2026-06-23-165387f6

• Items dropped:
  • CVE-2026-20245 — Cisco Catalyst SD-WAN Manager CLI command-injection-to-root ("sixth SD-WAN zero-day of 2026"). Verified live (Cisco PSIRT advisory cisco-sa-sdwan-privesc-4uxFrdzx, dated 2026-06-05; SecurityWeek 2026-06-09; CISA KEV dateAdded 2026-06-09) but dropped on recency: the primary source is ~14 days old, with no fresh in-window exploitation or attribution delta. The only in-window anchor was the CISA-KEV remediation deadline of 2026-06-23 — a US FCEB compliance date with no jurisdictional weight for a CH/EU SOC and, per PD-13, never sufficient on its own to justify coverage.
  • DifyTap — CVE-2026-41947 / -41948 / -41949 (cross-tenant authorization flaws in the Dify AI platform, CVSS up to 9.4). Did not clear the § 2 inclusion gate (exploitation requires an authenticated editor; no in-the-wild exploitation reported), and the only reachable sourcing was an aggregator (The Hacker News) plus NVD — the Zafran Security primary write-up was not separately resolvable. Held for future coverage if a primary source or exploitation emerges.
  • Microsoft 365 Copilot — CVE-2026-54130 (CVSS 9.8) / CVE-2026-47645 (8.8), BSI WID-SEC-2026-2020. Microsoft mitigated both server-side with no customer action required, so neither meets the daily relevance bar (nothing to patch/hunt/block/detect). Noted only as a SaaS-attack-surface signal — EU public-sector M365 tenants should keep Copilot in their SaaS bulletin-monitoring scope.
  • AryStinger botnet (legacy D-Link / QNAP reconnaissance-and-proxy mesh). Re-surfaced by a sub-agent but already covered as the 2026-06-22 deep dive; excluded per PD-8 (no material in-window delta).
• Single-source items: Elastic Azure AD Graph Activity Logs detection guide (§ 3) — Elastic is a vendor lab, so the national-CERT carve-out does not apply; the underlying GA log source and the described detections are independently verifiable against Microsoft documentation.
• Reduced-confidence / disambiguation: ShapedPlugin sources reference both CVE-2026-10735 (CVSS 9.8) and a duplicate submission CVE-2026-49777 (CVSS 10.0); this brief uses CVE-2026-10735 as the canonical identifier. ILIAS CVE-2026-12789 (§ 2) sits below the standard § 2 CVSS/exploitation gate (CVSS v4 2.0, authenticated) and is retained on CH/EU-public-sector-education relevance grounds: BSI-flagged, no patch available, public PoC, and DACH-ubiquitous deployment.
• Contradictions: TfL incident cost (§ 1) — the NCA primary press release states £29M in loss and recovery costs, while ITV and the BBC report £39M; the brief uses the NCA figure and flags the discrepancy. Squidbleed fixed version (§ 3) — sources disagree: the Squid maintainer first cited 7.6 then 7.7, Debian assesses the commit is already in 7.6 (released 8 June), and SecurityWeek reports the fix shipped in 7.6; the brief treats the fixed version as disputed and advises verifying against the actual build rather than a release number.
• Stalled sub-agents: none — all four research sub-agents returned within the wall-clock budget.
• Coverage gaps: databreaches-net (HTTP 403 on per-article drill — RSS feed reachable, article bodies blocked; rotation-priority); inside-it-ch (Cloudflare-gated; 2026-06-22 content was administrative IT-governance only, no in-window security items; rotation-priority); xlab-qianxin (blog 403 to bridge — AryStinger material reached via BleepingComputer); anssi-fr, ncsc-nl, cert-eu, cert-fr-actu (freshest advisories dated just outside the 36 h window); cnil-fr, ico-uk, sec-disclosures-edgar (no in-window enforcement actions or 8-K Item 1.05 filings).

Unmatched action items (migrated)

• Audit WordPress estates for ShapedPlugin Pro plugins (Product Slider Pro, Real Testimonials Pro, Smart Post Show Pro). If any was on a Pro update between ~21 May and mid-June, treat the site as fully compromised: update to fixed versions and rotate admin passwords, 2FA, DB credentials and wp-config.php salts; hunt for LicenseLoader.php and hidden woocommerce-subscription/woocommerce-notification plugins. See § 1.
• Hunt FortiGate appliances for abuse of diagnose sniffer packet and stray PCAP files, and force a domain-wide credential rotation for any device in the FortiBleed corpus — harvested AD credentials are the downstream prize. See § 4.
• Disable FTP proxying on Squid (drop FTP from Safe_ports / http_access deny ftp) as an interim mitigation for Squidbleed. The fixed version is disputed upstream (7.6 vs 7.7), so confirm the fix is present in your actual build rather than trusting a version number. See § 3.
• Enable AADGraphActivityLogs in Entra diagnostic settings and route them to your SIEM, then deploy ROADrecon/AADInternals enumeration detections (user-agent, client_id vs known apps, 4xx bursts). Low-cost closure of a long-standing identity blind spot. See § 3.
• For ILIAS LMS operators (no patch available): apply WAF rules on the learning-progress endpoints, restrict them to enrolled roles, and verify the ILIAS DB account lacks FILE/DROP/superuser rights. Monitor BSI/GitHub for a fix. See § 2.

Migrated from briefs/2026-06-23.md (v2).