CISA published an ICS advisory detailing three vulnerabilities in Johnson Controls C-CURE 9000 and Victor application server products. CVE-2026-21655 is a critical .NET deserialization flaw (CVSS 9.6) allowing unauthenticated adjacent-network attackers to achieve remote code execution on port 8999. CVE-2026-21653 is a critical SSRF in Victor Web enabling server-side request forgery against internal services. CVE-2026-34496 is a high-severity privilege issue allowing low-privilege Victor Web users to view unauthorized administrative pages. Vendor upgrades are available for all affected products.
SSRF
6 posts
Johnson Controls C-CURE 9000 and Victor application server (Update A) (CVE-2026-21655, CVE-2026-34496, CVE-2026-21653) It’s 37oC, And All We Can Think About Is ColdFusion (Adobe ColdFusion Security Bulletin APSB26-68 CVE Bonanza) Adobe ColdFusion security bulletin APSB26-68 patches 11 CVEs across ColdFusion 2025 and 2023, including critical arbitrary file read/write vulnerabilities in the RDS module and a path traversal in the CKEditor file manager upload endpoint. When RDS is enabled with authentication disabled, attackers can use the simple length-prefixed RDS RPC protocol to read or write arbitrary files, achieving remote code execution as SYSTEM by deploying a CFML webshell. A separate unauthenticated path traversal in the CKEditor file manager allows file uploads to arbitrary directories, also executing as SYSTEM.
SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon Varonis Threat Labs discovered SearchLeak, a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search (CVE-2026-42824). By chaining Parameter-to-Prompt (P2P) injection, an HTML rendering race condition, and a Server-Side Request Forgery (SSRF) via Bing's image search, attackers could exfiltrate sensitive organizational data via a single malicious link.
Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System Unit 42 developed a multi-agent AI proof-of-concept named Zealot to empirically test autonomous offensive capabilities in cloud environments. The PoC successfully demonstrated that AI can autonomously chain reconnaissance, SSRF exploitation, IAM privilege escalation, and data exfiltration at machine speed against a misconfigured GCP environment.
Your Staging Site Is More Important than You Think A third-party security researcher discovered a vulnerability in a staging environment via Server-Side Request Forgery (SSRF) probing. The incident underscores the critical importance of applying production-level security monitoring, access controls, and incident response capabilities to non-production environments to prevent them from becoming initial access vectors.
Cracks in the Bedrock: Escaping the AWS AgentCore Sandbox Unit 42 researchers discovered a method to bypass the network isolation of Amazon Bedrock AgentCore's Code Interpreter sandbox using DNS tunneling. Combined with a legacy MMDSv1 configuration that lacked session token enforcement, attackers could potentially exploit SSRF to extract highly privileged IAM credentials and exfiltrate them via the DNS covert channel.
