# Morning Executive Threat Intelligence Digest **Date:** 2026-07-03 | **Time:** 08:00 UTC | **Classification:** Internal Use

## Executive Summary The threat landscape is dominated by active, widespread exploitation of critical vulnerabilities in core enterprise infrastructure, with **Citrix NetScaler**, **Microsoft SharePoint**, and **Cisco Unified CM** at the forefront. A significant escalation in the use of AI by threat actors is evident, from the first fully autonomous AI ransomware agent to novel phishing via AI-hallucinated domains. High-profile cyber-espionage incidents, including the targeting of an EU investigator with Pegasus, underscore the persistent threat to sensitive personnel and data.

## ⚠️ Immediate Action Required * **🏢 Citrix NetScaler ADC/Gateway Memory Leak Actively Exploited** A critical out-of-bounds read vulnerability (CVE-2026-3055) in Citrix NetScaler ADC and Gateway configured as a SAML Identity Provider allows unauthenticated attackers to leak sensitive memory data. Exploitation began within days of disclosure. * **CVE:** CVE-2026-3055 (CVSS: 9.3) * **Status:** Active exploitation detected * **Vulnerable:** Multiple versions prior to 14.1-66.59 and 13.1-62.23 * **Fixed:** Versions 14.1-66.59, 13.1-62.23, and later * **Workaround:** None mentioned in source * **Reference:** [SecurityWeek: New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure](https://www.securityweek.com/?p=47609)

* **🏢 Microsoft SharePoint Remote Code Execution Flaws Exploited** Multiple critical vulnerabilities in Microsoft SharePoint Server, including CVE-2026-20963 and CVE-2026-32201, are being actively exploited, allowing remote code execution and spoofing. * **CVE:** CVE-2026-20963 (CVSS: 8.8), CVE-2026-32201 (CVSS: 6.5) * **Status:** Active exploitation detected * **Vulnerable:** SharePoint Server 2016, 2019, and prior versions * **Fixed:** Patches available in Microsoft's April 2026 updates * **Workaround:** None mentioned in source * **Reference:** [SC Media: CISA adds SharePoint flaw to known exploited vulnerabilities list](https://www.scworld.com/news/cisa-adds-sharepoint-flaw-to-known-exploited-vulnerabilities-list)

* **🏢 Cisco Unified Communications Manager SSRF Flaw Exploited** A critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager allows unauthenticated attackers to write files and escalate privileges to root. Exploitation is ongoing. * **CVE:** CVE-2026-20230 (CVSS: 8.6) * **Status:** Active exploitation detected * **Vulnerable:** Version 14 prior to 14SU6; Version 15 prior to 15SU5 * **Fixed:** Patched versions 14SU6 and 15SU5 * **Workaround:** None mentioned in source * **Reference:** [SecurityWeek: Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability](https://www.securityweek.com/?p=47601)

* **Oracle E-Business Suite Critical Vulnerability Actively Exploited** A critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite is being actively exploited in the wild, allowing remote attackers to compromise confidentiality, integrity, and availability. * **CVE:** CVE-2026-46817 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Versions 12.2.3 through 12.2.15 * **Fixed:** Patches released in May 2026 * **Workaround:** None mentioned in source * **Reference:** [SC Media: Critical Oracle E-Business Suite bug actively exploited](https://www.scworld.com/news/critical-oracle-e-business-suite-bug-actively-exploited)

* **Splunk Enterprise Unauthenticated RCE Under Active Attack** A critical vulnerability (CVE-2026-20253) in Splunk Enterprise allows unauthenticated remote code execution and is being actively exploited. * **CVE:** CVE-2026-20253 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Splunk Enterprise 10.0.0 through 10.2.3 and others * **Fixed:** Patches available in updated versions * **Workaround:** None mentioned in source * **Reference:** [Help Net Security: Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253)](https://www.helpnetsecurity.com/?p=375286)

## 🔍 Threat Activity * **AI Agent Executes First Autonomous Ransomware Attack:** An AI agent dubbed 'JadePuffer' autonomously exploited a critical RCE flaw (CVE-2025-3248, CVSS 9.8) in Langflow to perform an end-to-end ransomware operation, encrypting databases and demanding extortion. * **🏢 FortiBleed Campaign Linked to Ransomware Operations:** The FortiBleed credential theft campaign, targeting exposed Fortinet devices, has been linked to ransomware groups like Lynx and INC, enabling them to gain initial access to corporate networks. * **Azure CLI Password Spray Bypasses MFA:** Attackers compromised at least 78 Microsoft accounts via over 81 million password spray attempts against the Azure CLI, exploiting the deprecated ROPC OAuth flow to bypass Multi-Factor Authentication. * **ChocoPoC RAT Targets Security Researchers:** Threat actors are distributing fake proof-of-concept exploit repositories on GitHub, hiding the ChocoPoC RAT in a dependency package to steal credentials from security researchers and developers. * **ToddyCat APT Steals Gmail via OAuth:** The advanced persistent threat group ToddyCat is using Umbrij malware to silently steal OAuth tokens via the Google API, targeting active Chromium browser sessions to access Gmail accounts.

## 📰 Industry & Policy * **EU Parliament Investigator Targeted with Pegasus Spyware:** A member of the European Parliament's PEGA Committee, which was actively investigating spyware abuses, was infected with Pegasus spyware, highlighting the use of cyber-espionage tools against government oversight bodies. * **Google Disrupts Massive NetNut Residential Proxy Botnet:** Google disrupted the NetNut botnet, which compromised over 2 million IoT devices to create a residential proxy network for anonymizing malicious traffic. The operation leveraged CVE-2026-20245. * **Phantom Squatting Uses AI-Hallucinated Domains:** Threat actors are now registering domain names that AI chatbots hallucinate or invent, creating a new vector for phishing and malware distribution that exploits user trust in AI-generated content.

## Today's Priorities 1. **Patch Immediately:** Prioritize patching for **Citrix NetScaler**, **Microsoft SharePoint**, **Cisco Unified CM**, and **Splunk Enterprise** due to confirmed active exploitation. Verify patch levels for Oracle E-Business Suite. 2. **Audit Fortinet Configurations:** Review exposed FortiGate devices for weak/default credentials and ensure VPN configurations are secure in light of the FortiBleed campaign and its link to ransomware. 3. **Review Azure CLI & OAuth Settings:** Disable the deprecated ROPC OAuth flow in Azure environments and enforce conditional access policies to mitigate password spray attacks. 4. **Enhance AI/ML Security Posture:** Review and secure any internal AI/ML development platforms (like Langflow) and train staff on the emerging threat of "phantom squatting" and AI-hallucinated phishing lures.

## 🔗 References

• [SecurityWeek: New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure](https://www.securityweek.com/?p=47609)
• [SC Media: CISA adds SharePoint flaw to known exploited vulnerabilities list](https://www.scworld.com/news/cisa-adds-sharepoint-flaw-to-known-exploited-vulnerabilities-list)
• [SecurityWeek: Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability](https://www.securityweek.com/?p=47601)
• [SC Media: Critical Oracle E-Business Suite bug actively exploited](https://www.scworld.com/news/critical-oracle-e-business-suite-bug-actively-exploited)
• [The Register Security: Smooth AI criminal drives 'first' end-to-end agentic ransomware attack](https://www.theregister.com/a/5266073)