CISA Just Put a 48-Hour Clock on Four Critical Flaws, an MLflow Bug Hands Out Cloud Credentials for Free, and a Ransomware Affiliate Is Now Cold-Emailing Victims a Delete-Your-Data Discount

Four flaws, one deadline, zero patience. CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog on Tuesday, all confirmed under active exploitation, all carrying a CVSS score of at least 9.1, and all due for remediation by federal civilian agencies come August 21 — that's roughly 48 hours from when the catalog update landed. Three of the four are flaws we've already been tracking on this site as they moved from disclosure to confirmed exploitation: the macOS Screen Sharing authentication bypass (CVE-2026-65400) that's been used to root exposed Macs and mine Monero, the SharePoint JWT weak-authentication bug (CVE-2026-55040) at the front of the pre-auth RCE chain patched earlier this month, and the VMware vCenter path traversal flaw (CVE-2026-59310) that German responders caught being exploited just five days after Broadcom's patch shipped. Watching all three graduate to official KEV status in the same week isn't a coincidence so much as confirmation — these were never theoretical risks, and now they carry a government-mandated clock to go with the CVSS score.

The fourth is the one worth learning fresh: CVE-2026-33824, a double-free vulnerability in Microsoft's Internet Key Exchange (IKE) Service Extensions, also scored a maximum-severity 9.8. IKE is the protocol that negotiates and manages security associations for IPsec VPN tunnels — a double-free in the service handling it opens the door to remote code execution against anything running with IKE enabled, no authentication required, over the same UDP ports (500 and 4500) that VPN infrastructure depends on to function at all. If you can't patch immediately, CISA and multiple researchers are pointing at blocking those two ports at the network edge as the interim mitigation, with the obvious caveat that doing so also breaks any legitimate IPsec VPN traffic passing through — a real tradeoff, not a free move, but one worth making until the patch lands. The throughline across all four flaws is the same one we keep coming back to on this site: authentication and identity-adjacent services — screen sharing, SharePoint tokens, vCenter's session handling, IKE's key exchange — continue to be where the real damage originates, not exotic zero-days in obscure corners of the stack.

If the IKE bug is this week's "patch the network edge" story, MLflow's is this week's "patch the AI stack" story, and the two rhyme more than you'd expect. Researchers at watchTowr and VulnCheck independently disclosed CVE-2026-64849, a 9.3-severity unauthenticated server-side request forgery in MLflow, the open-source platform a large share of the industry uses to track machine learning experiments and manage model lifecycles. Any attacker who can reach a running MLflow Tracking Server — meaning any deployment exposed to a network they can touch — can direct it to issue HTTP requests to arbitrary internal targets, including cloud metadata endpoints. On AWS, Azure, and GCP alike, those endpoints are exactly where an instance's own temporary security credentials live, which means an unauthenticated request to the wrong URL can hand an attacker the same access the MLflow server itself has to the surrounding cloud environment. Affected versions are anything prior to 3.15.0. If your organization runs MLflow anywhere — and given how central it's become to ML operations, there's a real chance it's running somewhere you're not thinking about — confirm the version today, and don't assume "it's just for internal experiment tracking" means it's not worth an attacker's time; SSRF into cloud metadata is precisely the kind of low-effort, high-yield pivot that turns a forgotten internal tool into a full cloud account compromise.

Alongside it, the same disclosure wave covered CVE-2026-25895, a 9.5-severity flaw in FUXA, an open-source web-based SCADA and HMI platform used to monitor and control industrial systems. The bug combines missing authentication on a critical function with a path traversal weakness, letting an unauthenticated remote attacker write arbitrary files to the server's filesystem and achieve remote code execution outright. FUXA sits in the same category of software that's made 2026 a genuinely rough year for industrial control systems exposed to the internet — purpose-built to be reachable and useful for operators, which is exactly what makes an unauthenticated RCE in it so dangerous once it's reachable by anyone else too. If FUXA or anything like it is part of your OT environment, network segmentation isn't optional here; there is no legitimate reason for this class of interface to be internet-facing at all.

On the breach side, Heights Finance, a U.S. consumer finance company, disclosed that an unauthorized party accessed personal and financial data belonging to more than 1.2 million people through a compromised third-party cloud platform. State breach-notification filings already put the number above 1.2 million, and given how these figures tend to move in the days after initial disclosure, don't be surprised if it climbs further. The mechanism — a third-party cloud platform, not Heights Finance's own core systems — is the detail worth sitting with, because it's the same shape of failure we've now covered multiple times this month: the vulnerability that actually gets exploited often isn't in the organization whose name ends up in the headline, it's in whatever shared infrastructure that organization trusted to hold its data. If your vendor risk assessments treat "we don't manage that system directly" as a reason to ask fewer questions rather than more, this is a good week to reconsider that instinct.

And then there's the story that's more interesting for what it says about the ransomware economy than for its technical sophistication. A ransomware affiliate operating under the name Ransom Busters has been proactively emailing organizations that were previously compromised by other ransomware groups, offering — for a fee ranging from $20,000 to $60,000 — to delete the stolen data still sitting on those groups' servers. There's no credible way to verify such a claim, no mechanism by which a third party can prove data was deleted rather than simply copied first, and no reason to trust an extortion-adjacent actor's promise about data they never actually possessed custody of in any auditable sense. What it does reveal is a maturing, increasingly layered criminal ecosystem: initial-access brokers, ransomware operators, data leak-site hosts, and now apparently freelance "cleanup" actors are treating a single victim's stolen data as a resource multiple separate parties can independently monetize, sequentially, off the same original breach. If your organization has already been through a ransomware incident and receives a follow-up offer like this, the right answer is the same one incident response teams have given for years: paying does not create a verifiable, enforceable guarantee of anything, and a second extortion demand from an unrelated actor is a second extortion demand, not a service.

The AI angle this week is less about a specific tool and more about a pattern researchers are now documenting directly. DataBreachToday's Mathew Schwartz reported that attackers' own operational security failures are increasingly revealing they're using AI tools in semi-autonomous ways to accelerate reconnaissance and ransomware operations — with results researchers are explicitly characterizing as mixed, not uniformly effective. Separately, Bitdefender disclosed a China-linked espionage campaign it's calling SilkParasite, which deployed seven distinct modular remote access trojans against Central Asian government targets, with coding artifacts in the malware suggesting AI-assisted development. Neither story is about a single dramatic AI-powered attack; both are about AI quietly becoming part of the normal tooling on the offensive side, sped up in some places, still error-prone in others, and increasingly visible in the operational traces attackers leave behind when the automation doesn't go quite as planned. That last part is the genuinely useful takeaway for defenders: AI-assisted operations aren't necessarily stealthier than manual ones, and the same imperfections that make AI-generated code or AI-planned reconnaissance occasionally clumsy are showing up in forensic evidence, which means threat hunting built around "does this look automated and slightly off" is a legitimate detection angle, not a stretch.

Six stories, one week's worth of the same lesson repeating in different clothes: authentication that quietly gets reconfigured or bypassed rather than broken outright, trust extended to third-party infrastructure that turns out to be the actual point of failure, and a criminal ecosystem that keeps finding new ways to monetize access it's already gotten rather than needing to find new ways in. The technical details change daily. The shape underneath them mostly doesn't.