Critical CVEs are outrunning quarterly patch cycles

At a glance

What this is: This weekly threat report shows exploitation velocity rising across zero-days, chained authorization flaws, supply chain worms, and nation-state campaigns.

Why it matters: For IAM, PAM, and NHI teams, the report underscores that exposed credentials, weak authorization boundaries, and delayed remediation can turn routine vulnerabilities into rapid identity-led compromise.

By the numbers:

• Five CVSS 10.0 or 9.8 vulnerabilities entered active exploitation within 72 hours of disclosure.

👉 Read FireCompass's weekly report on active exploitation and critical CVEs

Context

The core problem is not simply more vulnerabilities. It is the shrinking time between disclosure and weaponisation, which leaves traditional patch cycles unable to close exposure before attackers begin exploiting it. In a report like this, the relevant question for security teams is how quickly a control failure becomes a credential, privilege, or service outage problem.

This matters to identity programmes because several of the techniques described depend on access tokens, cloud credentials, weak authorization checks, and over-privileged management paths. When attackers can pivot from initial code execution to token harvesting or root-level appliance access, IAM, PAM, and NHI governance are part of the exploitation chain, not just the cleanup phase.

Key questions

Q: What breaks when organisations cannot patch exploited systems fast enough?

A: When patching lags behind active exploitation, the problem shifts from vulnerability management to containment failure. Attackers have time to harvest credentials, move laterally, or exfiltrate data before defenders close the door. Organisations then rely on segmentation, privilege restriction, and credential rotation to limit damage. If those controls are weak, a single flaw becomes an enterprise-wide incident.

Q: Why do partial patches still leave organisations exposed to compromise?

A: A partial patch often removes the original exploit path but leaves adjacent authorization or privilege boundaries intact. Attackers then pivot through management interfaces, privileged functions, or token theft to reach the same end state. The control failed because the system was judged safe by version status instead of by reachable authority.

Q: How should security teams handle stolen tokens after an incident?

A: Treat stolen tokens as active credentials, not artefacts. Revoke and reissue them, check for process-memory exposure, look for workflow reuse, and assume any long-lived token may already have been copied into automation or exfiltration infrastructure. If the token can still be replayed, the incident is not contained.

Q: How do patch, IAM, and NHI teams coordinate when exploitation is already underway?

A: They should operate as one response chain. Vulnerability teams validate exposure, IAM and PAM teams revoke standing paths and privileged access, and NHI teams rotate secrets, tokens, and automation credentials that may have been harvested. Coordination matters because attackers often move from the initial flaw to identity abuse in the same incident.

Technical breakdown

Exploitation velocity compresses remediation windows

The report shows a pattern where disclosure, proof-of-concept release, and active exploitation happen inside days rather than weeks. That compresses the useful life of vulnerability management processes, especially where patching requires change windows, regression testing, or cross-team approvals. When critical flaws are weaponised within 72 hours, the control question shifts from perfect remediation to whether exposure can be continuously measured, prioritized, and contained before attackers arrive.

Practical implication: move critical exposure validation into a continuous process instead of waiting for the next patch cycle.

Authorization bypass turns partial fixes into full compromise

One SonicWall chain illustrates a common post-patch failure mode: the initial code-execution issue was addressed, but residual authorization weaknesses still allowed privilege escalation. This is a governance gap, not a coding footnote. A system can appear patched while still exposing privileged management functions to compromised user contexts, which is why privilege boundaries and control-plane authorization need separate verification.

Practical implication: test patched systems for privilege escalation paths, not just for the original vulnerability.

Token harvesting and supply chain propagation extend breach life

The report also describes threat paths that do not depend on reusing the original exploit. OAuth token harvesting from process memory, pre-install package manager worms, and GitHub workflow abuse all turn a single compromise into persistent access and broader propagation. These are NHI-adjacent patterns because secrets, tokens, and automation credentials become the durable asset that attackers steal, reuse, and weaponise.

Practical implication: treat tokens, API keys, and automation credentials as attack surface and monitor them as such.

Threat narrative

Attacker objective: Attackers aim to turn a short-lived foothold into durable privileged access, data theft, and repeatable operational disruption at scale.

1. Entry begins with exposed internet-facing services, vulnerable application stacks, or phishing-delivered malware that provides the first foothold.
2. Escalation follows when attackers exploit residual authorization gaps, harvest tokens from process memory, or inject package and workflow payloads to gain durable access.
3. Impact is achieved through root appliance control, credential theft, lateral movement, ransomware deployment, or mass repository compromise.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploitation speed is now a governance problem, not just a vulnerability problem. When disclosure-to-exploit windows collapse to hours or days, the old assumption that teams can patch first and investigate later no longer holds. Continuous validation, prioritisation, and containment become the real control plane. For practitioners, that means patch SLAs must be paired with live exposure measurement.

Residual authorization is the hidden failure mode in many partial fixes. The SonicWall chain is a good example of why removing the original entry point does not end the risk if privileged functions remain reachable. This is especially relevant to IAM and PAM teams, because privileged management paths must be tested independently from application code fixes. The practical lesson is to verify control boundaries, not just version numbers.

Secrets and tokens are the durable assets attackers prefer once they are inside. The report’s OAuth harvesting and supply chain worm activity reinforce a specific concept: credential persistence debt: credentials, tokens, and automation secrets often outlive the incident that exposed them. That creates a long-tail compromise risk across NHI, workload identity, and automation pipelines. Practitioners should reduce the lifetime and reusability of these assets as aggressively as they reduce patch backlog.

Mass exploitation is increasingly tied to automation rather than bespoke skill. Pre-install worms, memory dumping, and workflow injection show that attackers optimise for repeatability. That shifts defensive value toward telemetry, anomaly detection, and runtime control across cloud, developer, and identity systems. For security leaders, the question is no longer whether a tool is patched, but whether the operating model can absorb machine-speed abuse without cascading trust failure.

The cross-domain lesson is that identity governance sits inside exposure management. Vulnerabilities, secrets, and authorisation controls are converging into a single operational risk surface. For programmes that still separate IAM, NHI, cloud, and vulnerability management, this report is a warning that attackers do not respect those boundaries. Practitioners should align controls across those teams before the next exploitation wave.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For a deeper control model, see OWASP NHI Top 10 for agentic risk categories and governance gaps.

What this signals

The signal for practitioners is clear: exposure management is becoming inseparable from identity governance, especially where tokens, automation, and privileged management planes intersect. A control stack that cannot observe live access paths will lag behind active exploitation, even if patch compliance looks healthy on paper.

Credential persistence debt: the longer secrets, tokens, and privileged sessions remain valid after exposure, the more likely they are to become the real breach vector. Organisations should use this as a design lens for CI/CD, cloud access, and incident response, and anchor their control review to the NIST Cybersecurity Framework 2.0 and the MITRE ATT&CK Enterprise Matrix.

For identity-heavy environments, the next step is to converge vulnerability triage with NHI lifecycle controls so that secret rotation, token revocation, and privilege reduction happen as one workflow. The teams that can close that loop fastest will absorb the least damage when the next zero-day hits.

For practitioners

• Shorten the exposure-to-remediation loop Create a continuous validation process for critical internet-facing assets so disclosure, exploit detection, and remediation are measured in hours, not weekly patch windows. Prioritise systems with known active exploitation and verify compensating controls before maintenance windows close.
• Test post-patch privilege boundaries After any hotfix or emergency patch, run targeted checks for authorization bypass, privileged endpoint access, and role-based control failures. A fixed entry point is not enough if the management plane still accepts low-privilege interaction.
• Treat tokens and secrets as live attack surface Audit OAuth tokens, API keys, GitHub tokens, and automation credentials for memory exposure, workflow reuse, and long-lived validity. Reissue compromised assets quickly and reduce the standing value of any secret that can be replayed across systems.
• Monitor package and workflow execution paths Add detection for pre-install package execution, suspicious workflow injection, and self-hosted runner registration because these are common propagation paths after initial compromise. Build-system telemetry is now part of identity governance when credentials are present in CI/CD.

Key takeaways

• Critical vulnerabilities are now being weaponised within days, which means patch cadence alone can no longer protect exposed systems.
• The biggest exploitation failures in this report involve not only initial access but also residual authorization gaps, token theft, and secret reuse.
• Security teams need continuous exposure validation, rapid secret revocation, and post-patch privilege testing to stay ahead of attackers.

Key terms

• Exploitation Velocity: The speed at which attackers move from disclosure or discovery to active exploitation. It matters because it determines whether normal patch cycles, maintenance windows, and approval chains are fast enough to matter. When exploitation velocity is high, organisations need continuous validation and rapid containment rather than periodic remediation alone.
• Authorization Bypass: Authorization bypass occurs when a system technically allows an action through valid credentials, but the action exceeds the human user’s intended or approved authority. In agentic environments, the bypass is often contextual, not cryptographic, which makes it harder for standard IAM controls to detect.
• Credential Persistence Debt: Credential persistence debt is the accumulated operational and security cost of keeping long-lived secrets in circulation. It grows when teams rely on static keys for cross-cloud access, because every secret must be tracked, rotated, revoked, and eventually rediscovered during incident response.
• Post-Patch Exposure: The condition where a system has been updated but still retains a practical route to compromise through another flaw, misconfiguration, or privilege gap. This is especially dangerous in internet-facing infrastructure because teams may assume the asset is safe once the headline CVE is fixed. Real security depends on verifying the whole control path.

What's in the full report

FireCompass's full report covers the operational detail this post intentionally leaves for the source:

• Step-by-step exploitation chains for React2Shell, SonicWall SMA 1000, GitLab, and other critical CVEs.
• Detailed scan and prioritisation logic for active exploitation, including CISA KEV and threat-intelligence correlation.
• Red team validation methods for privilege escalation, token harvesting, and workflow abuse.
• A remediation roadmap with environment-specific findings that implementation teams can use directly.

👉 The full FireCompass report includes exploitation timelines, affected versions, and remediation prioritisation details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity for teams that need practical control over machine access. It gives identity and security practitioners a shared baseline for reducing standing exposure across modern environments.