2026-07-03-04ba8283

• Dropped CVE (did not clear a § 2 inclusion gate): CVE-2026-20191 — Cisco Catalyst Center unauthenticated path-traversal arbitrary file read (CVSS 7.5, confidentiality-only). Not in CISA KEV, not ENISA-EUVD-exploited, CVSS < 9.0, no reported in-the-wild exploitation, no public PoC, and it is a file-read primitive rather than RCE — so it clears none of the § 2 gates. Flagged by NCSC-NL (NCSC-2026-0218) and BSI CERT-Bund (WID-SEC-2026-2174) citing Cisco's PSIRT advisory (Cisco, 2026-07-01); fixed in 3.1.6-GSMU200. Retained here for awareness and carried in § 6 as a hygiene action.
• borderline-drop: Kubota North America 35-day-dwell breach (employee SSN/DOB/driver's-license/bank data; BleepingComputer + victim notice, 2026-07-01) — real disclosed breach, but no threat actor named, no initial-access vector disclosed, off primary sector (manufacturing), US-only; the transferable lesson (DLP scoping on HR/payroll shares) is generic. A Tier 2/3 responder in this constituency would not act differently in the next 7 days. Dropped for signal.
• Single-source / reduced confidence: Navient 8-K (§ 1) — victim's own SEC regulatory filing; no independent press coverage of the filing found in-window. Included under the victim-own-disclosure carve-out. AdaptHealth 8-K (§ 1) is likewise effectively single-origin — the StockTitan citation is a digest of the same filing, not an independent source — and carries the [SINGLE-SOURCE] flag under the same victim-own-disclosure carve-out.
• Single-origin investigative claim (§ 4 FortiBleed): the ransomware-link, 430,000+ device count, ~20-person operator structure, and Nextcloud-zero-day claims all trace to SOCRadar's analysis of one exposed staging server. Corroborating outlets (The Hacker News, and separately Dark Reading's RSS headline) relay SOCRadar without independent verification. Claims are attributed to SOCRadar in-text and not stated as established fact; the Nextcloud zero-day has no CVE and withheld technical detail. Dark Reading's article page was surfaced via RSS but not fetched this run, so it is not cited as a Source.
• § 3 Research and § 5 Deep Dive are intentionally empty/negative — quiet day; no qualifying research item and no candidate cleared the deep-dive bar.
• No Immediate Action callout — nothing in window is a freshly-weaponised, actively-exploited-right-now, patch-to-the-hour item.
• The home-region & sector research pass returned zero qualifying items: all four essential CH-EU sources (cert-at, enisa, ncsc-ch-focus, ncsc-ch-incidents) were fetched successfully but carried only out-of-window or non-technical content. Near-miss for next run: a Kudelski Security DPRK "Contagious Interview" write-up (2026-06-30) trojanizing a GitHub repo impersonating the Swiss firm Ajuna-network — genuine Swiss nexus but published outside this run's 36 h window.
• Watchlist: not configured (org profile defines no product/supplier watchlist) — sweep line omitted.
• Essential-coverage: cisa-advisories and cisa-directives were attempted but returned HTTP 403 via both direct WebFetch and the cisa page bridge subcommand; no working recipe this run. CISA KEV (separate essential source, api subcommand) was fetched successfully and cross-checked — its only in-window addition (CVE-2026-45659, SharePoint) was already covered on 2026-07-02. All other essential sources were attempted.
• Coverage gaps: cisa-advisories (bridge+webfetch 403); cisa-directives (bridge+webfetch 403); cisa-news (bridge 403); govcert-at (documented RSS path 404 — stale recipe, flagged for metadata-drift fix); ibm-xforce (generic url bridge returns CMS shell only — needs a dedicated subcommand); kela-cyber (per-article pages exceed fetch size caps even via bridge); cert-eu, anssi-fr, cert-pl, ncsc-uk, 0patch-blog, chrome-releases, greynoise, censys-blog (fetched successfully, no in-window items — quiet, not failures).

Unmatched action items (migrated)

• For FortiGate operators: treat any historically internet-exposed FortiGate management/VPN interface as credential-compromised given the confirmed credential-theft-to-ransomware link — rotate local/VPN and downstream domain credentials and hunt the VPN → domain-controller → domain-admin escalation path. Nextcloud operators should track the coordinated zero-day disclosure. See § 4 FortiBleed UPDATE.
• Review the contractor/third-party session trust boundary into cloud EHR/document SaaS: enforce phishing-resistant MFA + token-theft-resistant session binding on contractor identities and scope CASB impossible-travel / new-device alerts to guest/contractor principals. See § 1 AdaptHealth.
• Reassess vendor/fourth-party risk for outside counsel and collections firms holding SSN-class identifiers — mandate encryption-at-rest, short breach-notification SLAs, and independent assessment. See § 1 Navient.
• If you run Cisco Catalyst Center, upgrade to 3.1.6-GSMU200 for the unauthenticated file-read CVE-2026-20191 (Cisco PSIRT, 2026-07-01) and confirm the management plane is not internet-reachable. See § 7.

Migrated from briefs/2026-07-03.md (v2).