Threat Intelligence Brief - Friday, June 19, 2026

Executive Signal

• Splunk Enterprise (CVE-2026-20253) is under active exploitation for unauthenticated RCE — CISA has mandated federal agencies patch within three days, and the window for everyone else is equally narrow.
• ~74,000 Fortinet firewall and VPN credentials are publicly exposed via the “FortiBleed” leak — any organization running Fortinet perimeter devices should treat credentials as compromised until rotated.
• The Klue/Salesforce supply chain incident demonstrates that OAuth token abuse in a single third-party SaaS integration can cascade into data exfiltration across multiple customer environments, including named security vendors.
• Gentlemen RaaS is actively investing in EDR-killing capabilities, signaling that endpoint defenses alone are insufficient — organizations relying solely on EDR for ransomware prevention face elevated risk.
• The Novo Nordisk breach via a leaked GitHub token reinforces a persistent pattern: developer secrets are identity credentials and must be governed accordingly, not treated as a tooling afterthought.

Immediate Action Required

High-Impact Developments

Splunk Enterprise RCE Exploited Within Days of Disclosure

• What happened: CVE-2026-20253 in Splunk Enterprise is being actively exploited for unauthenticated remote code execution. CISA added it to the Known Exploited Vulnerabilities catalog and issued a 3-day patch deadline to federal agencies.
• Why it matters: Splunk is a core security operations platform in most enterprise environments. A compromised Splunk instance gives an attacker visibility into — and potentially control over — the security monitoring infrastructure itself.
• Who should care: Vulnerability management, SOC leadership, Splunk administrators, incident response.
• Recommended action: Patch Splunk Enterprise immediately. Where patching is not immediately possible, restrict network exposure of Splunk instances and validate no indicators of compromise exist on Splunk hosts.
• Confidence: High — active exploitation confirmed, CISA KEV listed.
• Search metadata: CVE-2026-20253, T1190, Splunk Enterprise

FortiBleed: 74,000 Fortinet Credentials Exposed

• What happened: A data leak dubbed “FortiBleed” exposed nearly 74,000 credentials for Fortinet firewalls and VPN devices. CISA issued an urgent advisory directing Fortinet customers to secure their devices.
• Why it matters: Exposed perimeter credentials enable direct unauthorized access to network infrastructure. Fortinet devices are high-value targets with a documented history of exploitation. Exploitation from this specific leak is unconfirmed, but the credentials are in threat actor hands now.
• Who should care: Network security, infrastructure operations, security leadership, incident response.
• Recommended action: Rotate all Fortinet device credentials immediately. Review authentication logs for anomalous access. Enforce MFA where supported. Confirm firmware is current.
• Confidence: High — credential exposure confirmed, exploitation status unknown but risk is immediate.
• Search metadata: T1110, Fortinet firewalls, Fortinet VPN, FortiBleed

Klue/Salesforce Supply Chain Attack via OAuth Token Abuse

• What happened: Attackers compromised Klue’s Salesforce integration through OAuth token abuse, exfiltrating data from customer Salesforce instances. Named victims include Huntress and Recorded Future. Salesforce disabled the Klue Battlecards app integration pending investigation. The initial Klue security incident occurred June 11, 2026.
• Why it matters: One compromised vendor integration provided access to multiple downstream customer environments. Security vendors were among the victims. OAuth tokens granted to third-party apps frequently carry broad permissions and persist well beyond operational need.
• Who should care: Security leadership, IAM teams, cloud and application owners, third-party risk management.
• Recommended action: Audit all OAuth integrations connected to Salesforce and other critical SaaS platforms. Revoke tokens for unused or unverified integrations. Enforce least-privilege scoping for all third-party app authorizations. Review Salesforce data access logs for anomalous activity since June 11.
• Confidence: High — incident confirmed by Salesforce, multiple victims named.
• Search metadata: Salesforce, Klue Battlecards app, OAuth token abuse, supply chain attack, data exfiltration

Gentlemen Ransomware Deploys Suite of EDR Killers

• What happened: The Gentlemen ransomware-as-a-service operation is actively developing and distributing multiple EDR-killing tools to affiliates, designed to disable endpoint defenses prior to encryption.
• Why it matters: RaaS groups investing in EDR evasion tooling raise the capability floor for all affiliates — less sophisticated operators can now bypass endpoint controls. Organizations treating EDR as their primary ransomware defense layer are increasingly exposed.
• Who should care: SOC leadership, endpoint security teams, incident response.
• Recommended action: Confirm EDR tamper protection is enabled and enforced. Verify that network-based controls, application allowlisting, and privileged access controls are layered alongside endpoint defenses. Monitor EDR health for unexpected agent terminations.
• Confidence: High — capability confirmed, specific targeting unknown.
• Search metadata: T1562.001, Gentlemen ransomware, RaaS, EDR evasion

Novo Nordisk Breach Highlights Secrets as an Identity Risk

• What happened: A leaked GitHub token was the entry point for a breach at Novo Nordisk, exposing risks in software development pipelines. Secrets — API keys, tokens, and credentials embedded in code — are identity artifacts and carry the same access risk as any other credential.
• Why it matters: Developer secrets remain a persistent blind spot. Many organizations treat secrets scanning as a tooling checkbox rather than an integrated identity governance control. A single leaked token can provide persistent access to source code, downstream systems, and cloud infrastructure.
• Who should care: Security leadership, IAM teams, DevOps, software engineering.
• Recommended action: Audit secrets across source code repositories, CI/CD pipelines, and developer environments. Automate secrets rotation and ensure leaked tokens are invalidated immediately upon detection. Integrate secrets governance into identity lifecycle management, not just developer tooling.
• Confidence: High — breach confirmed, root cause identified.
• Search metadata: T1539, GitHub, secrets management, software development pipeline

Monitor Only

• No additional lower-priority items from today’s feed crossed the action threshold. The five items above represent the full actionable surface for this brief period.

Analyst Observation

Today’s brief reflects a consistent pattern: organizations are being breached through the seams — third-party integrations, developer credentials, and perimeter device configurations — not through novel zero-days. The Klue/Salesforce incident and the Novo Nordisk breach both trace back to credential and token hygiene failures, not sophisticated tradecraft. The Splunk RCE and Fortinet credential leak represent the kind of compounding exposure that turns a bad week into a crisis: if your monitoring platform is compromised and your perimeter credentials are in the wild simultaneously, detection and response capability degrades exactly when it’s needed most. The Gentlemen EDR-killer story is a capability signal, not an active crisis — but it warrants a direct internal conversation about whether endpoint controls are being treated as a complete defense rather than one layer among several.

Source Links

• Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure — https://www.securityweek.com/splunk-enterprise-vulnerability-exploited-in-attacks-days-after-disclosure/
• CISA warns Fortinet users to secure devices after FortiBleed leak — https://www.bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/
• Cybersecurity Firms Impacted by Klue Supply Chain Attack — https://www.securityweek.com/cybersecurity-firms-impacted-by-klue-supply-chain-attack/
• Salesforce Disables Klue App Integration After OAuth Token Abuse Exposes Customer Data — https://thehackernews.com/2026/06/salesforce-disables-klue-app.html
• Gentlemen ransomware uses multiple EDR killers to disable defenses — https://www.bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/
• Novo Nordisk Breach Exposes Software Development Pipeline Risk — https://www.darkreading.com/cyber-risk/novo-nordisk-breach-exposes-dev-pipeline-risk

Generated by DevSecOpsDadAttack cyber threat intelligence.