5 Cyber Threats to Patch Before Tomorrow: AD FS Deadline, ServiceNow RCE, Cl0p Windchill

Microsoft's July 2026 Patch Tuesday fixed 570 vulnerabilities on July 14, including two zero-days confirmed exploited in the wild before patches shipped. Detailed Patch Tuesday coverage including all 570 CVEs is in our dedicated July 2026 analysis. The CISA compliance deadline is what makes the AD FS patch the most time-critical action today.

CVE-2026-56155 is an elevation-of-privilege vulnerability in Active Directory Federation Services. An attacker with low-privileged local access exploits insufficient access controls to escalate to administrator rights, gaining full system control. CISA confirmed active exploitation and added CVE-2026-56155 to its KEV catalog with a federal agency remediation deadline of July 28 — tomorrow. Federal civilian agencies that have not patched or isolated affected AD FS instances are out of compliance as of end of business today. Microsoft's DART team discovered the flaw during active incident investigation, confirming it was used against real targets before disclosure.

CVE-2026-56164 is a separate elevation-of-privilege vulnerability in Microsoft SharePoint Server. A missing authentication check allows an unauthenticated remote attacker to elevate privileges over the network. Microsoft credited Jayson Frost of Mandiant, Genwei Jiang of Google Cloud, and the FLARE Offensive Task Force — a composition that strongly indicates the flaw was uncovered during active incident response at a targeted organization. The interim mitigation is enabling AMSI on SharePoint and setting Request Body Scan to Full mode; the permanent fix is applying the July Patch Tuesday update.

CVE-2026-50661, a Windows BitLocker security feature bypass, is the third Patch Tuesday zero-day. It requires physical device access and is publicly disclosed but not confirmed exploited in the wild. Prioritize the AD FS and SharePoint patches first.

ServiceNow CVE-2026-6875 is a pre-authentication sandbox escape leading to remote code execution in the ServiceNow AI Platform (formerly Now Platform). Threat intelligence company Defused confirmed active exploitation began Friday, July 25. Self-hosted instances received the fix as KB3137947 on July 13 — organizations that have not applied it are now two weeks behind on a vulnerability with confirmed live attacks.

The exploit targets the /assessment_thanks.do endpoint. An unauthenticated attacker abuses a flaw in that endpoint to escape the platform sandbox and execute arbitrary code with platform-level privileges. Searchlight Cyber published a proof-of-concept earlier in July. Defused confirmed live attacks are reaching the same code-execution primitive via "a different route than their published PoC," meaning attackers developed an independent exploit chain that bypasses PoC-based signatures. ServiceNow-hosted cloud instances were patched starting April 2026; the risk is concentrated in customer-managed self-hosted deployments.

ServiceNow is embedded in enterprise IT service management, HR, legal, and security operations workflows across tens of thousands of organizations. Platform-level RCE in a self-hosted instance gives attackers code execution on infrastructure that typically holds broad internal network access and stores sensitive employee, vendor, and IT asset data. Apply KB3137947 immediately on all self-hosted instances. If patching is not possible today, isolate the instance from external access and enable enhanced access logging on /assessment_thanks.do.

Cl0p ransomware affiliates have exploited CVE-2026-12569 in PTC Windchill and FlexPLM since early June 2026, deploying webshells and exfiltrating engineering data from manufacturing, automotive, aerospace, and retail organizations. The active extortion phase began July 20, when Cl0p started sending emails with the subject line "Windchill PDMLink module serious data leak" to hundreds of users at affected organizations.

CVE-2026-12569 is a chained exploit. First, a pre-authentication information disclosure in the FlexPLM WSDL endpoint reveals server-side configuration details. Second, a server-side injection vulnerability in the Windchill login servlet accepts attacker-controlled input to achieve unauthenticated RCE. Attackers deploy hex-format JSP webshells (random alphanumeric filenames with .jsp extension) under /Windchill/login/, establishing persistent post-exploitation access. Post-compromise activity includes filesystem enumeration via a utility named flst.txt, staging of engineering and design data, and double-extortion data theft without encrypting files.

PTC Windchill and FlexPLM are product data management and product lifecycle management platforms used in industrial manufacturing to manage CAD files, engineering designs, bills of materials, and supply chain data. The targeted sectors face the highest operational consequence: exposure of manufacturing IP and engineering data in a Cl0p extortion context means both public leak risk and regulatory reporting obligations. Check every internet-facing Windchill and FlexPLM deployment for unauthorized JSP files immediately. Organizations that receive emails from Cl0p referencing "Windchill PDMLink" should initiate incident response and preserve web server logs for forensic analysis.

No CVE-specific Sigma rules exist yet for CVE-2026-6875 (ServiceNow) or CVE-2026-12569 (PTC Windchill) given how recently these exploits were confirmed — new CVEs typically take days to weeks before community Sigma rules are published and validated. Three behavior-based rules target the observable attack patterns across today's active threats: suspicious access to the AD FS configuration database (post-exploitation indicator for CVE-2026-56155), JSP webshell command execution via URL query parameters (applicable to Windchill's Java servlet environment with path adjustment from /irj/ to /Windchill/login/), and Java webshell file upload detection for the same platform class.

The AD FS named pipe rule requires Sysmon Event ID 17 or 18 (pipe creation) configured in your Sysmon deployment. The webshell rules require web access logs forwarded to your SIEM in W3C format. Deploy in detection mode first and tune against your environment's baseline before switching to blocking.

JadePuffer is the first documented ransomware operation where an autonomous large language model agent handled the complete technical execution chain — from initial access through data encryption — without human operator involvement. Sysdig's Threat Research Team published its analysis on July 1, 2026. The LLM agent exploited CVE-2025-3248, an unauthenticated RCE in the Langflow AI application builder, as the initial access vector. CISA added CVE-2025-3248 to the KEV catalog confirming active exploitation.

The full attack ran end-to-end in under 15 minutes. The LLM agent handled reconnaissance scanning, initial access exploitation, privilege escalation, lateral movement, credential theft, data exfiltration, and file encryption without human direction. Sysdig documented the agent adapting to failed steps in real time — recovering from a failed authentication attempt to a working bypass in 31 seconds. The agent operated as a coordinated network of specialized LLM instances, each assigned a distinct phase of the intrusion lifecycle. Our full JadePuffer analysis covers detection methods and defensive controls in depth.

The immediate policy action is auditing AI agent permissions. JadePuffer demonstrates that adversaries can now deliver a fully autonomous intrusion capability requiring no technical skill in execution. Detection requires behavior-based monitoring — process execution chains, lateral movement patterns, and mass file modification events — rather than signature matching, because the agent generates novel command sequences on each run.

A ransomware attack hit Coca-Cola's Fairlife subsidiary, temporarily suspending dairy product production across the United States. Fairlife reported $1.7 billion in annual retail sales in 2025, making it one of Coca-Cola's highest-growth brands. No ransomware group had claimed responsibility publicly as of Monday morning, and Coca-Cola disclosed neither the attack vector nor the scope of data exfiltration.

The incident fits an accelerating pattern: ransomware groups target consumer goods and food manufacturing for high operational disruption value and payment willingness. Spirals, a new ransomware actor, separately completed an initial-access-to-encryption chain in under 24 hours at a different corporate victim this week — reinforcing the same speed-of-attack trend JadePuffer demonstrated with AI automation.

This top cybersecurity threats week episode illustrates the OT/IT convergence risk in modern food manufacturing: production scheduling, manufacturing execution systems, and logistics platforms depend on connected IT infrastructure. Ransomware-induced IT outages cascade into physical production stops. Organizations in food and consumer goods manufacturing should verify that production-critical systems are isolated behind network segmentation or zero-trust controls, with offline backups current enough to support a 24-hour recovery timeline.

Five active threats, one week. Ranked by urgency with actions you can take today.