N-able RMM Flaw Exploited, TP-Link ZTP Vulnerabilities, and AI Incident Sharing Framework

This daily cybersecurity summary highlights critical updates and new threats impacting organizations. N-able's N-central RMM platform is under scrutiny as CISA adds CVE-2026-18556 and CVE-2026-18577 to its Known Exploited Vulnerabilities catalog. The initial zero-day exploit (CVE-2026-18556) allowed administrative access, and CVE-2026-18577 emerged as a bypass to an incomplete patch, posing a significant supply chain risk to Managed Service Providers (MSPs). Federal agencies are mandated to patch these by August 7, 2026.

Forescout researchers have identified 15 vulnerabilities in TP-Link's Omada Zero-Touch Provisioning (ZTP) system, which, when chained, could lead to full network takeover. These flaws affect hardware, software, and cloud controllers, with potential attack vectors including credential harvesting and device hijacking. The widespread use of Omada controllers online amplifies the risk.

In the realm of AI security, the Open Secure AI Alliance, in collaboration with The Linux Foundation, has proposed the Shared AI Findings Exchange (SAFE) framework. This initiative aims to standardize the reporting of AI security incidents, creating a confidential pipeline for threat intelligence sharing related to agentic AI. Key industry players are supporting this effort to foster a collective defense against systemic AI risks.

Other notable incidents include an accelerated Microsoft Teams vishing campaign by STAC4749 deploying Chaos Ransomware in under 17 hours, leveraging legitimate remote access tools. JetBrains has patched critical flaws in its IDEs and TeamCity CI/CD platform, including RCE and command injection vulnerabilities. A phishing campaign impersonating Bank of America is distributing a disguised ScreenConnect RAT using a UAC bypass for stealthy persistence. Microsoft Defender successfully halted a ransomware attack abusing 'mshta.exe' in 128 seconds through automatic device isolation. Singapore Police are warning of an iMessage phishing scam that has cost victims over S$1.2 million. Finally, cloud misconfigurations continue to be a major breach vector in 2026, with recent incidents exposing millions of records due to default public access and a lack of MFA enforcement.