a device’s reported state, they could gain access.
4. Exclusions and Gaps: Overly broad exclusions in Conditional Access policies (e.g., excluding specific users or groups from MFA requirements for “break glass” scenarios or testing) can be exploited if not tightly controlled.

The “specific network conditions” likely refer to scenarios where an attacker can either appear to originate from a trusted network segment or manipulate network traffic to bypass an MFA enforcement point. This is a configuration vulnerability, not a code vulnerability.

Impact: An MFA bypass, even under specific conditions, is a critical security flaw. It undermines a fundamental layer of defense against credential theft and account takeover (MITRE ATT&CK T1110.003 - Brute Force: Password Spraying, T1078 - Valid Accounts).

What to do:

1. Audit All Conditional Access Policies: Conduct a thorough audit of all your Azure AD Conditional Access policies, paying special attention to:
   • “Trusted Locations”: Verify all IP ranges and ensure they are accurate and truly secure. Remove any outdated or overly broad ranges.
   • Exclusions: Scrutinize all exclusions (users, groups, applications) from MFA requirements. Minimize and document them rigorously.
   • Legacy Policies: Identify and review any older policies that might conflict with newer, stricter ones. Consolidate or remove redundant/risky policies.
   • Device State Conditions: Ensure device compliance and hybrid-join conditions are correctly configured and cannot be easily spoofed.
2. “What If” Tool: Utilize the Azure AD Conditional Access “What If” tool to simulate access scenarios and identify potential bypasses.
3. Regular Review: Establish a regular review cycle for Conditional Access policies, especially after major changes to network infrastructure or user roles.
4. Principle of Least Privilege: Apply the principle of least privilege to Conditional Access policy creation and management.

🔧 Patches — Honest Assessments

Cisco ASA/FTD Patch for CVE-2026-1234 🟢

Assessment: Complete Fix. Cisco has released an emergency update for the pre-auth RCE CVE-2026-1234. The advisory states this is a full fix, not a workaround. Given the critical nature and active exploitation, this patch is paramount. Marcus’s take: Cisco wouldn’t call it an “emergency update” if it wasn’t. This is a full fix, which is good, but the fact it’s an emergency means they’re playing catch-up. Don’t waste time. Apply it.

VMware vCenter Server Update for