Tenable Security Intel Brief: AI agents breach 395 organizations
Tenable Security Intel Brief for September 16, 2026 Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, AI agents compromised hundreds of organizations through PaperCut flaws and ignored their own targeting limits. The brief also covers Anthropic's September threat report, the BlueMoon Chrome exploit kit, and Google's findings on stolen AI accounts. AI agents hit 11 organizations in 26 seconds, then ignored orders → Brief: A likely Russian-speaking actor used hundreds of AI agents to exploit two PaperCut NG/MF flaws, compromising at least 440 instances across 395 organizations in 48 countries. Intel: On August 31, the actor ran hundreds of AI agents, using OpenAI's Codex harness paired with a DeepSeek model, to exploit CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw, in PaperCut NG/MF. PaperCut manages an organization's printing, and the software typically runs with system-level privileges and connects to Active Directory. GreyNoise tracked the actor from an empty workspace to code execution on a live victim in under four hours, and once the campaign launched, 11 organizations were compromised in 26 seconds; at one US high school, seven minutes separated initial access from control of the entire domain. Why it matters: The agents ignored the actor's own list of 28 countries to avoid, and Cloudflare's WAF stopped the attack at least once. The agents achieved domain administrator access at only 12 of the 395 organizations. The agents moved faster than the actor's own intent could steer them. AI levels the field between nation-state actors and solo operators → Brief: Anthropic's "Detecting and countering misuse of AI" September 2026 threat report covering disrupted operations between December 2025 and August 2026 documents state espionage operators, financially motivated crews, and lone hacktivists running AI-driven campaigns that previously required skilled teams. Intel: One Russian-nexus actor, whose attribution is "consistent with public reporting linking the actor to Midnight Blizzard," ran agents that rebuilt malware each time security products flagged it. A Chinese-speaking group, likely based in Changsha, produced over a dozen candidate zero-days against network appliances in a month using autonomous research loops; two operators were university undergraduates. A solo French-speaking hacktivist assembled a searchable doxxing index of tens of millions of records and breached at least 14 of 42 targets, running the whole campaign alone. Why it matters: Campaigns at volumes that once required staffed teams came from a group that included two undergraduates and from a hacktivist working alone. Operational complexity no longer tells a defender who they are facing. Four actors share a Chrome exploit kit built from a public fix → Brief: Four espionage-motivated threat actors began using a shared exploit kit Proofpoint tracks as BlueMoon, which chains two Chrome V8 flaws and a Windows kernel zero-day, with China-aligned TA412 deploying it first on August 28. Intel: BlueMoon chains a V8 type confusion flaw (CVE-2026-85046) for remote code execution, a V8 sandbox escape (CVE-2026-87491), and a Windows kernel privilege escalation zero-day (CVE-2026-85880) in older Windows builds. Both V8 flaws were "patch-gap" zero-days: the CVE-2026-85046 fix was committed August 7 but did not reach a stable release until September 3, leaving the fix code publicly visible for nearly four weeks before browsers shipped it. Observed activity is majority China-nexus but not exclusively so, and how four distinct groups obtained the same kit within days remains unknown. Why it matters: When a security fix lands in open-source code before the browser ships it, the commit itself becomes a public map of the vulnerability. Here, that window ran nearly four weeks, long enough for four distinct groups to adopt and deploy the kit. Proofpoint found artifacts in the kit consistent with AI-assisted exploit development, and assesses this pattern of rapid weaponization is likely to recur. AI accounts become loot as agents run a six-hour credential harvest → Brief: Google Threat Intelligence Group (GTIG) reports that stolen AI accounts have become attacker loot, while one threat actor assembled and ran a mass credential harvesting campaign from a compromised cloud resource in under six hours. Intel: The campaign ran on preconfigured Markdown playbooks, with agents autonomously handling scanning, troubleshooting, and IP rotation. GTIG separately found an exposed command-and-control server whose live dashboard organized over 23,800 harvested secrets, cloud and AI service API keys among them. AI access itself is now loot: underground prices for stolen AI accounts more than doubled in 2026, and infostealer malware now targets AI coding tools' configuration files for their plaintext API keys. GTIG says it has "not yet observed threat actors deploying fully autonomous pipelines against targets in the wild." Why it matters: A stolen API key now unlocks more than data: it hands the thief compute capacity and a ready-made attack platform at the victim's expense. The six-hour harvest is the proof. As agents absorb the manual labor, the gap between access and a full operation shrinks, and the defender's response time shrinks with it. Stat of the week: $12.7 billion The amount of financial activity tied to suspected digital asset investment scams, also known as pig butchering, identified across 33,904 Bank Secrecy Act reports filed between September 2023 and December 2025, according to FinCEN. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Oracle May 2026 Critical Security Patch Update Addresses 35 CVEs
On May 28, Oracle released its Critical Security Patch Update (CSPU) for May 2026. This CSPU contains fixes for 35 unique CVEs in 35 security updates across 5 Oracle product families. Out of the 35 security updates published, 31.4% of patches were assigned a critical severity. High severity patches accounted for the bulk of security patches at 51.4%, followed by critical severity patches at 31.4%. For more information about the May 2026 CSPU release, including the availability of patches and Tenable product coverage, please visit our blog.FAQ on SharePoint Zero-Day Vulnerability Exploitation (CVE-2025-53770)
On July 19, researchers at Eye Security identified active exploitation in Microsoft SharePoint Server. Originally, this exploitation was believed to have been linked to a pair of flaws (CVE-2025-49704, CVE-2025-49706) dubbed “ToolShell” that was disclosed at Pwn2Own Berlin and patched in Microsoft’s July 2025 Patch Tuesday release, Microsoft published its own blog post stating that the flaw was actually a zero-day. CVE Description CVSSv3 CVE-2025-53770 Microsoft SharePoint Server Remote Code Execution Vulnerability 9.8 Microsoft confirmed that CVE-2025-53770 is a “variant” of CVE-2025-49706. As of July 20 at 2PM PST, CVE-2025-53770 remains unpatched. Update: Since we published our community and FAQ blog post, Microsoft has created an additional CVE and added in some preliminary patches for SharePoint Subscription Edition and SharePoint Server 2019. CVE Description CVSSv3 CVE-2025-53771 Microsoft SharePoint Server Spoofing Vulnerability 6.3 For more information about these vulnerabilities, including the availability of patches and Tenable product coverage, please visit our blog.CrushFTP Zero-Day Exploited (CVE-2025-54309)
On July 18, CrushFTP warned that a zero-day in its CrushFTP software was being exploited in the wild. CVE Description CVSSv3 CVE-2025-54309 Unprotected Alternate Channel Vulnerability 9.0 According to CrushFTP, the vulnerability was first discovered as being exploited on July 18 at 9AM CST, though they caution that exploitation may have “been going on for longer.” For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.
Research Release Highlight - Changes to SMB Kerberos
Research Release Highlight - Changes to SMB Kerberos Summary Kerberos has been the default authentication mechanism for domain connected Windows devices since Windows 2008. Tenable credentialed scans of Windows targets support an explicit Kerberos credential type. The explicit credential, which names the DC and domain name, frees the Nessus sensor from having to be connected to the Windows domain being scanned and allows the scanner to be hosted on Linux or MacOS as well. The nature of this explicit Kerberos credential type has widely led to the expectation that a Kerberos scan of Windows will never use NTLM. That is not true. Currently Kerberos Windows scans will fail over to using NTLM if Kerberos does not succeed. The Kerberos protocol depends on time synchronization, FQDN target specification and bi-directional DNS name resolution, but NTLM does not. Tenable fails over to NTLM to preserve scan continuity where Kerberos on the target or scanner may not be configured correctly. As each Windows credential is tried, if Kerberos fails, a second attempt will be made using NTLM. Change We are changing Windows scans so that a scan will try all Windows credentials first before trying them again using NTLM if the credential set contains at least one Kerberos credential. This change also extends our Kerberos coverage to include Windows Configuration Manager and Active Directory Service Interfaces (ADSI) scans. Impact In certain customer environments where a single service credential (username/password) is used across multiple domains the current failover behavior causes NTLM to be used prematurely when it is possible that a subsequent Kerberos credential targeting a different domain might succeed. The change here favors Kerberos first and only fails over to NTLM after all credentials have been tried. Customers can also modify their SCCM (Windows Configuration Manager) credentials to include the domain controller's FQDN to allow those scans to use Kerberos. The net effect of these changes will be reduced dependency on NTLM in Windows scans and should produce better results in some cases. Target Release Date 07/16/2025FAQ on BadSuccessor
On May 21, researchers at Akamai published a blog post detailing a new privilege escalation vulnerability in Active Directory (AD) domains. Dubbed "BadSuccessor," the flaw affects AD domains with at least one Windows Server 2025 domain controller. The blog includes details about the flaw, as well as detection and mitigation guidance. As of June 2, Microsoft has not yet released patches nor assigned a CVE for BadSuccessor. However, in the Akamai blog, they quote Microsoft as saying they would “fix this issue in the future.” For more information, including details about BadSuccessor as well as Tenable product coverage, please visit our FAQ blog.TL;DR: The Tenable Research 2020 Threat Landscape...
TL;DR: The Tenable Research 2020 Threat Landscape Retrospective Tenable’s Security Response Team (SRT) is tasked with looking at the threat landscape on a day-to-day basis and, while that provides us with the ability to see things in the moment, it’s only when we look back at the year that was that we can see the bigger picture. In the Tenable Research 2020 Threat Landscape Retrospective, the SRT takes a look back at the major vulnerability and cybersecurity news of 2020 to develop insight and guidance for defenders. The Tenable Research 2020 Threat Landscape Retrospective begins with an overview of the vulnerability landscape in 2020 in which 18,358 new CVEs were assigned. The report progresses to explore the threat landscape in 2020. How were attackers leveraging the vulnerabilities disclosed in 2020, and several that were significantly older? The final section of the report offers a digest of the key vulnerabilities in 2020 including their technical details, whether and how they’ve been exploited, all categorized by vendor or product. The landing page giving access to the report can be found here and an accompanying blog post can be found here.
