Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips

Executive Summary

• CVE-2026-45659 (Microsoft SharePoint RCE): Actively exploited; CISA KEV addition July 1. Deserialization flaw allows authenticated (low-priv) network RCE. Atomic Risk: 9/10. Immediate patching critical for enterprise collaboration platforms; strong Risk Manager + SAST/SCA applicability.
• CVE-2026-8037 (Progress Kemp LoadMaster): Pre-auth OS command injection RCE (CVSS ~9.6–9.8); active exploitation + public PoC. Targets load balancers. Atomic Risk: 9.5/10. High blast radius in network infrastructure.
• Ongoing Mini Shai-Hulud/Miasma npm supply chain worms: Credential harvesting via malicious packages (binding.gyp, postinstall hooks); affects Red Hat Cloud Services, LeoPlatform, and related ecosystems. Persistent propagation risk in CI/CD. Atomic Risk: 9/10. Prioritize SCA + Package Firewall.
• Broader signals: Routine ransomware activity (Qilin, etc.); Chrome renderer/sandbox issues; no silent major zero-days dominating last 48h beyond above. Supply chain remains highest velocity vector.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• SharePoint CVE-2026-45659: Root cause = deserialization of untrusted data (CWE-502). Mechanism: Authenticated attacker crafts payload triggering RCE. Blast radius: Enterprise file/collaboration compromise, lateral movement. Veracode control: Risk Manager for KEV prioritization + SAST for custom code paths.
• Kemp LoadMaster CVE-2026-8037: Pre-auth command injection via API (heap/uninitialized issues). Why now: Public PoC accelerates exploitation. Propagation: Network appliances as entry points. Veracode: EASM for exposed assets.
• npm Supply Chain (Miasma/Shai-Hulud variants): Root = maintainer compromise + install-time execution (binding.gyp bypasses). Blast radius: Secrets theft → CI/CD takeover → downstream supply chain. Veracode: SCA + Package Firewall blocks at ingestion.

Broader Signals

Limited X volume on brand-new exploits in last 24h; focus remains on patching KEV items and npm campaigns. Persistent APT/ransomware activity noted but no fresh high-blast campaigns.

Veracode Tool Reference with Links

• SCA + Package Firewall: https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall
• Risk Manager: https://docs.veracode.com/r/Veracode_Risk_Manager
• Veracode Fix: https://docs.veracode.com/r/About_Veracode_Fix
• SAST: https://docs.veracode.com/r/c_static_overview
• DAST: https://docs.veracode.com/r/DAST
• EASM: https://docs.veracode.com/r/Discover_your_attack_surface
• Container Security: https://docs.veracode.com/r/Veracode_Container_Security
• Policy Management: https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms: Mini Shai-Hulud/Miasma. SCA + Package Firewall fits for dependency scanning/blocking. Action: Enable policies for npm/PyPI; scan all repos.
• New/KEV CVEs: SharePoint CVE-2026-45659, Kemp CVE-2026-8037. Risk Manager (KEV) + EASM. Action: Prioritize in unified view; discover exposed assets.
• Web/Runtime Exploits: Exchange OWA. DAST. Action: Test exposed web apps/APIs.
• Governance: All. Policy Management. Action: Enforce across tools/CI-CD.

Prioritized Action Plan

• Patch CVE-2026-45659 and CVE-2026-8037 today; verify via Risk Manager.
• Enable SCA + Package Firewall policies for malicious npm packages; enforce in CI/CD.
• Run EASM scan for exposed LoadMaster/Exchange assets; apply mitigations.
• Audit dependencies with SCA; use Veracode Fix for remediations.
• Update Policy Management for KEV prioritization and governance.
• Monitor X/vendor feeds; re-scan tomorrow.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.