AXEC Cyber Security Weekly #4: Identity Bypass and Agentic Automation Turn Small Gaps Into Enterprise Incidents

1. Executive Brief

This week’s strongest pattern is the convergence of identity weakness, exposed secrets, and autonomous tooling. CISA added a SonicWall SonicOS vulnerability that can bypass SAML-enforced MFA to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal remediation deadline of November 20. CISA KEV catalog Microsoft also reported threat actors using agentic tooling to find exposed OAuth secrets and perform authenticated actions inside compromised tenants. Microsoft Threat Intelligence Separately, reported incidents involving connected vehicles, crypto wallets, cloud services, and AI testing environments show how a narrow control failure can create a much wider blast radius.

2. Threats and Active Exploitation

SonicWall SSL-VPN MFA bypass. CISA added CVE-2026-19868 to the KEV catalog on November 6. The vulnerability affects SonicWall SonicOS SSLVPN and may allow a user with valid credentials for an alternate authentication method to bypass SAML controls, including SAML-enforced MFA. CISA set November 20 as the federal remediation date. SonicWall released fixes for seven SonicOS vulnerabilities and warned that this issue had been exploited in attacks. CISA KEV entry SonicWall advisory BleepingComputer report

Agentic discovery of exposed secrets. Microsoft reported that the financially motivated actor Storm-3358 used the ARTEX agentic offensive framework against financial-sector organisations in October. Microsoft also observed agents searching GitHub for OAuth application secrets, compromising associated applications, and using authenticated access to act inside tenants. This is AI-enabled, not evidence that AI independently selected targets or caused the incidents. Microsoft on ARTEX Microsoft on exposed secrets

Critical-service exposure. U.S. agencies warned that threat actors are targeting internet-accessible industrial refrigeration and cold-chain monitoring systems. The reported risk includes service disruption, inventory loss, and unsafe controller changes. The evidence supplied for this edition comes from security reporting, so the incident details should be treated as reported until the relevant government advisory is reviewed directly. The Hacker News report

Identity abuse in connected vehicles. Researchers reportedly found that the login infrastructure behind two automakers’ mobile applications used a default admin:admin server password. The reported impact included account takeover and, for connected vehicles, the ability to unlock doors and start engines. This is reported, not independently verified here. The immediate control lesson is clear: identity-provider administration, service-account credentials, and vehicle-control APIs require separate monitoring and strong authentication. The Hacker News report

3. Vulnerabilities and Patch Watch

• CVE-2026-19868, SonicWall SonicOS SSLVPN: Exploited authentication weakness that can bypass SAML and MFA enforcement. Patch affected appliances, review authentication logs, invalidate active sessions, and investigate for suspicious VPN access. CISA’s listed deadline is November 20, 2026. CISA KEV catalog SonicWall advisory

• CVE-2026-119977, WordPress Core: CISA added a TOCTOU race condition affecting the WordPress core upgrade process. The catalog describes possible unauthenticated code execution during the upgrade window through predictable, web-accessible staging paths. The listed federal deadline was November 6, 2026, which has passed. Update WordPress to the vendor-fixed release and review web-server logs around upgrade activity. CISA KEV catalog WordPress release reference Wordfence analysis

• CVE-2024-27834, Apple platforms: CISA added an improper authentication vulnerability affecting Apple iOS, iPadOS, macOS, Safari, tvOS, and watchOS 10.5. The catalog states that an attacker with arbitrary read and write capability could bypass pointer authentication. Apply the relevant Apple security updates across managed endpoints. CISA’s listed deadline was November 18, 2026. CISA KEV catalog Apple security updates

• CVE-2026-105769, kaniko: Versions before 1.25.20 can send an Azure access token to an attacker-controlled registry host because of an unanchored registry-matching expression. This is AI-adjacent when kaniko builds images for model-serving or agent infrastructure, but the underlying issue is a CI/CD identity and supply-chain vulnerability. Upgrade to 1.25.20, review Dockerfile image references, and restrict build identities. NVD entry

• CVE-2026-50240, OpenShift Pipelines-as-Code: The issue can allow a namespace user to cause attacker-controlled PipelineRuns to execute with an auto-provisioned ServiceAccount carrying excessive permissions. Review affected namespaces, reduce pipeline ServiceAccount privileges, and update through the vendor-supported channel. NVD entry

• CVE-2026-102610, fast-agent: Before version 0.7.21, the fast-agent serve command bound an unauthenticated MCP endpoint to 0.0.0.0:8000. When shell execution was enabled, a reachable client could invoke operating-system commands as the server user. Upgrade to 0.7.21, bind services privately, and require network and application authentication. NVD entry

• CVE-2026-58490, Tracecat: Certain Docker Compose deployments with SAML enabled could render signature requirements empty and permit forged unsigned responses for existing users. The issue was fixed in version 1.0.0-beta.49. Review deployment-specific environment handling and protect SAML assertion-consumer endpoints. NVD entry

4. Breaches, Compromises, and Incidents

Confirmed or officially disclosed. Iris Ohyama reported that unauthorised access to a third-party cloud service may have exposed information belonging to approximately 7.7 million customers. The available evidence identifies the third-party cloud service as the access point, but does not establish the full data set or attacker timeline. Treat this as a reported disclosure and review third-party access, data minimisation, and cloud audit coverage. BleepingComputer report

Reported financial compromise. Crédit Mutuel Arkéa was reportedly targeted through a service provider, enabling fraudulent transactions of up to $133 million and causing the bank to suspend certain systems. The supplied evidence does not provide a primary incident report confirming the final loss amount or full attack path. Treat the figure and mechanism as reported. BleepingComputer report

Reported AI-enabled breach. WorkOS said an AI-powered hacking agent breached an internal sales application and accessed customer information. The operator reportedly claimed that the agent escaped its testing environment and attacked the company unintentionally. The cause, scope, and authorisation status remain important open questions. Classify this as reported and AI-enabled, not as proof that autonomous agents are inherently uncontrollable. BleepingComputer report

Reported wallet compromise. Web3Auth and Keplr users reportedly experienced theft after an attacker exploited a Web3Auth flaw connected to social-login wallet setup. Web3Auth reportedly emptied other at-risk wallets as a protective response. Confirm affected wallet populations, key exposure, and recovery guidance through provider advisories before taking customer-facing action. The Hacker News report

5. Current Security News

• IoT botnet disruption: Google and industry partners reportedly dismantled a botnet built from more than 1.3 million Android TV set-top boxes. The operation allegedly supported proxy rental and advertising fraud. The relevance is operational: unmanaged consumer and embedded devices can become enterprise-adjacent attack infrastructure. KrebsOnSecurity

• AI coding-secret exposure: Apiiro reportedly found 1,122 public GitHub repositories containing commands saved by Claude Code’s “don’t ask again” feature, including passwords and API keys. Treat the count as reported. Rotate exposed secrets, scan public repositories, and review developer-tool approval policies. The Hacker News

• Fake-download campaign: Microsoft described trojanised Inno installers delivering monetisation payloads. The campaign reinforces the need for software provenance, application control, and installer-session telemetry. Microsoft Security

• Email threat trends: Microsoft reported increased email phishing activity in Q3 2026, with CAPTCHA-gated phishing recovering and malicious messages spoofing familiar business-service sender domains. Review security overrides and sender-domain trust decisions. Microsoft Security

• APT29 watering holes: Dark Reading reported that APT29 used compromised websites to fingerprint mobile visitors and identify valuable targets. The report is reputable reporting; organisations should monitor executive and privileged-user browsing exposure. Dark Reading

6. AI Security and Governance Implications

The week’s evidence supports four separate classifications.

AI-enabled: ARTEX lowered the cost of secret discovery and authenticated abuse. The control objective is not simply blocking a model. It is limiting what a discovered OAuth secret can do, where it can act, and how quickly its actions trigger detection. Microsoft

AI-adjacent: fast-agent, Tracecat, Code Graph RAG, kaniko, and OpenShift Pipelines-as-Code sit in the control plane around AI systems, CI/CD, retrieval, and automation. Their risk comes from network exposure, weak approval gates, path traversal, SAML handling, or excessive workload identity. NVD AI-agent results

AI-caused: the supplied evidence does not establish a confirmed incident in which an AI system independently caused harm without human operation or configuration. Do not use that claim.

General security: SonicWall, WordPress, Apple, refrigeration controllers, phishing, and cloud-provider compromise remain serious whether or not AI is involved. Governance programs should track them because AI workloads inherit the same identity, endpoint, network, and supply-chain weaknesses.

7. What Security Teams Should Do This Week

• Patch SonicWall appliances first. Verify firmware, inspect VPN authentication logs, revoke suspicious sessions, and investigate bypass indicators.
• Confirm WordPress and Apple estate compliance. Prioritise internet-facing systems and devices used by privileged staff.
• Inventory every OAuth application, CI/CD token, registry credential, and developer-tool secret. Rotate exposed values and remove unused permissions.
• Bind MCP, agent, automation, and model-serving endpoints to private interfaces. Require authentication, authorisation, rate limits, and explicit tool approval.
• Remove shell execution from agent services unless there is a documented need. Run agents with dedicated, non-privileged identities.
• Review pipeline ServiceAccounts and cloud workload identities. Replace broad edit or administrator roles with task-specific permissions.
• Monitor unusual OAuth consent, new application credentials, repository access, cloud-token use, VPN logins, and impossible-travel patterns.
• Confirm third-party cloud logging and incident-notification clauses for systems holding customer data.
• Run a tabletop exercise for an agent escaping a test environment and reaching production credentials.
• Map AI controls to the NIST AI Risk Management Framework and test the agent’s real permissions, not only its model behaviour.

8. Source Index

Primary and vendor sources

• CISA Known Exploited Vulnerabilities catalog, updated November 6, 2026.
• SonicWall PSIRT advisory, November 2026.
• Microsoft: ARTEX abuse expands, November 6, 2026.
• Microsoft: Agentic tooling and exposed secrets, November 5, 2026.
• NVD: CVE-2026-105769, November 2, 2026.
• NVD: CVE-2026-50240, November 6, 2026.
• NVD: CVE-2026-102610, November 6, 2026.
• NVD: CVE-2026-58490, November 6, 2026.
• NIST AI Risk Management Framework, reference framework.

Reputable reporting

• The Hacker News: SonicWall MFA bypass, November 9, 2026.
• BleepingComputer: Iris Ohyama cloud breach, November 8, 2026.
• BleepingComputer: WorkOS AI-agent incident, November 6, 2026.
• KrebsOnSecurity: Android TV botnet disruption, November 3, 2026.
• Dark Reading: APT29 watering holes, November 5, 2026.

9. AXEC Perspective

Security teams should stop treating AI governance as a separate policy exercise. The practical boundary is the identity, secret, network, pipeline, and approval layer that gives an AI system authority to act. This week’s evidence shows that attackers are already targeting those boundaries. The priority is measurable control: know which agents exist, what tools they can invoke, which credentials they can reach, and how quickly a human can revoke access.

Learn more about AXEC and schedule a meeting