Security Signal Weekly: June 27-July 3, 2026

Overview

This week kept circling the same operational lesson: the boring control planes are where the damage starts. Remote support, SharePoint, phone systems, firewalls, Microsoft 365, developer packages, and AI workflow servers all showed up because they sit close to credentials, admin access, customer environments, or production data.

Reality check: If a system can manage users, reach endpoints, route traffic, or run code on behalf of a team, it deserves faster patching and better logging than a normal business app.

Top 10 Security Signals

1. SimpleHelp RMM auth bypass is now an active MSP-grade incident risk

What happened: CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog after active exploitation of SimpleHelp’s OpenID Connect authentication bypass, while Horizon3.ai’s disclosure explains that vulnerable OIDC configurations can let an unauthenticated attacker obtain a technician session. Blackpoint and follow-on reporting tied exploitation to TaskWeaver and Djinn Stealer activity against Windows, macOS, and Linux environments.

Why it matters: RMM is not just another server. For an MSP or internal IT team, a technician session can become a path into every managed endpoint, which turns a single exposed support tool into a downstream customer incident.

Action:

Upgrade SimpleHelp to a fixed release and disable OIDC where it is not required.

Audit technician accounts, group-authenticated users, and SimpleHelp server logs for unfamiliar identities.

Assume exposed RMM credentials and endpoint secrets may need rotation if exploitation indicators are present.

2. CISA flags actively exploited SharePoint Server RCE

What happened: CISA added CVE-2026-45659 to KEV based on active exploitation of Microsoft SharePoint Server, and Microsoft’s MSRC advisory describes a deserialization issue that allows an authorized attacker to execute code over the network.

Why it matters: SharePoint often holds internal documents, workflow data, credentials in files, and enough business context to make post-exploitation useful. The fact that this was patched earlier but is now showing exploitation is the real signal: delayed patching creates the attack window.

Action:

Patch all affected SharePoint Server Subscription Edition, 2019, and 2016 systems and verify the installed build.

Review SharePoint exposure, especially externally reachable portals and partner-facing sites.

Hunt for unexpected process execution, web shell behavior, newly modified ASPX files, and suspicious authenticated access.

3. Cisco confirms Unified CM exploitation after public PoC pressure

What happened: Cisco’s advisory for CVE-2026-20230 now says Cisco PSIRT became aware of active exploitation in June, and CISA had already added the Unified Communications Manager SSRF and file-write flaw to KEV after exploitation reports. The issue affects Unified CM and Unified CM SME systems where the WebDialer service is enabled.

Why it matters: Voice infrastructure is easy to under-prioritize because it feels separate from normal endpoint and cloud work. In practice, it is an identity-adjacent communications platform with privileged services, internal reach, and high business disruption value.

Action:

Upgrade Unified CM and Unified CM SME to fixed releases, especially 14SU6 or 15SU5 where applicable.

Disable the WebDialer service if it is not needed or if patching cannot happen immediately.

Review device logs and file-system changes for signs of arbitrary file writes or follow-on root activity.

4. BlueHammer moved from Windows Defender patch debt to ransomware signal

What happened: CISA’s KEV catalog entry for CVE-2026-33825 shows Microsoft Defender Antivirus exploitation, and BleepingComputer reported that CISA confirmed ransomware crews are exploiting the BlueHammer local privilege escalation flaw.

Why it matters: Local privilege escalation bugs are easy to mentally downgrade until ransomware operators pair them with initial access. Once they do, unpatched endpoints become a privilege problem, not just an endpoint hygiene problem.

Action:

Confirm Microsoft Defender platform and engine updates actually landed on endpoints, not just that update jobs ran.

Prioritize systems with remote access, VPN exposure, help desk tooling, or privileged user activity.

Correlate Defender update gaps with suspicious privilege changes, service creation, and ransomware precursor behavior.

5. Google and partners disrupted NetNut’s residential proxy network

What happened: Google Threat Intelligence Group said it took action with the FBI, Lumen, and others against the NetNut residential proxy network, estimating the network at least 2 million devices and observing suspected NetNut exit nodes used by hundreds of threat clusters in a single June week.

Why it matters: Residential proxies make malicious traffic look like normal home or small-business traffic. That weakens simple IP reputation controls and helps attackers hide password spraying, fraud, scraping, and command infrastructure behind addresses defenders hesitate to block.

Action:

Treat residential ISP traffic to admin and authentication endpoints as a risk signal, not automatically benign.

Tune detections around impossible travel, unusual ASN changes, failed-login bursts, and session creation from new geographies.

Check unmanaged streaming boxes, Android devices, and low-cost appliances for proxy or malware enrollment signs.

6. Azure CLI password spraying exposed weak Conditional Access coverage

What happened: Huntress reported an LSHIY-linked password spray campaign that made more than 81 million attempts against Microsoft accounts between June 12 and June 26, compromising at least 78 accounts across 64 organizations by abusing Azure CLI and Resource Owner Password Credentials flows.

Why it matters: The story is not that MFA failed. The story is that Conditional Access policies often cover the paths teams think about while legacy or special-case auth flows remain reachable.

Action:

Require MFA for all users, all cloud apps, and all client app types where possible.

Restrict Azure CLI access for users who do not need it and review ROPC exposure.

Prioritize password resets for accounts with breached-password matches, failed spray attempts, or successful Azure CLI sign-ins.

7. ARToken showed how mature Microsoft 365 phishing kits have become

What happened: Cisco Talos analyzed ARToken, an EvilTokens-linked phishing-as-a-service panel targeting Microsoft 365, and found more than 80 API endpoints for device-code phishing, Primary Refresh Token persistence, mailbox access, BEC operations, and SharePoint exfiltration.

Why it matters: Modern Microsoft 365 phishing is moving past fake login pages. Attackers are packaging token theft, persistence, mailbox search, and payment-fraud workflows into operator panels that lower the skill needed to run a serious cloud account takeover.

Action:

Monitor device-code authentication, OAuth consent grants, PRT-related anomalies, and suspicious mailbox rule creation.

Move privileged and finance users toward phishing-resistant MFA where possible.

Review Microsoft 365 app consent settings and restrict user consent to verified, low-risk applications.

8. FortiBleed credentials are being tied to ransomware operations

What happened: Follow-on reporting on the FortiBleed credential theft campaign says stolen FortiGate credentials are being linked to INC and Lynx ransomware activity, after earlier reporting described mass FortiGate targeting and large-scale credential collection.

Why it matters: Firewall credentials are high-leverage initial access. If attackers can authenticate to edge infrastructure or reuse harvested RADIUS, NTLM, Kerberos, or service credentials, the incident starts behind the perimeter instead of at it.

Action:

Rotate FortiGate, VPN, RADIUS, LDAP, and service credentials that may have been exposed through edge-device compromise.

Audit Fortinet administrative l…