Secure Supplier Controls After Active SIEM and OAuth Exploits

What happened

CISA warned that a Splunk Enterprise vulnerability (CVE-2026-20253) is being actively exploited and urged agencies to patch vulnerable instances. Shadowserver tracks many internet‑exposed Splunk instances, but not all are confirmed vulnerable; verify exposure and remediate accordingly. Watch whether suppliers and MSPs produce verifiable patch and telemetry evidence for affected tenants

Why the category manager should care

Treat SIEMs as critical assets with uptime and security dependencies; require suppliers to provide patch and remediation artifacts because compromise undermines detection capability

Key facts

• CVE-2026-20253 affects recent Splunk Enterprise versions
• Proof‑of‑concept exploit publicly shared shortly after vendor patch
• Shadowserver shows many internet‑exposed Splunk instances

What happened

ESET reports the Gentlemen ransomware group uses multiple EDR‑killing tools (notably 'GentleKiller') that impersonate legitimate security products to disable endpoint defenses. The toolkit leverages vulnerable drivers to gain kernel privileges and targets processes from many security vendors, increasing the chance EDR alone will not detect or stop attacks. Watch for vendor advisories and whether managed detection providers adjust containment playbooks

Why the category manager should care

Do not assume EDR contractual SLAs alone guarantee containment; require supplier playbooks for when endpoint protection is bypassed

Key facts

• GentleKiller has multiple variants and impersonates legitimate products
• Toolset uses 'bring your own vulnerable driver' (BYOVD) technique for kernel elevation
• Targets processes across a broad set of security vendors

What happened

Klue confirmed unauthorized activity that led to theft of OAuth tokens connecting to customer Salesforce environments; attackers used a compromised legacy credential in integration infrastructure. Klue says customer content inside its platform was not affected but several connected Salesforce instances were accessed, making connector token handling a direct supplier risk. Watch supplier token storage practices and require revocation and audit support when connectors are implicated

Why the category manager should care

Treat connectors and third‑party integration services as systems of record for access control and require token handling obligations in contracts

Key facts

• Unauthorized activity identified on June 12 affecting integration infrastructure
• Attackers used a compromised legacy credential to obtain OAuth tokens
• Connected Salesforce instances were accessed; internal Klue content appears unaffected

What happened

Defiant warns of active exploitation of an information‑disclosure bug in the Gravity SMTP WordPress plugin that can return system reports containing API keys and OAuth tokens. The flaw is present in many sites and exploitation attempts have been blocked in the millions by security vendors' firewall services, indicating active probing. Watch hosting suppliers and plugin management processes for speed of patch deployment and notification

Why the category manager should care

Ensure web hosting and CMS suppliers have explicit obligations for plugin patching and speedy vulnerability remediation because plugins can leak integration secrets

Key facts

• Vulnerability allowed unauthenticated access to a plugin 'System Report' endpoint
• Exploit attempts spiked; host‑level web firewalls blocked millions of requests
• Issue fixed in a later plugin release—patching cadence determines exposure

What happened

A third‑party vendor for Texas Parks and Wildlife disclosed a data breach that exposed millions of customers' driver's license and passport numbers via the license system vendor. State cyber teams are investigating and report some personal data types were exposed though certain sensitive fields were not impacted; supplier identity is not yet public. Watch vendor incident response timelines and demand supplier forensic evidence and customer‑notification support

Why the category manager should care

Treat vendor‑operated citizen/customer systems as critical suppliers with heightened data handling and notification obligations

Key facts

• Breach at a license system vendor exposed customer identity fields tied to millions of records
• State cyber team initiated investigation; certain sensitive fields reportedly not impacted
• Vendor identity has not been publicly named at time of disclosure