Two 9.8 Cursor CVEs Enable Zero-Click RCE Before v3.0

The Situation

Two unrelated but equally critical remote code execution vulnerabilities need emergency action today. CVE-2026-45659 (SharePoint Server) was added to CISA's Known Exploited Vulnerabilities catalog with confirmed active exploitation — this carries a federal mandate for patching. Simultaneously, CVE-2026-50548 and CVE-2026-50549 (Cursor IDE, CVSS 9.8) give attackers zero-click code execution on every developer machine running versions before 3.0.

These aren't theoretical advisories — SharePoint is being exploited in the wild right now, and Cursor's zero-click pair means any attacker-controlled content an AI agent reads becomes an exploit trigger.

SharePoint: CVE-2026-45659

CISA KEV listing means confirmed exploitation and a federal remediation deadline. Internet-facing SharePoint instances are the immediate priority — inventory them, patch them, or isolate them. Hunt for compromise on anything that was exposed while unpatched. The exploitation path is RCE, meaning full host compromise of a system that typically holds sensitive collaboration data.

Cursor: CVE-2026-50548/50549

Discovered by Cato AI Labs, these flaws let attacker-controlled content escape Cursor's sandbox, write arbitrary files, and execute code with no user interaction. In an agentic IDE, the attack surface is everything the agent ingests: repository files, MCP tool responses, web search results. A poisoned repo or crafted MCP payload becomes a silent entry point to developer workstations holding cloud credentials, CI/CD tokens, and source code.

Cross-Source Pattern

These two items share a structural lesson: both target infrastructure where the reading of content constitutes the attack. SharePoint renders content that triggers exploitation; Cursor's agent reads content that triggers exploitation. The traditional model of exploitation-requires-interaction is dead for both classes.

Argo CD: The No-Patch Problem

Adding complexity: Argo CD's repo-server carries an unpatched pre-auth RCE reachable from the cluster's internal network. Synacktiv demonstrated the full chain: unauthenticated gRPC → Kustomize command execution → Redis credential theft → malicious manifest injection → full Kubernetes cluster takeover. No fix exists yet — compensating controls are your only defense.

Prioritization Matrix

The Shift

AI/ML infrastructure crossed from 'emerging risk' to confirmed target this week. Three distinct, active campaigns demonstrate that adversaries are attacking, weaponizing, and poisoning AI tooling at operational scale — not theoretically, not in lab conditions, but in production environments against real organizations.

Your LLM orchestration frameworks, inference endpoints, and security researchers' workflows are all now confirmed attack surfaces — treat them with the same rigor as your web applications.

Campaign 1: JADEPUFFER — First Autonomous AI-Agent Ransomware

Documented by Sysdig, JADEPUFFER is the first end-to-end ransomware attack driven by an AI agent. The agent exploited a Langflow RCE vulnerability and automated the full kill chain through database encryption. This isn't a concept — it's observed in the wild. The immediate lesson: LLM orchestration frameworks (Langflow, LangChain, and peers) are first-class attack surface and belong in your asset inventory alongside any exposed web application.

Campaign 2: Hijacked Inference Endpoints

Three observed operators are actively hijacking misconfigured Ollama and LiteLLM inference endpoints — often completely unauthenticated or protected only by placeholder API keys. Once compromised, attackers conscript these endpoints to power autonomous pentest frameworks and a Codex-based agent for weaponization and reverse-engineering. Your AI compute is being used against you and others. Pair this with open-weight GLM-5.2 (first open model to lead an APEX-SWE category at 55.3% Pass@1) that can be trivially fine-tuned to strip safeguards, and adversary tooling economics improved materially.

Campaign 3: ChocoPoC RAT Targeting Researchers

Threat actors are distributing a RAT disguised as Python proof-of-concept code on GitHub, specifically targeting vulnerability researchers and security teams. This inverts the usual model — your defenders are the targets. A researcher who clones and runs an unvetted PoC on a credentialed machine hands over internal tooling, credentials, and sensitive vulnerability data.

The Force Multiplier: Agentic Vuln Discovery

Cognition's Devin Security Swarm used 'Agentic MapReduce' to autonomously find and validate 1,000+ exploitable vulnerabilities in a single Fortune 500's production repos. This capability is now operational and available to adversaries at equivalent scale. If your public repositories or leaked source have similar vulnerability density, automated exploitation is a matter of when, not if.

What Sources Agree On

All five contributing sources converge on one conclusion: AI infrastructure has moved from theoretical risk to active attack surface. The controls gap is that most SOCs have zero monitoring on inference endpoints, orchestration frameworks, or agent-consumed content.