VulnWatch VulnWatch
← All articles
Weekly digest · Jul 27, 2026

VulnWatch Weekly: Oracle Coherence Flood, Supply Chain Poisoning, and Agentic RCE

This week saw an unprecedented flood of Oracle Coherence RCEs, a critical npm supply chain compromise, and severe agentic vulnerabilities in M365 Copilot and PraisonAI. Immediate patching and supply chain audits are required.

Prompt Injection Remote Code Execution Data Leakage Auth Bypass SSRF Agentic / MCP

Week in Review: July 20–26, 2026

Executive Summary

The week of July 20–26, 2026, will be remembered as one of the most volatile periods for AI infrastructure security in recent memory, defined by three dominant themes: a historic cascade of Remote Code Execution (RCE) vulnerabilities in Oracle Coherence, a sophisticated supply chain poisoning attack targeting the Node.js ecosystem, and the maturation of "agentic" exploitation techniques that turn AI assistants into direct attack vectors. The single most urgent item for all CISOs and platform teams is the compromise of the @beproduct/nestjs-auth npm package (CVE-2026-46412), which actively harvested cloud credentials and tokens from CI/CD environments, necessitating an immediate rotation of all secrets in affected pipelines. While the sheer volume of Oracle Coherence CVEs is staggering, the stealthy nature of the supply chain attack and the emergence of unauthenticated RCE in major AI platforms like M365 Copilot represent a fundamental shift in the threat landscape that requires immediate, decisive action.

Top Items of the Week

The following entries represent the highest-impact vulnerabilities discovered this week. These items demand immediate attention from security engineering and ML platform teams.

  1. CVE-2026-46412 | Critical (10.0) | Supply Chain / Credential Harvesting

    • Affected Component: @beproduct/nestjs-auth (npm)
    • Impact: Malicious versions published via compromised token harvested npm, GitHub, AWS, and Vault secrets from build environments.
    • Recommended Action: Immediately audit package-lock.json for versions 0.1.2–0.1.19. Rotate all credentials (AWS keys, GitHub PATs, OIDC tokens) exposed in any environment where this package was installed. View Advisory

  2. CVE-2026-50517 | Critical (9.9) | RCE in AI Assistant

    • Affected Component: Microsoft M365 Copilot
    • Impact: Deserialization of untrusted data allows authorized attackers to execute arbitrary code over the network.
    • Recommended Action: Apply Microsoft's emergency patch immediately. Review logs for anomalous deserialization events in Copilot connectors. View Advisory

  3. GHSA-w28w-gp39-m4p6 | Critical (10.0) | SSTI to RCE

    • Affected Component: @prompty/core (Nunjucks Renderer)
    • Impact: Server-Side Template Injection allows unrestricted JavaScript execution in the host Node.js process via crafted .prompty files.
    • Recommended Action: Upgrade @prompty/core to the latest patched version. Audit all user-supplied template inputs for SSTI payloads. View Advisory

  4. CVE-2026-47391 | Critical (9.8) | Agentic RCE

    • Affected Component: PraisonAI (A2A Server)
    • Impact: Unauthenticated A2A JSON-RPC endpoint exposes a calculate tool using Python eval(), leading to arbitrary code execution.
    • Recommended Action: Disable the A2A server example in production. Upgrade to PraisonAI v4.6.40+ and restrict network access to agent endpoints. View Advisory

  5. CVE-2026-65700 | Critical (9.3) | Path Traversal / Auth Bypass

    • Affected Component: h2oGPT
    • Impact: Path traversal in the OpenAI-compatible files API allows unauthenticated read/write/delete of arbitrary files via bearer token manipulation.
    • Recommended Action: Upgrade h2oGPT to >0.2.1. Implement strict allowlisting for file API paths and enforce non-empty API keys. View Advisory

  6. CVE-2026-60217, CVE-2026-60308, et al. | Critical (9.8–10.0) | Oracle Coherence RCE

    • Affected Component: Oracle Coherence (Multiple versions)
    • Impact: Dozens of easily exploitable vulnerabilities allow unauthenticated network attackers to take over Oracle Coherence instances.
    • Recommended Action: This is a mass-exploitation event. Apply the July 2026 Critical Patch Update (CPU) immediately. Isolate Coherence ports from untrusted networks until patched. View NVD List

  7. CVE-2026-63764 | Critical (9.2) | SSRF

    • Affected Component: lmdeploy
    • Impact: SSRF via crafted image_url redirects allows access to internal cloud metadata and loopback services.
    • Recommended Action: Patch lmdeploy. Implement egress filtering to block access to cloud metadata IPs (e.g., 169.254.169.254) from model serving pods. View Advisory

  8. CVE-2026-57495 | High (8.2) | Indirect Prompt Injection

    • Affected Component: AgenticMail (@agenticmail/claudecode)
    • Impact: Inbound email triggers session resumption with permissionMode: 'bypassPermissions', allowing attackers to hijack Claude Code sessions.
    • Recommended Action: Upgrade AgenticMail packages immediately. Audit email bridges for unauthorized session activations. View Advisory

The Oracle Coherence Deluge

The most visually striking aspect of this week's digest is the sheer volume of vulnerabilities disclosed in Oracle Coherence. We tracked over 40 distinct CVEs (ranging from CVE-2026-60197 to CVE-2026-60309) affecting the Core component of Oracle Fusion Middleware. While the NVD entries often share similar descriptions, they represent a complex matrix of attack vectors including TCP, HTTP, HTTPS, HTTP/2, T3, and IIOP protocols.

The severity is uniformly critical, with dozens of entries carrying CVSS scores of 9.8 and 10.0. The common thread is "easily exploitable" and "unauthenticated attacker with network access," resulting in full takeover of the Coherence cluster. For organizations running Coherence as a caching or data grid layer for AI inference pipelines or vector stores, this is a catastrophic exposure. The attack surface is vast, covering versions 12.2.1.4.0 through 15.1.1.0.0.

Actionable Insight: Do not attempt to triage these individually. Treat this as a singular, critical infrastructure failure. The Oracle July 2026 Critical Patch Update must be applied across the board. Until patching is complete, network-level isolation of Coherence ports (default 7001, 8088, etc.) is mandatory. Assume any exposed instance is already compromised.

Supply Chain Poisoning and CI/CD Compromise

Beyond the Oracle flood, the most insidious threat emerged from the npm registry. CVE-2026-46412 details a supply chain attack where an attacker utilized a compromised publish token to release 18 malicious versions of @beproduct/nestjs-auth. Unlike typical defacements, this payload was designed for silent exfiltration. The post-install script scanned for ~/.npmrc, GitHub tokens (gho_*), AWS credentials, and HashiCorp Vault tokens, exfiltrating them to an attacker-controlled server.

This incident highlights the fragility of the software supply chain, particularly for packages integrated into CI/CD pipelines where high-privilege credentials are routinely present. The fact that the window of exposure was narrow (May 2026) but the impact potentially permanent (leaked long-lived keys) underscores the need for short-lived credentials and rigorous dependency scanning.

Additionally, we saw GHSA-6g55-p6wh-862q in PostCSS, where attacker-controlled sourceMappingURL comments could trigger arbitrary file reads, leaking file contents via error messages. While less severe than the npm compromise, it demonstrates how build tools continue to be a vector for information disclosure.

Agentic Vulnerabilities: When the Assistant Attacks

A significant thematic shift this week is the rise of vulnerabilities specific to AI Agents and Model Context Protocol (MCP) servers. As organizations deploy agents with tool-use capabilities, the attack surface has expanded from the model itself to the tools it can invoke.

  • PraisonAI (CVE-2026-47391 & CVE-2026-47393): Two critical flaws were found. First, an unauthenticated A2A endpoint exposed a Python eval() tool, allowing immediate RCE. Second, the default code generator deploys Flask servers with authentication disabled and binds to 0.0.0.0. This is a classic "secure by default" failure that turns a helpful agent into a public shell.
  • AgenticMail (CVE-2026-57495): This vulnerability demonstrates the danger of indirect prompt injection. By sending a specifically crafted email, an attacker could trigger an agent to resume a coding session with permissions bypassed. This bridges the gap between external communication channels and internal privileged actions.
  • MCP Server Flaws: Multiple MCP servers showed weaknesses. CVE-2026-47708 in MCP-for-Stata allowed command injection via unsanitized log file names. CVE-2026-46555 in the WhatsApp MCP Server allowed local processes to send messages and read files due to a lack of authentication on the localhost bridge. CVE-2026-44192 in Ansible Lightspeed MCP allowed path traversal via indirect prompt injection, enabling file writes to unauthorized locations.
  • n8n (CVE-2026-65015): A privilege escalation flaw allowed Project Viewers to chat with an agent and execute arbitrary nodes, effectively bypassing role-based access controls to steal credentials.

These incidents confirm that tool authorization is the new perimeter. If an agent can be tricked into calling a tool, the security of that tool call is paramount.

Model Serving and Infrastructure Risks

The infrastructure layer supporting LLMs also faced significant challenges this week.

  • h2oGPT (CVE-2026-65700): A severe path traversal vulnerability in the files API allowed unauthenticated attackers to read, write, and delete arbitrary files. The root cause was using the bearer token string directly as a path component without sanitization. This is a textbook example of how custom API implementations can introduce legacy web vulnerabilities into modern AI stacks.
  • lmdeploy (CVE-2026-63764): An SSRF vulnerability allowed attackers to bypass URL safety checks by using HTTP redirects to point image_url parameters to internal metadata services. This poses a direct threat to cloud-hosted model instances.
  • Ollama (CVE-2026-65315): An uncontrolled memory allocation bug in the GGUF metadata parser allowed remote attackers to crash the server via crafted model files, leading to a denial of service.
  • Prompty (GHSA-w28w-gp39-m4p6): As noted in the top items, the Nunjucks renderer in Prompty allowed SSTI to RCE, compromising the host Node.js process. This is particularly dangerous for applications that allow users to upload or define custom prompts.

Known Exploited Status

Fortunately, as of this writing, none of the vulnerabilities tracked this week are flagged as is_exploited: true in public databases. However, the nature of the Oracle Coherence flaws (easy, unauthenticated, network-accessible) and the public availability of the npm malicious package details suggests that active exploitation is highly probable in the wild, even if not yet formally confirmed by vendors. The window for proactive defense is closing rapidly.

What to Do This Week

  1. Rotate All Secrets: If your CI/CD pipelines or production environments installed @beproduct/nestjs-auth between May and July 2026, assume total compromise. Rotate AWS keys, GitHub tokens, npm tokens, and Vault credentials immediately.
  2. Patch Oracle Coherence: Prioritize the application of the July 2026 Oracle CPU. Isolate Coherence nodes from the internet and untrusted internal segments until patched.
  3. Audit Agent Tooling: Review all MCP servers and Agentic frameworks in production. Ensure that:
    • No tools use eval() or unsanitized string interpolation for command execution.
    • Localhost bridges (like WhatsApp MCP) are authenticated or firewalled.
    • Default deployments do not bind to 0.0.0.0 without authentication.
  4. Sanitize Template Inputs: For applications using Prompty, Nunjucks, or similar templating engines with LLMs, enforce strict sandboxing and disable access to constructor/prototype properties.
  5. Egress Filtering: Block access to cloud metadata endpoints (169.254.169.254 and variants) from all model serving and agent runtime pods to mitigate SSRF risks.

What to Watch Next Week

Next week, we anticipate a surge in exploit scripts targeting the Oracle Coherence RCE chain, given the number of affected versions and the ease of exploitation. We will also be monitoring the npm registry for follow-on supply chain attacks mimicking the @beproduct incident, as attackers often strike while defenses are focused on a specific vector. Finally, expect deeper analysis on "Indirect Prompt Injection" as the AgenticMail vulnerability sets a precedent for using email and other asynchronous channels to hijack agent sessions.

Stay vigilant, patch aggressively, and assume your agents are already being probed.

Covered entries (120)