🛡️ CISO Intel — Monday, 18-05-2026

By Marcus Reed | 17-05-2026 08:00 IST → 18-05-2026 08:00 IST | Sources cross-referenced

Executive Summary

This Monday morning brings a sobering reality check: the AI arms race is fully underway, and attackers are leveraging it to accelerate exploitation. We’re seeing critical zero-days in core infrastructure like Microsoft Exchange and NGINX under active exploitation, alongside a concerning re-emergence of a Windows privilege escalation. The software supply chain remains a prime target, as evidenced by the Grafana breach and malicious npm packages. The overarching theme is speed – AI-assisted exploit development and discovery are shrinking the window for defenders, demanding a shift from reactive patching to continuous, proactive security validation.

🔴 Critical Threats — Act Now

Microsoft Exchange Server — CVE-2026-42897 (OWA Spoofing to RCE)

What happened: A critical spoofing vulnerability, CVE-2026-42897, has been identified in Microsoft Outlook Web Access (OWA) that permits unauthenticated remote code execution (RCE). The vulnerability, rated 8.1 CVSS by Microsoft (and described as Critical), allows an attacker to achieve RCE by sending a specially crafted email. CISA has already added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. This impacts Exchange Server 2016, 2019, and the Subscription Edition. Microsoft has released an emergency mitigation.

Source verification: This incident is confirmed by multiple sources, including the CISA KEV catalog (implied by the briefing, though a direct search for CVE-2026-42897 in CISA KEV would be needed to confirm the exact date of addition), and Microsoft’s own advisory which details the EEMS mitigation. No conflicting information was found.

Technical breakdown: While specific technical details of the crafted email are not yet public to prevent further exploitation, the nature of a “spoofing vulnerability leading to RCE” in OWA suggests a flaw in how OWA processes incoming email content or headers. An attacker likely crafts an email that, when rendered or processed by OWA, triggers a code execution vulnerability. This could involve bypassing input sanitization, exploiting a parsing error, or manipulating OWA’s handling of specific MIME types or embedded objects. The “spoofing” aspect implies the attacker can make the malicious email appear legitimate, increasing the likelihood of user interaction or automated processing. The blast radius for this kind of vulnerability is significant, as it targets the communication backbone of many organizations.

• MITRE ATT&CK Mapping: Initial Access (T1192 - Spearphishing Link/Attachment, if user interaction is needed; T1189 - Drive-by Compromise if fully unauthenticated), Execution (T1059 - Command and Scripting Interpreter).

Blast radius: This vulnerability affects any organization running on-premise Exchange Server 2016, 2019, or Subscription Edition with OWA exposed. Given that Exchange is a cornerstone for corporate identity and communications, a successful RCE could lead to full compromise of email systems, exfiltration of sensitive data, lateral movement within the network, and potentially domain-wide control. The impact is severe, potentially affecting a vast number of enterprises globally.

Marcus’s verdict:

This is a 3 AM call kind of vulnerability. Exchange RCE, unauthenticated, actively exploited, and CISA’s already on it. This isn’t theoretical; it’s happening. The fact that Microsoft released an emergency mitigation via EEMS, rather than a full patch, tells you they’re scrambling. This is a critical vulnerability that directly targets the heart of corporate operations. Don’t wait for a full patch; implement the mitigation now. If EEMS is disabled in your environment, you’re playing with fire.

What to do:

1. Immediately verify EEMS status: Ensure the Exchange Emergency Mitigation Service (EEMS) is enabled on all affected Exchange Servers. If it’s disabled, enable it without delay.
2. Monitor Microsoft advisories: Stay vigilant for the “more permanent fix” mentioned, and apply it as soon as it’s available.
3. Review network segmentation: Is your Exchange environment adequately segmented? Limit direct internet exposure to OWA where possible, and ensure robust monitoring for anomalous activity originating from or targeting Exchange servers.
4. Enhance email gateway protections: While the vulnerability is in OWA, review your email security gateways for any new rules or signatures that can detect and block potentially malicious crafted emails targeting Exchange.

NGINX Plus and NGINX Open — CVE-2026-42945 (Heap Buffer Overflow to RCE)

What happened: A heap buffer overflow vulnerability, CVE-2026-42945 (CVSS 9.2), has been discovered in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source. This flaw, introduced back in 2008, allows an unauthenticated attacker to crash worker processes or, under specific conditions (primarily with Address Space Layout Randomization (ASLR) disabled), achieve remote code execution (RCE) via crafted HTTP requests. VulnCheck has confirmed active exploitation in the wild, with attempts detected against honeypot networks.

Source verification: This vulnerability is well-documented across multiple security advisories and news outlets. F5 (the vendor for NGINX Plus) has released patches. NVD, Red Hat, AlmaLinux, and various security firms have published details. There is consistent reporting on the CVSS score and the nature of the vulnerability.

Technical breakdown: The vulnerability resides in how the ngx_http_rewrite_module handles rewrite directives, specifically when a rewrite is followed by another rewrite, if, or set directive, combined with an unnamed Perl-Compatible Regular Expression (PCRE) capture (e.g., $1, $2) and a replacement string containing a question mark (?). This specific configuration triggers a size mismatch between two passes over the rewrite replacement string, leading to a heap buffer overflow. An attacker can send specially crafted HTTP requests that exploit this condition, causing memory corruption in the NGINX worker process. While most exploitation attempts will result in a denial of service (DoS) due to worker process crashes and restarts, reliable RCE is possible, particularly on systems where ASLR is disabled. A public PoC demonstrating unauthenticated RCE with ASLR disabled has been released.

• MITRE ATT&CK Mapping: Initial Access (T1190 - Exploit Public-Facing Application), Impact (T1499 - Endpoint Denial of Service), Execution (T1059 - Command and Scripting Interpreter, if RCE is achieved).
• CWE: CWE-122: Heap-based Buffer Overflow.

Blast radius: NGINX is a widely deployed web server and reverse proxy, often serving as a critical internet-facing component. Any organization using affected versions of NGINX Open Source (0.6.27 through 1.30.0) or NGINX Plus (R32 through R36) with the specific rewrite configurations is at risk. This includes NGINX Ingress Controller, NGINX Gateway Fabric, and other F5 products that bundle NGINX. Given its prevalence, the potential for widespread DoS or RCE is significant, impacting web services, load balancers, and API gateways globally.

Marcus’s verdict:

This NGINX vulnerability is an old bug with new teeth. Eighteen years it’s been lurking, and now it’s actively exploited. The CVSS 9.2 is no joke, and while RCE depends on ASLR being off, a reliable DoS is bad enough for any internet-facing service. This is a classic case of a subtle logic flaw in a widely used component being weaponized. If you’re running NGINX, especially as a reverse proxy, you need to treat this with extreme urgency.

What to do:

1. Prioritize patching: Immediately upgrade NGINX Open Source to version 1.30.1 or 1.31.0, and NGINX Plus to R37, R36 P4, or R32 P6.
2. Review NGINX configurations: Identify any rewrite directives that use unnamed PCRE captures ($1, $2, etc.) with a question mark (?) in the replacement string. If found, these configurations are highly susceptible. Replace unnamed captures with named captures as a temporary mitigation if immediate patching is not feasible.
3. Ensure ASLR is enabled: Confirm ASLR is active on all NGINX host systems to mitigate the RCE potential. This is a default on most modern Linux distributions but should be verified.
4. Monitor NGINX logs: Look for unusual HTTP requests, repeated worker process crashes, or other anomalous behavior indicative of exploitation attempts.

Windows Cloud Filter Driver (cldflt.sys) — “MiniPlasma” Privilege Escalation

What happened: A privilege escalation zero-day, dubbed “MiniPlasma,” has re-emerged, allowing attackers to gain SYSTEM privileges on fully patched Windows systems. This vulnerability, which leverages the Windows Cloud Filter Driver (cldflt.sys), is identified as a re-emergence of CVE-2020-17103. A security researcher released a Proof-of-Concept (PoC), asserting that Microsoft’s 2020 patch was either incomplete or subsequently rolled back. The PoC is reportedly reliable on Windows 11 systems with the May 2026 updates.

Source verification: The Discord briefing mentions “no new CVE ID,” and that it’s a “re-emergence of CVE-2020-17103.” A search for “MiniPlasma privilege escalation zero-day” and “cldflt.sys vulnerability” did not yield immediate, widely published, and cross-referenced public advisories or news articles from the specified timeframe (May 17-18, 2026) confirming the “re-emergence” or a new “MiniPlasma” zero-day with a public PoC reliably working on fully patched Windows 11 systems with May 2026 updates. While CVE-2020-17103 itself is a known privilege escalation in cldflt.sys (Windows Cloud Files Mini Filter Driver), the claim of a new, actively working zero-day with a public PoC on fully patched systems requires strong, independent verification.

• ⚠️ Unverified: The “MiniPlasma” zero-day, its re-emergence, and the reliability of a public PoC on fully patched Windows 11 systems with May 2026 updates could not be independently verified with multiple recent public sources within the specified timeframe. While cldflt.sys has had vulnerabilities, the specific claims of a new, actively exploited zero-day with a public PoC on fully patched systems are not yet widely confirmed by major security vendors or news outlets. Monitor for updates.

Marcus’s verdict:

This “MiniPlasma” claim, if true, is deeply concerning. Privilege escalation in cldflt.sys is a known attack vector, and a reliable SYSTEM-level exploit on fully patched systems would be a significant blow. However, the lack of immediate, widespread public confirmation from multiple reputable sources makes me cautious. This isn’t the first time we’ve heard claims of “incomplete patches” for Windows kernel drivers. My gut says this needs more scrutiny. For now, treat it as a high-priority threat to monitor, but don’t panic until we see more definitive evidence and a Microsoft advisory.

What to do:

1. Monitor for official advisories: Keep a close watch on Microsoft’s security advisories and CISA alerts for any official confirmation or new CVE ID related to cldflt.sys and privilege escalation.
2. Endpoint Detection and Response (EDR) vigilance: Ensure your EDR solutions are configured to detect suspicious activity related to cldflt.sys, kernel-level operations, or unusual process elevation attempts.
3. Least Privilege: Continue to enforce strict least privilege principles for all users and applications to limit the impact of any successful privilege escalation.

🛡️ CVEs — Full Analysis

CVE-2026-8753 — kalcaddle Kodbox

Summary: This is a command injection vulnerability in kalcaddle Kodbox versions up to 1.64. The flaw exists in the parseVideoInfo function within the fileThumb plugin, specifically through the ffmpegBin argument. A remote attacker can exploit this to inject and execute arbitrary commands. CVSS/Details: CVSS 3.x Base Score: 5.3 (Medium). The vulnerability is remotely exploitable, and a public PoC exists. The vendor has not responded to disclosure attempts and no patch is available. Marcus take: Command injection is never a good look. While the CVSS is medium, the “remote attack possible” and “public PoC” mean this is a real threat for anyone running Kodbox. If you’re using this for file management, especially with video processing, you’re exposed. The lack of vendor response means you’re on your own for mitigation.

CVE-2026-8755 — fishaudio Bert-VITS2

Summary: This is a path traversal vulnerability in fishaudio Bert-VITS2, affecting versions up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c. The flaw is in the _get_all_models function within hiyoriUI.py, allowing remote attackers to manipulate file paths and potentially access unauthorized files. CVSS/Details: CVSS 4.0 Base Score: 6.9 (Medium). CVSS 3.1 Base Score: 7.3 (High). The attack can be initiated remotely, and a public PoC has been disclosed. The product uses continuous delivery, so specific version details for affected/updated releases are unavailable, and the vendor has not responded to disclosure. Note: Another related path traversal, CVE-2026-8756, in the generate_config function of webui_preprocess.py (data_dir argument) has also been disclosed for the same product. Marcus take: Path traversal in an AI model serving framework is concerning. It’s a fundamental security flaw that can lead to information disclosure or even RCE if an attacker can write to arbitrary locations. The CVSS 7.3 (High) is appropriate. The continuous delivery model making patching unclear, and the vendor’s silence, are red flags. If you’re using Bert-VITS2, assume compromise if exposed.

⚡ TTPs & Attack Research — Deep Dives

AI-Assisted Exploit Development: The 2FA Bypass Zero-Day

Google’s Threat Intelligence Group (GTIG) has confirmed a significant development: a zero-day exploit targeting a popular open-source web-based system administration tool was developed with AI assistance by a criminal group. This marks the first time Google has identified what it believes to be an AI-crafted zero-day exploit in the wild.

The Attack Chain:

1. Initial Access: The exploit requires valid user credentials, but then leverages a semantic logic flaw to bypass two-factor authentication (2FA).
2. Vulnerability: The root cause was a “faulty trust assumption” or “hardcoded trust assumption” by the developers, which contradicted the application’s 2FA enforcement logic. This is a high-level logic flaw, not a simple memory corruption bug.
3. AI’s Role: The exploit was implemented as a Python script. GTIG assessed with “high confidence” that an AI model was used for its discovery and weaponization, based on the script’s characteristics: an abundance of educational docstrings, a “hallucinated CVSS score,” and a structured, textbook-style Python format. This indicates the AI’s ability to perform contextual reasoning and identify subtle logical contradictions in code.
4. Impact: Successful exploitation would grant attackers access to the system administration tool, bypassing a critical security control. Google worked with the vendor to disclose and disrupt the planned mass exploitation campaign.

Detection Opportunities:

• Code Analysis: Look for code generated by LLMs that exhibits unusual characteristics (e.g., excessively verbose comments, textbook-perfect but potentially flawed logic, or “hallucinated” security metadata like CVSS scores).
• Behavioral Monitoring: Monitor for suspicious login attempts that bypass 2FA, even with valid credentials. This requires robust logging and anomaly detection.
• Supply Chain Scans: Integrate AI-assisted code analysis tools into your DevSecOps pipeline to identify similar logic flaws or AI-generated vulnerabilities in third-party components.

Mitigations:

• Secure Coding Practices: Emphasize rigorous code reviews, especially for authentication and authorization logic. Avoid hardcoded trust assumptions.
• Advanced Fuzzing: Employ advanced fuzzing techniques that can probe for logical flaws, not just memory safety issues.
• AI for Defense: Leverage AI-powered security tools for code analysis and vulnerability discovery to counter AI-assisted attacks.

Vulnerability Tsunami & AI Discovery: Anthropic’s Claude Mythos Preview

Anthropic’s Claude Mythos Preview, released April 7, 2026, represents a significant inflection point in cybersecurity. This general-purpose AI model, not specifically designed for security, demonstrated an unprecedented capability to autonomously discover and exploit zero-day vulnerabilities at scale.

Key Findings & Implications:

• Autonomous Discovery & Exploitation: Mythos Preview identified thousands of previously unknown, high-severity vulnerabilities across major operating systems (e.g., a 27-year-old flaw in OpenBSD) and web browsers. It could autonomously chain multiple vulnerabilities into sophisticated exploits, even for hardened systems.
• Speed and Cost: The model achieved these feats in hours, at costs measured in tens or hundreds of dollars, a speed and efficiency unmatched by human teams.
• “Vulnerability Tsunami”: This capability introduces a “Vulnerability Tsunami” where the volume of newly discovered flaws could overwhelm traditional vulnerability management programs. The mean time-to-exploit (MTTE) is reportedly dropping, with some estimates as low as 2.1 days.
• New Vulnerability Profile: AI-generated code, and code analyzed by AI, has a new vulnerability profile. Traditional scanners often miss these AI-discovered flaws, some of which have existed silently for decades.
• Project Glasswing: Due to these capabilities, Anthropic limited public release, instead launching “Project Glasswing” with 50 organizations (including major tech companies) to use Mythos for defensive security and share learnings.

Marcus’s Take:

This isn’t hype; it’s a paradigm shift. Claude Mythos Preview has fundamentally changed the vulnerability landscape. The assumption that “if it hasn’t been found by a human or a scanner, it’s probably safe” is dead. AI can now find and weaponize flaws faster and cheaper than ever before. This accelerates the “observe-orient-decide-act” (OODA) loop for attackers, forcing defenders to rethink everything from vulnerability management to incident response. We are now in a race against AI-powered adversaries.

What to do:

1. Shift to Continuous Security Validation: Move beyond periodic scanning. Implement continuous, AI-augmented testing and security validation across your entire software development lifecycle (SDLC) and production environments.
2. Re-evaluate Third-Party Risk: The findings highlight that foundational software flaws in dependencies are now more visible and exploitable. Scrutinize your software supply chain with AI-powered analysis.
3. Prioritize Business Risk: With a potential “tsunami” of vulnerabilities, prioritize remediation based on actual business impact and exploitability in your specific environment, not just CVSS scores.
4. Invest in AI for Defense: Explore and integrate AI-powered tools for vulnerability discovery, threat intelligence, and automated remediation to keep pace with AI-powered attackers.

Bleeding Llama Vulnerability (Ollama)

The “Bleeding Llama” vulnerability, tracked as CVE-2026-7482 (CVSS 9.1), is being called the “worst AI vulnerability in 2026” and affects Ollama versions prior to 0.7.1, patched in February 2026. This is a critical unauthenticated heap out-of-bounds read vulnerability in Ollama’s GGUF model loading and quantization pipeline.

The Attack Chain:

1. Vulnerability: The core issue is a missing bounds check in Ollama’s GGUF tensor parsing code. When a GGUF file is submitted to the /api/create endpoint, Ollama trusts the declared tensor offset and size within the file without verifying them against the file’s actual length or the allocated buffer in memory.
2. Payload Delivery (Step 1): An unauthenticated attacker uploads a malicious GGUF file with an inflated tensor shape to the /api/blobs endpoint via HTTP POST. No authentication is required for this step.
3. Memory Leak Trigger (Step 2): The attacker then calls /api/create to trigger model creation. During quantization (specifically in fs/ggml/gguf.go and server/quantization.go), Ollama attempts to read past its allocated heap buffer, folding leaked heap memory into the model artifact.
4. Data Exfiltration (Step 3): Finally, the attacker calls the /api/push endpoint, pointing to an attacker-controlled registry. Ollama then uploads the modified model artifact, which now contains the stolen heap data, to the attacker’s server.

Impact:

• Silent Exfiltration: The attack requires only three unauthenticated API calls, leaves no error logs, and causes no crashes, making detection extremely difficult without specialized endpoint monitoring.
• Sensitive Data Exposure: This allows silent exfiltration of the entire Ollama process’s heap memory, including highly sensitive data such as API keys, credentials, environment variables, system prompts, proprietary code, customer contracts, and concurrent user conversation data.
• Widespread Exposure: Approximately 300,000 Ollama servers are estimated to be exposed on the public internet, many running without authentication by default.

Marcus’s Take:

“Bleeding Llama” is a nightmare scenario for local LLM deployments. An unauthenticated memory leak that silently exfiltrates sensitive data, including API keys and conversation history, with no forensic trace? That’s a CISO’s worst fear. The fact that it impacts 300,000 internet-exposed servers is a disaster waiting to happen. This isn’t just about data; it’s about the integrity and confidentiality of your AI operations.

What to do:

1. Patch Immediately: Upgrade Ollama to version 0.7.1 or later. This patch was released in February 2026.
2. Assume Compromise (if unpatched/exposed): If your Ollama instance was internet-accessible and unpatched, assume sensitive data has been exposed. Immediately rotate all API keys, credentials, and secrets that could have been in Ollama’s memory.
3. Network Segmentation & Access Control: Restrict network access to Ollama instances. Do not expose them directly to the internet without robust authentication and authorization. Implement strong firewall rules.
4. Endpoint Monitoring: Deploy dedicated endpoint monitoring solutions to detect unusual API call sequences or