2026-06-15-d964affc

• Quiet window. The 36 h recency window (gap to prior brief 24 h) genuinely produced little new in-window primary publication; most sub-agent candidates were June 9–11 advisories already absorbed by the 2026-06-10 → 2026-06-14 dailies. § 1 and § 4 carry the only solidly in-window developments; §§ 2–3 reflect that brevity rather than missed coverage. Per the less-is-more rule, the brief was not padded.
• Items dropped — already covered, no material in-window delta:
  • Splunk Enterprise CVE-2026-20253 ("watchTowr full RCE chain") — a sub-agent surfaced this as a new development, but the 2026-06-14 brief already covered the complete pre-auth RCE chain (PostgreSQL sidecar /v1/postgres/recovery/backup + /restore, empty Basic-auth → code execution) in both § 2 and its deep dive, citing the same watchTowr Labs (2026-06-12) write-up. No delta; the "file-write only" framing of the prior coverage was inaccurate.
  • Cisco Catalyst SD-WAN Manager CVE-2026-20245 — covered 2026-06-06 (§ 2 + deep-dive context) and re-checked 2026-06-08. The only change this window is the CISA KEV listing (2026-06-09); per PD-13 a KEV listing/deadline on an already-covered, already-confirmed-exploited item is not a fresh threat delta. Re-checked, no promotion.
  • Microsoft Exchange OWA stored XSS CVE-2026-42897 — deep-dived 2026-05-16; the permanent patch (2026-06-09) and CERT-FR alert (2026-06-11) are both out of the 36 h window, and the June patch cycle was covered 2026-06-12. No in-window delta.
• CVEs assessed and not promoted to § 2 (did not clear an inclusion gate, or out-of-window):
  • Adobe ColdFusion CVE-2026-47928 (CVSS 9.6) + CVE-2026-47932 (CVSS 8.8, path-traversal) — unauthenticated, no-interaction RCE with host-level scope change (APSB26-64, 2026-06-09; fixed 2023 Update 20 / 2025 Update 9). On inspection the CVSS vector is AV:A/AC:L/PR:N/UI:N/S:C/... — adjacent-network, not internet-routable — so the earlier "internet-exposed RCE" framing overstated reachability; the realistic threat model requires an attacker already on the same segment. No KEV listing, no ENISA-EUVD-exploited status, no in-the-wild exploitation and no public PoC, and the primary advisory is out of the 36 h window. It therefore clears no § 2 inclusion gate. Still worth patching (see § 6) given ColdFusion's exploitation history and the 9.6 score on flat networks; single-source (Adobe PSIRT — the vendor is the primary disclosing party for its own product).
  • OpenSSL CVE-2026-45447 (PKCS7_verify heap UAF, "potential RCE") / CVE-2026-34182 — primary advisory 2026-06-09, out of window; no in-the-wild exploitation, no public PoC; already noted as an out-of-window drop on 2026-06-13. CMS API users unaffected. Patch and migrate EOL 1.1.1/1.0.2 deployments, but it does not meet the § 2 bar.
  • GitLab EE CVE-2026-6552 (Group SAML account takeover, CVSS 8.7) + CVE-2026-10087 / CVE-2026-7250 / CVE-2026-9204 — patch released 2026-06-10 (out of window); post-auth (Group Owner required), no ITW, no public PoC, CVSS below the 9.0 EUVD threshold. Already assessed and dropped on 2026-06-13. Worth scheduling 19.0.2 / 18.11.5 / 18.10.8; does not clear a § 2 gate.
  • Traefik CVE-2026-47124 (security-policy bypass, GHSA-3g6v-2r68-prfc) — patch 2026-06-11 (out of window); no exploitation, no PoC, not a CVSS-9-class RCE; only affects multi-router-equal-priority configurations. Relevant to EU/CH Kubernetes ingress estates — upgrade to v3.6.20 / v3.7.4 — but below the § 2 bar.
• Recency caveat on the one included out-of-window item: the Cal Water / Handala incident (primary sources 2026-06-12, within the 72 h developing window but outside the strict 36 h window) was promoted on transferable-defender-value grounds — a novel and replicable internet-exposed GNSS/NTRIP attack vector directly applicable to CH/EU water and utility operators — with its publication dates shown inline.
• Unconfirmed claim — held from the body, surfaced to watch: ShinyHunters (UNC6240) listed the Council of Europe (coe.int) on its extortion site on 14 June, claiming ~297 GB of HR/payroll data (~10,000 staff) with a 16 June deadline. Sourced only to two ransomware-monitor blogs (DeXpose, hendryadrian.com); no victim statement and no high-reliability journalism (BleepingComputer, The Record, SecurityWeek) as of 2026-06-15 ~04:40 UTC. Under the fake-news guard (PD-6) leak-site claims require victim disclosure or HIGH-reliability journalism — not met. High potential CH/EU public-sector relevance if confirmed; recommend monitoring for victim confirmation.
• Single-source items in the body: none. (ColdFusion CVE-2026-47928, the only single-source candidate, was not promoted to § 2 — see the assessed-not-promoted list above.)
• Contradictions: none unresolved.
• Sub-agents: all four (S1–S4) returned within the cap; S3 returned zero in-window items (genuinely empty research window, confirmed against the 88-record prior-coverage set).
• Coverage gaps: inside-it-ch (HTTP 403, no Wayback snapshots in 180 days — 4-run failing streak); cert-at (RSS feed returned empty/non-JSON body); ncsc-ch-focus (week 24/25 weekly reports not yet published, 404); sophos-xops (feed 404; featured-blog feed only items June 4–11, out of window); risky-biz (feed 404); databreaches-net (403, 7-run failing streak — bridge deferred, WebSearch fallback found no unique in-window items); sec-disclosures-edgar (EDGAR Item 1.05 query returned zero in-window 8-K cyber filings — content-empty, not a fetch failure); ico-uk, cnil-fr, edpb, troyhunt, mandiant-gtig, sans-isc — fetched/checked, no new in-window content.

Unmatched action items (migrated)

• Audit your external attack surface for internet-exposed RTKBase / NTRIP / GNSS and industrial-IoT platforms. The Cal Water compromise (§ 1) started at a public-facing GNSS-correction server on stale credentials and pivoted to the IT data plane. Place any such service behind MFA-enforced VPN/ZTNA, rotate NTRIP mountpoint passwords, and validate segmentation between the GNSS/IoT layer and billing/IT subnets. Hunt for NTRIP caster authentication from non-field-crew source addresses.
• Schedule the Adobe ColdFusion update (CVE-2026-47928), prioritising flat/shared network segments. Apply ColdFusion 2023 Update 20 / 2025 Update 9 (see § 7) — an unauthenticated, no-interaction CVSS 9.6 RCE with host-level scope change. Note the CVSS vector is AV:A (adjacent network, not internet-routable), so the realistic threat is an attacker who already holds a foothold on the same segment; this lowers urgency relative to a network-reachable RCE but still warrants prompt patching given ColdFusion's exploitation history. Restrict ColdFusion admin-console exposure as a defence-in-depth measure.
• Sustain phishing-page hunting despite the Outsider takedown (§ 4). The FBI seizure cuts Outsider's active infrastructure but not the AI-assisted kit technique; continue to hunt AI-generated package/toll/parking credential-harvest pages and brand-impersonation lures targeting staff.

Migrated from briefs/2026-06-15.md (v2).