Verified status as of July 30, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-20316 in Cisco Secure Firewall Management Center is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-07-29; federal remediation due 2026-08-01). NVD rates it 5.3 (MEDIUM) on CVSS v3.1. NVD lists a vendor advisory.
TL;DR
North Korean hackers linked to multiple npm supply-chain attacks; Azure Cosmos DB vulnerability patched after exposing cross-tenant database access; Microsoft Copilot Word feature leaks hidden prompts. Immediate action required on npm dependencies and Azure deployments.
Executive Summary
- North Korean threat actors confirmed behind Debug and Chalk npm supply-chain attacks, with Amazon and open-source researchers linking coordinated compromises to Pyongyang-backed operations.
- Azure Cosmos DB vulnerability (codenamed CosmosEscape) patched after potentially exposing platform-wide credentials allowing cross-tenant database access.
- Microsoft Copilot for Word feature allows hidden document instructions to be copied into output files, disclosed 144 days after researcher reported to vendor.
- Cisco Secure Firewall Management Center hard-coded password vulnerability added to CISA KEV catalog with federal remediation deadline.
- JetBrains TeamCity critical authentication bypass enables remote code execution on affected On-Premises instances.
Top Threats Today
1. North Korea Attributed to npm Supply-Chain Attacks
Severity: HIGH Affected: Technology
Amazon has linked multiple high-profile open-source supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers [1][2]. The compromised packages, identified as Debug and Chalk, were part of coordinated attacks against widely-used development libraries ⚠[1][2]. This attribution represents a significant escalation in the integration between state-sponsored actors and supply-chain compromise tactics affecting developers worldwide. ⚠
Sources:[1] BleepingComputer[2] The Record
Recommended Action
- Audit npm dependencies in your supply chain immediately, prioritizing Debug and Chalk package versions
- Review build logs and deployment artifacts for unexpected code execution from npm packages dated around campaign window
- Enforce package signature verification and implement Software Bill of Materials (SBOM) tracking for all open-source dependencies
- Consider adopting private npm registry mirrors with strict vetting policies for critical projects
2. Azure Cosmos DB Cross-Tenant Database Exposure (Patched)
Severity: HIGH Affected: Technology
A now-patched vulnerability in Azure Cosmos DB could have allowed an attacker to escape the service’s Gremlin query sandbox and obtain full read and write access to databases across customer tenants [1]. Security researchers codenamed the exploit chain CosmosEscape [1]. The flaw posed significant risk to multi-tenant deployments, potentially exposing sensitive data across organizational boundaries. ⚠
Sources:[1] The Hacker News
Recommended Action
- Verify all Azure Cosmos DB instances are running patched versions; check deployment status in Azure portal
- Review Cosmos DB access logs for anomalous query patterns or unexpected cross-tenant data access during vulnerability window
- Implement strict network segmentation and least-privilege access controls for Cosmos DB connections
- Enable advanced threat detection and alerting on Cosmos DB operations
3. Microsoft Copilot Word Prompt Injection via Hidden Instructions
Severity: HIGH Affected: Technology
Hidden instructions embedded in a Word document can make Microsoft 365 Copilot rewrite figures in a report and copy the same hidden instructions into the finished output file, according to a disclosure by researcher Håkon Måløy on July 28 [1]. The disclosure came 144 days after the researcher reported the technique to Microsoft [1]. This vulnerability allows attackers to inject malicious instructions that persist across document generations. ⚠
Sources:[1] The Hacker News
Recommended Action
- Disable Microsoft Copilot for Word until Microsoft releases an official patch addressing prompt injection
- Audit shared Word documents for suspicious hidden text, formatting, or field codes that could contain malicious instructions
- Implement document content scanning policies to flag suspicious hidden content before distribution
- Monitor Microsoft security advisories for official remediation guidance
4. JetBrains TeamCity Authentication Bypass RCE
Severity: HIGH Affected: Technology
JetBrains has warned of a critical authentication bypass vulnerability affecting TeamCity On-Premises that could be exploited to achieve remote code execution [1]. The flaw allows unauthenticated attackers to bypass access controls and execute arbitrary code on affected servers.
Sources:[1] BleepingComputer
Recommended Action
- Immediately check JetBrains security advisories for TeamCity patch availability and version compatibility
- Apply available patches to all TeamCity On-Premises instances without delay
- Restrict network access to TeamCity administration ports using firewall rules during patching window
- Review TeamCity access logs for unauthorized login attempts or unexpected administrative actions
5. Cisco Secure Firewall Management Center Hard-Coded Password (KEV Listed)
Severity: HIGH Affected: Technology
Cisco Secure Firewall Management Center (FMC), formerly known as Firepower Management Center, contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in using a low-privileged account and access sensitive data [1]. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on July 29, 2026, with federal remediation due by August 1, 2026 [1].
Sources:[1] CISA KEV
Recommended Action
- Identify all Cisco Secure Firewall Management Center instances in your environment and prioritize patching by August 1
- Implement network-level access controls to restrict FMC management interfaces to trusted administrative networks only
- Review FMC authentication logs for any unauthorized access attempts using default or hard-coded credentials
- Obtain and apply Cisco security patch for this vulnerability immediately
Today’s Action Checklist
- ☐ URGENT: Audit npm package dependencies for Debug and Chalk; cross-reference against deployment timelines
- ☐ URGENT: Verify Azure Cosmos DB instances are patched; review access logs for CosmosEscape exploitation indicators
- ☐ HIGH: Disable Microsoft Copilot for Word pending official patch; scan shared documents for hidden content
- ☐ HIGH: Apply JetBrains TeamCity patches to all On-Premises instances; restrict network access until patched
- ☐ HIGH: Patch Cisco Secure Firewall Management Center by August 1 deadline; implement network segmentation for FMC access