⚡ Global Cyber Intel Digest: July 22, 2026

Coverage window: July 21, 2026, 08:00 — July 22, 2026, 08:00 UTC+8

This edition prioritises developments first published or materially updated during the reporting window.

Official vendor advisories and original incident-response research were given precedence. Where active exploitation is based on third-party telemetry rather than confirmation from the affected vendor or a government authority, that distinction is stated explicitly.

---

📝 Executive Summary — 10-Second Read

• 🔴 CVE-2026-50522 is being used against Internet-facing, on-premises Microsoft SharePoint servers. Public exploit code targets an unsafe .NET deserialisation path, while observed attackers are stealing SharePoint machine keys that may enable continued access or forged application artefacts even after the vulnerable code is patched.

• 🔴 Multiple Qilin ransomware intrusions have originated from exploitation of PAN-OS CVE-2026-0257. The GlobalProtect authentication-bypass flaw enables unauthorised VPN sessions in affected configurations, followed by credential theft, lateral movement, data exfiltration and domain-wide encryption.

• 🔴 ServiceNow CVE-2026-6875 remains an urgent enterprise-platform risk. Third-party telemetry has identified activity consistent with use of the publicly disclosed pre-authentication exploit chain, although the operators and their intent have not been established. ServiceNow says it has not identified the reported activity against instances it hosts.

• 🟠 Identity and endpoint trust remain major attack surfaces. Clover Health disclosed a social-engineering incident involving three employee accounts, while the unpatched Windows “LegacyHive” weakness now has third-party micropatches but no official Microsoft fix.

---

🔍 Major Incidents: Technical Analysis

1. CVE-2026-50522: SharePoint Deserialisation RCE Used to Steal Machine Keys

Status: New exploitation reporting during the coverage window
Microsoft CVSS v3.1: 9.8 — Critical
ZDI technical assessment: CVSS 8.1 — High attack complexity
Analyst operational priority: 🔴 Critical
Direct impact: Remote code execution
Observed post-exploitation objective: SharePoint machine-key theft
Residual risk: Forged authentication artefacts and continued application-level access after patching
Exploitation status: Active exploitation reported by watchTowr and Defused; Microsoft’s original advisory did not initially mark the vulnerability as exploited

Incident Overview

Security researchers have observed attackers exploiting CVE-2026-50522 against vulnerable, on-premises Microsoft SharePoint servers shortly after functional proof-of-concept code became public.

The vulnerability is classified as an unsafe deserialisation issue affecting Microsoft SharePoint Server. Microsoft’s CVE record assigns it a network-accessible, low-complexity vector requiring no privileges or user interaction.

However, Zero Day Initiative’s technical assessment assigns High attack complexity and notes that the vulnerability may be used in conjunction with other SharePoint weaknesses.

watchTowr reported that its global honeypot network captured successful exploitation attempts within hours of the public exploit appearing.

The observed attackers were reportedly extracting SharePoint machine keys, creating a risk that compromise could persist beyond installation of the security update.

Source Discrepancy

Microsoft’s CVE description and CVSS vector classify the vulnerability as unauthenticated:

AV:N / AC:L / PR:N / UI:N

However, an advisory excerpt quoted by media described an attacker authenticated as at least a Site Owner.

Third-party telemetry from Defused reportedly captured exploitation requests containing no authentication material.

Until Microsoft clarifies the conflicting wording, Internet-facing deployments should be treated as potentially exposed to a pre-authentication attack.

Security teams should also distinguish between:

• The direct code-execution capability of the vulnerability

• The additional prerequisites or chaining conditions discussed by individual researchers

• The post-exploitation theft of cryptographic material observed in active attacks

Technical Deep-Dive

The public proof of concept targets SharePoint’s WS-Federation sign-in processing endpoint:

/_trust/default.aspx

At a high level, the exploit chain works as follows:

1. The attacker constructs a forged WS-Federation sign-in response.

2. A malicious .NET BinaryFormatter object graph is embedded inside a forged SecurityContextToken.

3. The token is delivered to SharePoint’s trust endpoint.

4. A vulnerable SharePoint component deserialises the attacker-controlled object.

5. Methods within the supplied object graph are invoked during reconstruction.

6. The resulting gadget chain executes attacker-controlled code in the SharePoint server context.

Deserialisation is dangerous because the application is not simply decoding passive data.

It is reconstructing complex objects whose constructors, properties, deserialisation callbacks or other methods may execute automatically.

Machine-Key Theft and Residual Risk

Observed attacks reportedly use the resulting code execution to retrieve SharePoint machine keys.

These keys are used to protect or validate application state, authentication artefacts and signed data.

Once the keys are stolen, an attacker may be able to generate artefacts that the application treats as authentic.

This creates an important incident-response distinction:

• Installing the patch closes the vulnerable deserialisation path.

• It does not invalidate machine keys or other cryptographic material already obtained by the attacker.

• A patched server may therefore remain exposed to forged artefacts until the affected secrets are rotated.

Affected Products

The official CVE data lists affected builds of:

• Microsoft SharePoint Enterprise Server 2016

• Microsoft SharePoint Server 2019

• Microsoft SharePoint Server Subscription Edition

SharePoint Online is not part of the affected on-premises server product set described in the CVE record.

Mitigation and Threat Hunting

1. Install the applicable July 2026 SharePoint security updates immediately.

2. Apply the update across every applicable SharePoint server in the farm.

3. Complete the required SharePoint configuration-upgrade process, including the appropriate PSConfig or supported farm-upgrade workflow.

4. Verify the resulting farm build rather than relying only on Windows Update history or the installation status of a single node.

5. Confirm that installed builds meet or exceed the applicable fixed versions identified by Microsoft:

   • SharePoint Enterprise Server 2016: 16.0.5561.1001

   • SharePoint Server 2019: 16.0.10417.20175

   • SharePoint Subscription Edition: 16.0.19725.20434

6. Temporarily remove unpatched SharePoint servers from direct Internet exposure.

7. Rotate SharePoint machine keys and related application secrets on systems that were publicly exposed before patching, using Microsoft-supported procedures.

8. Hunt for:

   • Requests to /_trust/default.aspx

   • Unusual or malformed WS-Federation responses

   • Unexpected w3wp.exe child processes

   • PowerShell or command-shell execution from IIS workers

   • Newly created .aspx files

   • Unknown assemblies

   • New scheduled tasks or services

   • Outbound connections from SharePoint application pools

   • Access to configuration files or locations containing machine keys

9. Review SharePoint and IIS logs for exploitation attempts that occurred before the security update was installed.

10. If compromise indicators are found, isolate the affected server and begin incident response.

11. Do not treat patch installation alone as evidence that the environment is clean.

References

Microsoft Security Response Center — CVE-2026-50522
msrc.microsoft.com/update-guide/vulner...

NVD — CVE-2026-50522
nvd.nist.gov/vuln/detail/CVE-202...

BleepingComputer — Critical SharePoint RCE Exploited to Steal Machine Keys
www.bleepingcomputer.com/news/security/criti...

The Hacker News — Critical SharePoint RCE CVE-2026-50522
thehackernews.com/2026/07/critical-sh...

---

2. CVE-2026-0257: GlobalProtect Authentication Bypass Leads to Qilin Ransomware

Status: Materially amplified during the coverage window; primary Arctic Wolf research published July 20, 2026
Vendor severity: 🟠 High — CVSS v4.0 7.8
Vendor urgency: Highest
Analyst operational priority: 🔴 Critical for exposed configurations
Impact: Unauthorised VPN access, domain compromise, data exfiltration and ransomware
Exploitation status: Confirmed active exploitation

Incident Overview

Arctic Wolf investigated multiple Qilin ransomware intrusions that originated from exploitation of CVE-2026-0257 against Palo Alto Networks PAN-OS firewalls.

The attacks began with unauthorised GlobalProtect VPN sessions and progressed to:

• Credential dumping

• Active Directory compromise

• Lateral movement

• Defence evasion

• Data theft

• Ransomware deployment

Post-compromise activity differed between victims.

Some environments were encrypted quickly with limited reconnaissance, while others experienced extended credential theft and double-extortion activity.

The variation may indicate that multiple Qilin affiliates are using the same initial-access technique. However, shared infrastructure, coordinated activity or a single operator using different playbooks cannot be excluded.

Vulnerable Configuration

The vulnerability affects GlobalProtect portals and gateways configured with:

• Authentication Override cookies enabled

• A certificate configuration that permits the Authentication Override public key to be obtained through another exposed function

Authentication Override allows a user who has already authenticated to present a cookie during a later connection rather than repeating the complete authentication flow.

Technical Deep-Dive

Palo Alto Networks classifies the weakness as:

CWE-565 — Reliance on Cookies without Validation and Integrity Checking

In affected versions, the appliance decrypts the Authentication Override cookie and trusts the recovered fields without performing a sufficiently independent integrity check.

The vulnerable flow can be summarised as follows:

1. A GlobalProtect deployment enables Authentication Override cookies.

2. The certificate used for those cookies is also reused by the GlobalProtect HTTPS service or another externally accessible function.

3. The corresponding public key becomes obtainable by an unauthenticated attacker.

4. The attacker constructs a forged Authentication Override cookie using the public key.

5. The appliance successfully decrypts the cookie.

6. The recovered identity fields are accepted without an independent integrity validation step.

7. The attacker establishes an unauthorised GlobalProtect VPN session without presenting valid user credentials.

The fixed implementation introduces stricter HMAC-based validation and regenerates cookies using a more secure method.

Users must authenticate again after upgrading because legacy cookies are no longer trusted.

Observed Qilin Attack Chain

After establishing a GlobalProtect session, attackers moved rapidly into credential-driven operations.

Persistence

Observed tools and artefacts included:

• AnyDesk

• Ngrok

• LogMeIn

• MeshAgent

• Registry Run values following the pattern:

*[a-z]{6}

The ransomware payload was commonly staged as:

C:\PerfLogs\win.exe

Credential Theft

Attackers dumped LSASS memory using:

• rundll32.exe

• comsvcs.dll

In some cases, the resulting dump was written with an unusual .odt extension to avoid simple filename-based detections.

The operators also used ntdsutil.exe and its Install From Media functionality to copy the Active Directory database, potentially exposing password hashes for every domain account.

Lateral Movement

The main lateral-execution pattern involved:

• Compromised administrative accounts

• Windows administrative shares such as C$

• PsExec

• PSEXESVC.exe

• Remote Desktop Protocol

Defence Evasion

Before ransomware execution, attackers were observed:

• Clearing Windows event logs

• Clearing PowerShell operational logs

• Disabling Microsoft Defender real-time protection

• Targeting Veeam backup infrastructure

Exfiltration

Double-extortion incidents involved:

• Rclone

• MEGA

• Proton Drive

• FileZilla

Other intrusions moved directly to encryption without confirmed data theft.

Mitigation and Threat Hunting

1. Upgrade all affected GlobalProtect portals and gateways to a fixed PAN-OS version listed in the Palo Alto Networks advisory.

2. Upgrade every component that generates or accepts Authentication Override cookies.

3. Avoid partial upgrades that leave older cookie-generation or validation behaviour active.

4. Terminate all active GlobalProtect sessions after patching.

5. Require users to authenticate again using valid credentials.

6. Where immediate patching is impossible:

   • Disable Authentication Override cookie generation and acceptance; or

   • Generate a dedicated certificate used exclusively for Authentication Override cookies

7. Do not reuse the portal, gateway or other externally exposed certificate for Authentication Override.

8. Hunt for:

   • Successful VPN sessions without corresponding authentication activity

   • Client hostnames identifying as kali

   • Abnormal device IDs

   • Blank or unusual domain fields

   • Sessions that cannot be correlated with a legitimate user authentication

   • New remote-access tools

   • C:\PerfLogs\win.exe

   • PSEXESVC.exe

   • LSASS access through comsvcs.dll

   • ntdsutil Install From Media operations

   • High-volume transfers to consumer cloud-storage services

   • Event-log clearing across multiple channels

9. Review historical GlobalProtect sessions that occurred before patching.

10. Correlate VPN telemetry with:

• Identity-provider authentication

• Endpoint activity

• Active Directory logons

• Privileged-account use

• Cloud-storage transfers

11. Treat evidence of successful exploitation as a network compromise—not merely a firewall patching issue.

References

Palo Alto Networks — CVE-2026-0257
security.paloaltonetworks.com/CVE-2026-0257

Arctic Wolf — Exploitation of CVE-2026-0257 Leads to Qilin Ransomware
arcticwolf.com/resources/blog/expl...

BleepingComputer — GlobalProtect Authentication Bypass Exploited in Ransomware Attacks
www.bleepingcomputer.com/news/security/criti...

The Hacker News — Qilin Ransomware Attacks Exploit PAN-OS CVE-2026-0257
thehackernews.com/2026/07/qilin-ranso...

---

3. CVE-2026-6875: ServiceNow Pre-Authentication Sandbox Escape

Status: Materially updated during the coverage window; original disclosure predates the window
Vendor severity: Critical — CVSS v4.0 9.5
Attack complexity: High
Analyst operational priority: 🔴 Critical
Impact: Unauthenticated, highly privileged code execution within an affected ServiceNow instance
Exploitation status: Third-party telemetry identified activity consistent with the public exploit chain; operators and intent remain unconfirmed

Incident Overview

CVE-2026-6875 affects the ServiceNow AI Platform’s server-side scripting and sandbox controls.

Searchlight Cyber reported the issue to ServiceNow on April 1, 2026.

ServiceNow deployed immediate mitigations to hosted cloud instances within approximately 24 hours and subsequently released updates addressing the underlying weaknesses.

Defused later reported observing activity against the same pre-authentication endpoint documented in Searchlight Cyber’s research.

The firm initially described the captured payload as using a different sandbox-escape method. It subsequently corrected that assessment and stated that the payload matched Searchlight Cyber’s published proof of concept.

The identity and intent of the operators have not been publicly established. The activity could represent malicious exploitation, security research or opportunistic scanning.

ServiceNow stated that it had not identified evidence connecting the reported activity to instances hosted by ServiceNow.

Self-hosted and partner-managed customers should therefore verify their actual patch status directly.

Technical Deep-Dive

The attack begins with a pre-authentication page:

/assessment_thanks.do

A user-controlled parameter called:

sysparm_assessable_type

is passed into a ServiceNow GlideRecord query.

ServiceNow encoded queries support values beginning with:

javascript:

This causes the supplied expression to be evaluated before its result is inserted into the database query.

The first execution occurs inside GlideSystemSandbox, which is intended to restrict access to dangerous JavaScript and Java functionality.

The sandbox blocks straightforward techniques such as:

• Direct eval

• Direct use of the Function constructor

• Function declarations

• Access to restricted Java classes

The escape becomes possible because ServiceNow script includes are loaded through a different evaluation path.

The public research showed that an attacker could abuse differences between the restricted query sandbox and the script-include execution context to recover a code-generation primitive.

At a high level, the chain involved:

1. Reaching an existing JavaScript function through a script include.

2. Deriving access to the JavaScript Function constructor.

3. Replacing a commonly used object method.

4. Supplying attacker-controlled prototype content.

5. Loading another script include that invokes the replaced method.

6. Transforming the attacker’s string into executable JavaScript outside the intended restrictions.

Successful exploitation can provide highly privileged access within the affected ServiceNow instance.

Researchers reported that an attacker could:

• Read sensitive platform tables

• Create or modify administrator accounts

• Change scripts and application logic

• Execute commands through connected MID or proxy servers

• Use ServiceNow integrations as a pathway into internal systems

Why This Matters

ServiceNow commonly connects to:

• Identity and access-management platforms

• CMDB records

• Cloud-management systems

• Endpoint tools

• HR workflows

• Privileged service accounts

• MID Servers inside corporate networks

An application-level compromise may therefore become a bridge into multiple downstream systems rather than remaining isolated to a single ITSM interface.

Mitigation and Threat Hunting

1. Apply every ServiceNow update associated with CVE-2026-6875.

2. Verify the actual build of self-hosted and partner-managed instances.

3. Confirm that the deployed release includes and enforces the applicable Guarded Script restrictions.

4. Search logs for:

   • /assessment_thanks.do

   • sysparm_assessable_type

   • javascript: expressions

   • Encoded or obfuscated query values

   • Unusually long pre-authentication query strings

5. Review:

   • New administrator accounts

   • Modified Script Includes

   • Changes to platform security controls

   • Unusual access to sensitive tables

   • Unexpected MID Server jobs

   • Commands executed through ServiceNow integrations

   • New outbound connections from workflow automation

   • Newly registered OAuth applications or integration credentials

6. Compare current privileged roles against a known-good baseline.

7. Review MID Server activity for commands that cannot be correlated with approved automation.

8. Rotate API tokens, integration credentials and secrets if suspicious activity is identified.

9. Where exploitation cannot be confidently excluded, treat the ServiceNow instance as a potentially compromised identity and automation platform—not merely a vulnerable web application.

References

ServiceNow — Security Advisory KB3137947
support.servicenow.com/kb

Searchlight Cyber — Smashing the ServiceNow Sandbox: Pre-Authentication RCE
slcyber.io/research-center/sma...

BleepingComputer — ServiceNow Code-Execution Flaw Reportedly Exploited
www.bleepingcomputer.com/news/security/criti...

SecurityWeek — Reported Exploitation of ServiceNow Vulnerability
www.securityweek.com/exploitation-of-ser...

---

🛠️ Vulnerability Watch

LegacyHive: Windows User-Profile Weakness Receives Unofficial Micropatches

Status: New mitigation update during the coverage window; original zero-day disclosure predates the window
Operational priority: 🟡 Medium
CVE status: No CVE assigned
Official Microsoft patch: Not available
Third-party mitigation: 0patch micropatches available for selected Windows versions
Exploitation status: No confirmed in-the-wild exploitation

Incident Overview

LegacyHive is an unpatched Windows User Profile Service weakness that may allow a non-administrative user to mount another user’s registry hive with excessive access.

The stripped public proof of concept has additional prerequisites and primarily demonstrates cross-user registry-hive access.

Public analysis indicates that it requires information such as:

• Another standard-user account’s credentials

• A target username

• Local access to the affected device

Independent researchers have assessed that the underlying primitive may be extended to modify another user’s Classes registry hive and cause attacker-controlled code to execute when that user later signs in.

The distinction is important:

• The public proof of concept directly demonstrates cross-user hive access.

• Administrator-context code execution is an assessed extension of the primitive rather than the only behaviour demonstrated by the stripped PoC.

Technical Overview

The underlying process creates temporary profile files inside a staging directory with permissive access controls.

By manipulating the profile-loading workflow, an attacker may cause Windows to mount another user’s hive under attacker-influenced conditions.

Potential targets include:

UsrClass.dat

and the corresponding per-user Classes registry hive.

Modification of that hive could enable persistence through mechanisms such as:

• Per-user COM registration

• Shell extensions

• File-association handlers

• Other login-triggered registry locations

If the affected user is an administrator who later signs in to the same device, attacker-controlled code may execute in that user’s context.

Mitigation

1. Avoid using shared endpoints for both low-privilege users and administrators.

2. Prevent administrators from signing in to potentially compromised user workstations.

3. Monitor for unusual user-hive mounting and modifications to:

   • UsrClass.dat

   • User Classes registry hives

   • Per-user COM registrations

   • Login-triggered persistence locations

   • Shell-extension configuration

4. Apply strong isolation to:

   • Jump hosts

   • Privileged-access workstations

   • Administrative VDI systems

   • Shared support endpoints

5. Evaluate the unofficial 0patch micropatch only after compatibility, security and operational testing.

6. Confirm that the specific Windows release is covered by the available micropatch before deployment.

7. Monitor Microsoft guidance for:

   • An official CVE

   • Vendor mitigation

   • Security update

   • Changes to the vulnerability’s assessed impact

References

BleepingComputer — Windows LegacyHive Zero-Day Receives Free Unofficial Patches
www.bleepingcomputer.com/news/security/windo...

ThreatLocker — LegacyHive Demonstration and Analysis
www.threatlocker.com/blog/legacyhive-vid...

---

🔐 Data-Breach Watch

Clover Health: Social Engineering Compromises Three Employee Accounts

Status: Materially amplified during the coverage window; SEC disclosure filed July 17, 2026
Operational priority: 🟠 High for affected individuals
Attack vector: Social engineering and employee-account compromise
Extortion status: No ransomware or extortion group has publicly claimed responsibility
Data-impact status: Scope of accessed or acquired information remains under investigation

Incident Overview

Clover Health Investments disclosed that a threat actor used social engineering to compromise three non-managerial employee accounts.

The affected employees performed:

• Member visit-scheduling functions

• Broker-facing sales functions

Their accounts had access to some personally identifiable information and protected health information.

According to Clover Health, the affected accounts did not provide access to its corporate financial or claims systems.

The company says it contained and terminated the unauthorised access.

However, the precise nature and scope of the information accessed or acquired remain under investigation.

Defensive Significance

The incident illustrates that attackers do not need to compromise a core claims or financial system to create significant healthcare-data exposure.

A lower-privilege employee account may still provide potential access to:

• Member identities

• Contact information

• Appointment details

• Broker relationships

• Protected health information

The business sensitivity of an account should therefore be assessed according to the data and workflows it can access—not merely its formal administrative privilege level.

Mitigation

1. Deploy phishing-resistant MFA for accounts with access to PII or PHI.

2. Strengthen help-desk and account-recovery verification.

3. Require additional verification for:

   • MFA resets

   • Device enrolment

   • Password recovery

   • Changes to contact information

   • New authentication methods

4. Revoke sessions, refresh tokens and application tokens after suspected account compromise.

5. Detect unusual:

   • Device registration

   • Geographic or network-location changes

   • OAuth consent

   • Bulk record access

   • Export activity

   • Access outside the employee’s normal workflow

6. Apply conditional access based on both user identity and managed-device status.

7. Train staff against targeted social engineering involving:

   • Healthcare members

   • Brokers

   • Scheduling workflows

   • Account recovery

   • Help-desk impersonation

8. Review the minimum information required by scheduling and broker-facing employees.

9. Restrict bulk export and high-volume record access unless operationally necessary.

References

Clover Health — SEC Form 8-K
www.sec.gov/Archives/edgar/data...

SecurityWeek — Clover Health Investments Discloses Data Breach
www.securityweek.com/clover-health-inves...

---

🛡️ Today’s Defensive Action Items

P0 — Act Immediately

• Patch every Internet-facing, on-premises SharePoint server.

• Complete the SharePoint farm configuration-upgrade process.

• Rotate SharePoint machine keys and related secrets on systems exposed before patching.

• Patch all affected PAN-OS GlobalProtect portals and gateways.

• Terminate active GlobalProtect sessions after patching.

• Investigate historical VPN sessions for signs of authentication bypass.

• Verify that every self-hosted or partner-managed ServiceNow instance has received the CVE-2026-6875 update.

P1 — Hunt for Compromise

• Search SharePoint servers for abnormal trust-endpoint requests and IIS worker child processes.

• Review SharePoint systems for machine-key access and post-exploitation persistence.

• Hunt for Qilin staging under C:\PerfLogs\.

• Detect PsExec, LSASS dumping, NTDS extraction and large cloud-storage transfers.

• Correlate GlobalProtect sessions with valid identity-provider authentication events.

• Search ServiceNow logs for pre-authentication JavaScript query expressions.

• Review MID Server activity and privileged integration credentials.

P2 — Strengthen Identity Controls

• Require phishing-resistant MFA for healthcare, ITSM and administrative accounts.

• Restrict account-recovery and help-desk reset procedures.

• Revoke refresh tokens after suspicious sign-ins.

• Correlate VPN, endpoint, Active Directory and cloud-storage telemetry.

• Inventory non-human identities, service principals and integration credentials.

• Alert on privileged SaaS activity that does not correspond to an approved workflow.

Endpoint Priority

• Separate administrator activity from shared user workstations.

• Prevent privileged users from signing in to potentially compromised endpoints.

• Monitor registry-hive mounting and user-profile manipulation.

• Evaluate LegacyHive mitigations on jump hosts and privileged-access workstations.

• Treat third-party micropatches as risk-based compensating controls rather than substitutes for an eventual Microsoft update.

---

📌 Final Assessment

Today’s incidents share one operational pattern:

Attackers are turning trusted enterprise control planes into direct paths towards wider compromise.

• SharePoint’s trust-processing flow became an RCE and machine-key theft mechanism.

• A GlobalProtect authentication cookie became an entry point for ransomware.

• ServiceNow’s scripting sandbox became a bridge towards high-privilege workflows.

• Windows user-profile handling created a potential route from local access to execution in another user’s context.

• Compromised healthcare employee accounts created potential access to sensitive information without requiring access to core claims or financial systems.

These incidents also demonstrate that remediation cannot stop at the originally exposed component.

A compromised platform may already have exposed:

• Cryptographic keys

• Active sessions

• Administrative identities

• Downstream integrations

• Internal network access

• Sensitive business records

The defensive lesson is equally consistent:

Patch the exposed component—but investigate every trust relationship that the component could already have exposed.

#CyberSecurity #ThreatIntelligence #CISO #SOC #SharePoint #PANOS #GlobalProtect #ServiceNow #Ransomware #IdentitySecurity #VulnerabilityManagement #IncidentResponse