CISO Signals Radar

Summary

ShinyHunters published at least 13M Charter customer records after Charter refused a ransom with a May 27 deadline. Initial access was a voice-phishing attack on an employee Microsoft Entra account, used to export consumer and business customer records from Charter's Salesforce instance. The same actor has hit Panera (5M+), Canvas, Aura (~1M), ADT (5.5M), Zara (197k) and 7-Eleven (600k) in 2026.

Impact on Retail/CPG

CPG and retail enterprises run their consumer data, trade promo and B2B account records inside Salesforce. The repeated vishing → Entra → Salesforce export pattern is now the dominant exfiltration path for the sector and must be treated as a board-level material risk.

Recommended Actions

• Enforce phishing-resistant MFA (FIDO2/Passkeys) on every Salesforce admin and integration user — IAM team, 14 days
• Conditional Access policy blocking high-risk sign-ins for Salesforce SAML/OIDC apps — IAM, 7 days
• Run vishing simulation against helpdesk and Salesforce admin populations — SOC, 30 days
• Audit Salesforce bulk-export and Data Loader activity for the last 90 days — DLP/SOC, immediate

Risks

• ShinyHunters retains data leverage even after public leak — secondary extortion risk
• Salesforce as a single data concentration point amplifies impact across loyalty, trade and B2B data sets

Sources

Summary

CVE-2026-42945, dubbed 'NGINX Rift,' is a heap buffer overflow in ngx_http_rewrite_module present in every NGINX build since 2008. A single crafted HTTP request from an unauthenticated attacker overwrites the heap and yields remote code execution in the worker process.

Impact on Retail/CPG

NGINX runs CPG and retail web storefronts, customer APIs and ingress traffic for many e-commerce and B2B portals. Unauthenticated worker-process RCE on the edge is a direct path to consumer PII, payment tokenization brokers, and inventory APIs.

Recommended Actions

• Inventory every NGINX edge node and apply vendor patch immediately — platform engineering, 48 hours
• Add specific WAF detection for the published exploit signature — SOC/AppSec, immediate
• Restrict rewrite-module use behind authenticated paths where feasible — application platform team
• Review ingress NGINX in Kubernetes clusters serving retail digital surfaces — DevSecOps

Risks

• 17-year exposure means many forks and embedded distributions exist — patch coverage will lag
• Edge compromise enables pivot into payment and identity flows

Sources

Summary

CVE-2026-31431 is an actively-exploited Linux kernel 'Incorrect Resource Transfer Between Spheres' flaw enabling an unprivileged local user to obtain root. CISA added it to the KEV catalog on May 1 with a mandatory remediation deadline of May 15, 2026.

Impact on Retail/CPG

Linux hosts power CPG e-commerce, demand-planning, manufacturing edge and POS back-end stacks. Local root LPE is the standard escalation step for any web-shell or supply-chain implant, including in retail Kubernetes nodes.

Recommended Actions

• Schedule emergency patch window across Linux production fleet — Infra/SRE, 7 days
• Force rotation of long-lived service-account credentials on patched hosts — IAM
• Enable eBPF-based runtime detection for kernel exploit indicators — SOC/EDR team

Risks

• Kernel patches on production POS and SCM nodes carry availability risk — needs staged rollout
• Container runtimes sharing kernel inherit the exposure — multi-tenant nodes are higher priority

Sources

Summary

CISA added Microsoft Defender vulnerabilities CVE-2026-41091 (EoP) and CVE-2026-45498 ('UnDefend' DoS) to the KEV on May 20. UnDefend can be triggered remotely with no credentials, crashing or destabilizing Defender and creating a blind-spot window during which attackers can deploy ransomware, exfiltrate data, or move laterally without detection.

Impact on Retail/CPG

Retail and CPG endpoint estates (store associates, DC workforce, head office) are heavily Microsoft Defender-dependent. A reliable AV/EDR DoS is the missing primitive for a ransomware actor with initial access to run an undetected payload.

Recommended Actions

• Push May 2026 Defender platform/security intelligence updates across endpoints — endpoint management, 7 days
• Enable tamper protection and verify cloud-delivered protection signals — endpoint security
• Add Defender process-health telemetry to SOC alerting — SOC engineering
• Tabletop: 'Defender silently disabled at 8 sites for 4 hours' — IR team, 30 days

Risks

• Existing IR playbooks may not include EDR-down detection paths
• Endpoint visibility loss disproportionately affects retail store environments with no on-site IT

Sources

Summary

CVE-2026-45659 is a high-severity SharePoint Server deserialization-of-untrusted-data flaw patched by Microsoft on May 26, 2026. Authenticated exploitation enables remote code execution against vulnerable SharePoint instances.

Impact on Retail/CPG

SharePoint hosts trade-spend agreements, supplier contracts and product formulation documents at most CPG enterprises. Authenticated RCE is reachable through any compromised vendor or low-trust internal account — a common scenario in CPG supplier portals.

Recommended Actions

• Apply May 2026 SharePoint CU across on-prem and hybrid farms — IT operations, 14 days
• Reduce supplier-facing SharePoint privileges and disable upload to deserialization-prone libraries — collaboration team
• Audit IIS and ULS logs for anomalous /_layouts payloads in last 30 days — SOC

Risks

• On-prem SharePoint patch velocity lags SharePoint Online materially
• Supplier-facing portals create persistent external authentication paths

Sources