Daily Threat Briefing
← All briefings

Active Directory Certificate Services · Authenticated RCE · Microsoft Kiota

Date: 2026-07-25 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Today’s most significant new developments are a working public exploit for Certighost, an Active Directory certificate abuse flaw enabling domain controller impersonation and DCSync by any low-privileged user, and multiple Redis authenticated RCE vulnerabilities with published PoCs across four major versions. Microsoft Kiota code generation tools carry multiple high-EPSS injection flaws requiring immediate update. The CISA KEV deadline for Check Point SmartConsole (CVE-2026-16232) and SharePoint (CVE-2026-50522) passed on 2026-07-25 — any unpatched instances must be treated as compromised.

Critical Vulnerabilities

Certighost — Active Directory Certificate Services (ADCS)

  • Severity: Not yet assigned (critical impact — domain compromise)
  • EPSS: Not yet scored; working public exploit published 2026-07-24
  • Technical detail: Researchers H0j3n and Aniq Fakhrul published a working exploit on 2026-07-24 allowing any low-privileged Active Directory user to obtain a certificate for a Domain Controller machine account. Because DC accounts carry directory replication rights, the resulting Kerberos credential can be used to execute DCSync and retrieve the krbtgt secret, enabling Golden Ticket attacks and full domain compromise. No CVE assigned at time of reporting; the exploit is publicly available.
  • Exploitation status: Working public exploit released; no confirmed in-the-wild exploitation reported yet, but weaponization window is now open.
  • Remediation: Audit ADCS certificate templates for misconfigured enrollment permissions (particularly ENROLLEE_SUPPLIES_SUBJECT and overly permissive ACLs). Apply Microsoft’s ADCS hardening guidance. Monitor for anomalous certificate requests and DCSync activity (Event IDs 4662, 4768, 4769). Restrict certificate template enrollment to authorized principals only.

Redis — Authenticated RCE (Multiple CVEs, versions 6.2–8.8)

  • Severity: Not yet individually scored; RCE impact
  • EPSS: Not yet scored; authenticated PoC chains published 2026-07-23–24
  • Technical detail: Researchers using the Kimi K3 AI agent discovered multiple memory corruption vulnerabilities in Redis. Authenticated RCE PoCs were published for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four exploit chains require the RESTORE command; Streams-based chains additionally require EVAL and XGROUP; the 8.8.0 chain requires EVAL and the bundled RedisBloom module. Fixed in Redis 6.2.23, 7.2.15, and 7.4.10. Redis 8.x patches are expected imminently.
  • Exploitation status: Public PoC available; no confirmed in-the-wild exploitation reported.
  • Remediation: Upgrade to Redis 6.2.23, 7.2.15, or 7.4.10 immediately. For Redis 8.x, apply patches as soon as released. As a compensating control, restrict RESTORE, EVAL, and XGROUP command access to trusted clients only via ACLs. Ensure Redis is not internet-exposed.

CVE-2026-59865 / CVE-2026-59866 / CVE-2026-59864 / CVE-2026-59860 / CVE-2026-59859 — Microsoft Kiota (Code Generation)

  • Severity: CVSS 9.3 (CVE-2026-59865/59866/59864); CVSS 8.7 (CVE-2026-59860/59859)
  • EPSS: CVE-2026-59865: 3.19 — high exploitation probability; CVE-2026-59866: 1.35; CVE-2026-59864: 1.28; CVE-2026-59860/59859: 1.02
  • Technical detail: Five vulnerabilities in Microsoft Kiota, the open-source API client code generator used in Microsoft 365 and Copilot development workflows. CVE-2026-59865 is a command injection via the x-ms-kiota-info dependencyInstallCommand field surfaced by kiota info — the highest-EPSS item in today’s data. CVE-2026-59866 allows arbitrary file write and code injection via clientClassName/clientNamespaceName fields. CVE-2026-59864 enables path/URL injection into generated Copilot plugin manifests. CVE-2026-59860 and CVE-2026-59859 are XML doc-comment newline breakout and PHP literal injection flaws respectively. All affect Kiota versions below 1.32.5 (PHP generator below 1.32.4). These flaws are particularly relevant in CI/CD pipelines where Kiota generates client code automatically from untrusted API definitions.
  • Exploitation status: No confirmed exploitation; EPSS scores indicate elevated near-term risk.
  • Remediation: Update Kiota to ≥ 1.32.5 (PHP generator ≥ 1.32.4). Review CI/CD pipelines consuming external OpenAPI definitions for untrusted input. Audit generated code in existing projects for injected content.

CVE-2026-56191 / CVE-2026-58630 / CVE-2026-58275 / CVE-2026-62825 / CVE-2026-56163 / CVE-2026-57106 — Microsoft Azure & Cloud Services (CVSS 10.0 cluster)

  • Severity: CVSS 10.0 (all)
  • EPSS: 0 (newly published; no exploitation reported)
  • Technical detail: Six additional CVSS 10.0 Microsoft cloud service vulnerabilities published 2026-07-24, extending yesterday’s cluster. New entries include: CVE-2026-58630 (Azure App Service for Linux — unauthenticated privilege escalation), CVE-2026-56163 (Azure Kubernetes Service — missing authentication for critical function, unauthenticated privilege escalation), and CVE-2026-57106 (Microsoft Purview Data Governance — SSRF enabling privilege escalation). Azure DNS (CVE-2026-58275), Azure Key Vault (CVE-2026-62825), and Exchange Online (CVE-2026-56191) were covered in yesterday’s report.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Monitor Microsoft service health and advisory portal for remediation status on all six. Review AKS RBAC configurations, App Service access controls, and Purview network policies. Audit Azure audit logs for anomalous privilege activity.

CVE-2026-10610 — ESET Endpoint Security / Cyber Security for macOS

  • Severity: CVSS 8.5
  • EPSS: 0
  • Technical detail: Local privilege escalation in ESET Endpoint Security for macOS (≤ 8.0.7200.0, 8.1.x ≤ 8.1.200.0, 9.0.x ≤ 9.0.5400.0, 9.1.x ≤ 9.1.2500.0) and ESET Cyber Security for macOS (≤ 9.0.5300.0). An attacker with local access can execute arbitrary code as a privileged user. Particularly relevant for enterprise macOS fleets where ESET is deployed as endpoint protection — a compromised endpoint could leverage this to fully escape the security tool’s own process boundary.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Update ESET Endpoint Security and Cyber Security for macOS to the latest available versions. Prioritize systems with untrusted local user access.

ONGOING:

  • CVE-2026-16232 (Check Point SmartConsole): KEV deadline passed 2026-07-25 — treat unpatched instances as compromised; apply hotfix and hunt IOCs.
  • CVE-2026-50522 (SharePoint): KEV deadline passed 2026-07-25 — conduct compromise assessment per CERT-EU 2026-009.
  • CVE-2026-64600 (Linux Kernel “RefluXFS”): PoC demonstrated; apply distribution patches as available.
  • CVE-2026-6516 (ManageEngine ADAudit Plus): unauthenticated RCE; upgrade to build 8606.
  • CVE-2026-0257 (PAN-OS GlobalProtect): Qilin ransomware exploitation ongoing; patch immediately.
  • CVE-2026-6875 (ServiceNow AI Platform): exploitation continues; patch and restrict access.
  • CVE-2026-15409 / CVE-2026-1541 (SonicWall SMA 1000): treat unpatched as compromised.
  • CVE-2026-44747 (SAP NetWeaver ABAP): patch immediately.
  • CVE-2026-15981 (WordPress SAML SSO Login): authentication bypass; update to ≥ 5.4.5.

European Advisories

BSI — New advisories (2026-07-24): BSI published a combined advisory WID-SEC-2026-2502 covering Microsoft Azure, Microsoft 365 Copilot, Exchange Online, and Surface — the CVSS 10.0 cloud service cluster is detailed in Critical Vulnerabilities above. New high-severity advisories were also published for: Google Chrome (WID-SEC-2026-2497, hoch) — multiple unspecified attack vectors; update Chrome to the latest stable release. JetBrains IntelliJ IDEA, WebStorm, PyCharm, and TeamCity (WID-SEC-2026-2505, WID-SEC-2026-2507, WID-SEC-2026-2496, WID-SEC-2026-2504, all hoch) — RCE, information disclosure, and security bypass; update all JetBrains IDEs and TeamCity to current releases. CyberPanel (WID-SEC-2026-2509, hoch) and cPanel/WHM (WID-SEC-2026-2508, hoch) — multiple flaws including potential RCE, information disclosure, and DoS; apply vendor patches. Check Point SmartConsole (WID-SEC-2026-2495, hoch) — privilege escalation to admin/root; covered in yesterday’s Critical Vulnerabilities (KEV deadline passed).

BSI — Updated advisories (2026-07-24): Routine updates to WID-SEC-2026-2409 (WordPress, kritisch — RCE) and WID-SEC-2026-1190 (GNU libc, kritisch); apply current distribution-level patches. Multiple Linux Kernel advisories updated — no new CVEs; apply kernel patches per prior guidance.

Active Threats and Campaigns

NEW — BlueNoroff Zoom/Teams Phishing Kit (Crypto Wallet Profiling): The North Korean threat actor BlueNoroff has operationalized a phishing kit impersonating Zoom and Microsoft Teams via typosquatted domains. The kit profiles victims’ cryptocurrency wallets before delivering malware, combining compromised industry contacts with social engineering to maximize targeting precision. Organizations in financial services and crypto-adjacent sectors should alert staff to verify videoconferencing invitations and block known typosquatted domains at DNS/proxy.

NEW — UAC-0099 (Russia-aligned) Fake Notepad++ Plugin / MATCHBOIL.V2: CERT-UA warns of a new campaign by UAC-0099 distributing a malicious archive containing a legitimate Notepad++ binary bundled with the MATCHBOIL.V2 implant disguised as a plugin. The campaign targets Windows systems; delivery method is consistent with prior UAC-0099 spear-phishing activity. Block execution of unsigned Notepad++ plugins and audit plugin directories on Windows endpoints.

NEW — Golden Chickens MaaS Resurfaces with Four New Malware Families: The Golden Chickens malware-as-a-service ecosystem has re-emerged with four new families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and a browser credential stealer. Organizations should update endpoint detection signatures and review threat intelligence feeds for updated Golden Chickens IOCs.

NEW — Clop Ransomware Targeting PTC Windchill and FlexPLM: Clop is actively targeting internet-exposed PTC Windchill and FlexPLM instances in a data theft extortion campaign. Organizations running these PLM platforms should immediately restrict internet exposure, apply available patches, and review for indicators of unauthorized data access.

NEW — Hermes AI Agent Used for Automated Post-Exploitation (Thai Finance Ministry): A threat actor deployed the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation activity against Thailand’s Ministry of Finance. While not directly targeting European organizations, this represents a significant escalation in attacker use of autonomous AI agents for network traversal and privilege escalation — SOC teams should review detection coverage for AI agent tooling on endpoints.

ONGOING — LAUNDRY BEAR Zero-Click Zimbra Campaign: No new technical developments; patch Zimbra and treat exposed credentials as compromised per yesterday’s guidance.

ONGOING — Hotel/Conference Wi-Fi DNS Hijacking (Microsoft 365 Credential Theft): Attackers are modifying DNS settings on hotel and conference center Wi-Fi devices to redirect users to fake Microsoft 365 login pages. Advise traveling staff to use VPN before accessing corporate resources on public Wi-Fi.

Security News and Context

  • Certighost public exploit: Researchers published a working ADCS domain controller impersonation exploit on 2026-07-24; see Critical Vulnerabilities for full detail. (The Hacker News)
  • Redis zero-days via AI-assisted research: Kimi K3 AI agents discovered multiple Redis RCE flaws; seven security releases shipped 2026-07-23. (Heise Security)
  • Google GTIG unified threat actor naming: Google Threat Intelligence Group is rolling out a merged naming taxonomy combining Mandiant and TAG tracking systems. (Mandiant/GTIG)
  • Web.de and GMX introduce Passkeys: German email providers GMX and Web.de have rolled out passkey support, improving phishing resistance for millions of European users. (Heise Security)
  1. Audit and harden ADCS immediately (Certighost): Review all certificate templates for overly permissive enrollment ACLs; monitor for anomalous certificate requests and DCSync events (Event IDs 4662, 4768, 4769).
  2. Patch Redis to 6.2.23 / 7.2.15 / 7.4.10: Restrict RESTORE, EVAL, and XGROUP commands via ACLs as a compensating control; ensure Redis is not internet-exposed.
  3. Update Microsoft Kiota to ≥ 1.32.5: Audit CI/CD pipelines consuming external OpenAPI definitions; review generated code for injected content. High EPSS scores indicate near-term exploitation risk.
  4. Review Microsoft Azure AKS, App Service, and Purview configurations: Monitor for anomalous privilege activity related to new CVSS 10.0 cluster (CVE-2026-58630, CVE-2026-56163, CVE-2026-57106).
  5. Update ESET Endpoint Security/Cyber Security for macOS to latest versions (CVE-2026-10610 local privilege escalation).
  6. Update JetBrains IDEs (IntelliJ IDEA, WebStorm, PyCharm, TeamCity), Google Chrome, cPanel/WHM, and CyberPanel per BSI advisories.
  7. Block typosquatted Zoom/Teams domains and alert staff to BlueNoroff phishing kit targeting crypto wallet holders.
  8. Restrict internet exposure of PTC Windchill and FlexPLM instances and investigate for Clop data theft indicators.
  9. Enforce VPN use on public/hotel Wi-Fi to mitigate DNS hijacking credential theft targeting Microsoft 365 accounts.
  10. Continue remediation of previously reported items: CVE-2026-16232 (Check Point — KEV deadline passed, treat as compromised), CVE-2026-50522 (SharePoint — KEV deadline passed, conduct compromise assessment), CVE-2026-64600 (Linux Kernel RefluXFS), CVE-2026-6516 (ManageEngine ADAudit Plus), CVE-2026-0257 (PAN-OS), CVE-2026-6875 (ServiceNow), CVE-2026-15409/CVE-2026-1541 (SonicWall SMA 1000), CVE-2026-44747 (SAP NetWeaver), CVE-2026-15981 (WordPress SAML SSO).