DAILY BRIEFING
Kiteworks patches max severity code injection vulnerability
Today's briefing covers CISA adding an actively exploited Cisco SD-WAN flaw to KEV, OpenAI disrupting a model distillation campaign, and financial software supply chain security.
5 stories2 min read
Active exploitation of network infrastructure and systematic AI model targeting dominate today's threat landscape. Enterprise network teams and security operations must prioritize immediate updates to critical routing management systems while re-evaluating risk models around proprietary AI interactions.
CISA added an authentication bypass flaw in Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-76504 with a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated remote attackers to gain administrative privileges via crafted HTTP requests.
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
CISA added CVE-2026-76504 (CVSS score 9.8), an authentication bypass flaw in Cisco Catalyst SD-WAN Manager, to its KEV catalog following active exploitation. The flaw stems from improper handling of URI hex encoding in HTTP requests, allowing remote attackers to gain administrative API privileges.
- Why it matters
- Unauthenticated remote attackers can gain full admin access to Cisco Catalyst SD-WAN Manager systems via single crafted API requests, exposing entire network management infrastructure to takeover.
- What to do
- Patch Cisco Catalyst SD-WAN Manager instances immediately to remediate CVE-2026-76504.
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates
OpenAI disrupted a coordinated model distillation campaign that manipulated interactions to illicitly extract protected reasoning from its AI models without compromising encryption or user databases. A core cluster of activity starting July 1, 2026, was linked to individuals associated with Moonshot AI.
- Why it matters
- AI intellectual property and propriety model reasoning can be target of large-scale prompt extraction campaigns, bypassing traditional infrastructure defenses through high-volume manipulated requests.
Kiteworks patches max severity code injection vulnerability
Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution.
How Financial Services Companies Can Modernize Their Software Supply Chain
Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities.
- Why it matters
- Financial institutions face elevated security risks when accumulating legacy vulnerability backlogs, as traditional risk management strategies prioritizing uptime over dependency updates are increasingly vulnerable.
- What to do
- Review and update patch management policies to eliminate long-term vulnerability exceptions in core financial platforms.
Microsoft enables Windows settings backup by default for orgs
Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2.
Key takeaways
- Patch Cisco Catalyst SD-WAN Manager to mitigate CVE-2026-76504, an auth bypass with a 9.8 CVSS score under active exploitation.
- CISA has added Cisco Catalyst SD-WAN Manager CVE-2026-76504 to its Known Exploited Vulnerabilities catalog.
- OpenAI disrupted a distillation campaign involving 16,000 requests from over 4,000 users designed to extract AI reasoning.