AI-accelerated exploitation of pre-existing exposures: collapsed time-to-exploit (Qualys analysis; CVE-2026-96951, CVE-2026-124194 exploited zero-days)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5916 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: mcp-remote OAuth Command Injection Spawning PowerShell Payload (CVE-2025-6514)

Detects the CVE-2025-6514 exploitation chain on Windows. A node process running mcp-remote (0.0.5-0.1.15) passes a crafted OAuth authorization_endpoint to the open package, which launches PowerShell; that PowerShell then spawns a non-browser payload such as calc.exe, cmd.exe, mshta.exe or rundll32.exe. The search correlates both stages per host and user inside a 2-minute window, so the routine PowerShell launch used to open a browser for a normal OAuth login does not fire on its own. Maps to T1190 and T1059.001.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.001
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ((ParentCommandLine="*mcp-remote*" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe"))
   OR ((ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe") ParentCommandLine="*-enc*"
       (Image="*\\calc.exe" OR Image="*\\cmd.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\regsvr32.exe" OR Image="*\\msiexec.exe" OR Image="*\\powershell.exe")))
| eval stage=if(like(ParentCommandLine, "%mcp-remote%"), "mcp_remote_spawned_powershell", "powershell_spawned_payload")
| bin _time span=2m
| stats dc(stage) as stage_count values(stage) as stages values(Image) as child_images values(CommandLine) as child_command_lines by host, User, _time
| where stage_count=2

Microsoft KQL

let SuspectChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "calc.exe", "mshta.exe", "rundll32.exe", "wscript.exe", "cscript.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe", "msiexec.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (InitiatingProcessCommandLine has "mcp-remote" and FileName in~ ("powershell.exe", "pwsh.exe"))
    or (InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe") and InitiatingProcessCommandLine has "-enc" and FileName in~ (SuspectChildren))
| extend Stage = iff(InitiatingProcessCommandLine has "mcp-remote", "mcp_remote_spawned_powershell", "powershell_spawned_payload")
| summarize StageCount = dcount(Stage), Stages = make_set(Stage), ChildProcesses = make_set(FileName), ChildCommandLines = make_set(ProcessCommandLine, 10) by DeviceName, AccountName, bin(Timestamp, 2m)
| where StageCount == 2

Sigma

title: Encoded PowerShell Spawning Payload Process After mcp-remote OAuth Launch (CVE-2025-6514)
id: b3d57e90-4a18-4c62-8f3d-2e6a1c9b5d07
status: experimental
description: Detects a PowerShell process started with an encoded command that spawns a non-browser payload such as calc.exe, mshta.exe or rundll32.exe. This is the second stage of the CVE-2025-6514 mcp-remote command injection chain on Windows, where a crafted OAuth authorization_endpoint is passed to the open package. Correlate with a node process running mcp-remote as the grandparent in the SPL or KQL variants.
references:
  - https://jfrog.com/blog/2025-6514-critical-mcp-remote-rce-vulnerability/
  - https://nvd.nist.gov/vuln/detail/CVE-2025-6514
  - https://blog.qualys.com/product-tech/2026/11/12/ai-didnt-create-a-new-kind-of-risk-it-removed-the-time-you-had-to-fix-the-old-one
author: Threadlinqs Team
date: 2026-11-13
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - cve.2025.6514
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    ParentCommandLine|contains: '-enc'
  selection_child:
    Image|endswith:
      - '\calc.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Administrative scripts that launch encoded PowerShell and then call certutil, msiexec or regsvr32
  - Software deployment tooling that wraps installers in encoded PowerShell
level: high

Known false positives:

• Developers who run mcp-remote and trigger a legitimate browser launch while an unrelated encoded PowerShell task spawns a child inside the same 2-minute window
• Management or deployment scripts that start encoded PowerShell and then call msiexec, certutil or regsvr32

Tuning notes: Baseline how mcp-remote launches the browser in your estate (the open package normally starts PowerShell with an encoded Start command that spawns the default browser). Add your known browsers to an exclusion list rather than widening the child list. Widen the bin span if events arrive with delay. Confirm every mcp-remote install is 0.1.16 or later with software inventory, since the fix removes the root cause.

• 🔒 Docker Model Runner Unauthenticated [indicator] POST (CVE-2026-28400) · unlock with TL Creds
• 🔒 Kubernetes TokenRequest or system:masters Credential Use by Non-System Identity · unlock with TL Creds
• 🔒 Pastebin Loader Fetched by Script Interpreter or Download Tool · unlock with TL Creds
• 🔒 Outlook Outbound SMB to External Host (CVE-2026-124194 Forced Authentication) · unlock with TL Creds
• 🔒 Credential File and Service Account Token Read by Shell Tool (Kubeconfig, git-credentials, environ) · unlock with TL Creds
• 🔒 Cloud Instance Metadata Endpoint Access by Unexpected Process ([indicator]) · unlock with TL Creds
• 🔒 NVIDIAScape Container Escape via nvidia-ctk createContainer Hook (CVE-2025-23266) · unlock with TL Creds
• 🔒 Tailscale Userspace Networking with SOCKS5 Proxy or Auth Key (Agent Lateral Movement) · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5916.

Sample indicators (1 of 15)

• Domain: model-runner[.]docker[.]internal

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

Technical analysis

The piece cites two exploited Microsoft zero-days and several AI-infrastructure CVEs with near-zero weaponization windows.

This record tracks a trend/analysis piece rather than a single campaign. Qualys (H. Kathpal, 2026-11-12) draws on Mandiant/GTIG's M-Trends 2026 and 'AI Risk and Resilience 2026' (September 2026) to argue that AI compresses the time defenders have to remediate old exposures. Cited figures: exploits caused 32% of intrusions; estimated mean time to exploit is minus seven days; the hand-off from initial access to a secondary threat group fell from over eight hours (2022) to 22 seconds (2025); 6 of 8 Mandiant case studies involved an exposure that could have been found beforehand; Entro Security reports 97% of non-human identities carry excessive privileges. These are vendor-cited statistics and have not been independently verified.

Vulnerabilities named: CVE-2026-96951 (Windows Shell security feature bypass via command injection, exploited zero-day in Microsoft's October 2026 Patch Tuesday, added to CISA KEV with a 2026-10-16 deadline); CVE-2026-124194 (Outlook spoofing zero-day in November 2026 Patch Tuesday, KEV deadline 2026-11-24; a crafted message file makes Outlook connect to an attacker-controlled network location without the usual external-content warning, potentially exposing authentication information); CVE-2025-23266 (NVIDIAScape, NVIDIA Container Toolkit container escape, CVSS 9.0; an image sets LD_PRELOAD so the privileged createContainer hook loads an attacker library; fixed in 1.17.8); CVE-2025-6514 (mcp-remote OS command injection via a crafted OAuth authorization_endpoint, CVSS 9.6, versions 0.0.5-0.1.15, fixed in 0.1.16; full command execution on Windows through PowerShell); and CVE-2026-28400 (Docker Model Runner unauthenticated POST /engines/_configure runtime flag injection, fixed in model-runner 1.0.16 / Docker Desktop 4.61.0; NVD-sourced CVSS 7.5, exploitability depends on runtime flags and invocation). Qualys states weaponization windows of minus one day for CVE-2025-23266 and CVE-2025-6514.

The article also describes incidents and tooling: agentic attack tools Hexstrike and Strix; a coding-session hijack spreading Shai-Hulud via an unverified AI-recommended package and long-lived GitHub OAuth tokens; poisoned PyPI packages and a compromised LiteLLM library; subverted CLI hooks, unsigned plugins and MCP servers leading to RCE; a denial-of-wallet reasoning loop (15,000+ API calls, ~USD 50,000 billing spike); and the July 2026 Hugging Face Kubernetes intrusion by an autonomous agent (about 17,600 actions over five days, cluster-admin in about 13 hours). Per Qualys' detection mapping, entry was via an HDF5 external-storage reference disclosing worker environment and an unsanitized Jinja2 template in an fsspec reference field giving Python execution; escalation used the projected service-account token, cloud metadata, TokenRequest API, a privileged pod with host mount, a connector credential bound to system:masters, a stolen Tailscale auth key run in userspace mode with a SOCKS5 proxy, replayed AWS credentials, a pastebin-based loader, rewritten DNS/hosts files and XOR-chunked staged data.

Defender takeaways from the source: measure disclosure-to-fix time in hours; inventory AI assets (agents, models, MCP servers, libraries); replace static agent credentials with short-lived scoped identities; break the 'lethal trifecta' (private data access, untrusted input, outbound channel); validate exploitability before prioritizing; treat coding assistants and MCP servers as privileged sessions. The source gives no IOCs, CVSS scores for the Microsoft CVEs, or affected-version lists for them.

MITRE ATT&CK techniques by tactic:

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python; T1610 Deploy Container

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application; T1195.001 Compromise Software Dependencies and Development Tools

Credential Access

T1187 Forced Authentication; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.005 Unsecured Credentials: Cloud Instance Metadata API; T1552.007 Unsecured Credentials: Container API

Lateral Movement

T1550.001 Use Alternate Authentication Material: Application Access Token

Command and Control

T1572 Protocol Tunneling

Privilege Escalation

T1611 Escape to Host

Discovery

T1613 Container and Resource Discovery

Remediation

Patches

• NVIDIA Container Toolkit 1.17.8
• mcp-remote 0.1.16
• Docker model-runner 1.0.16 (Docker Desktop 4.61.0)
• Microsoft October 2026 and November 2026 Patch Tuesday updates

Immediate actions

• Apply Microsoft October and November 2026 updates for CVE-2026-96951 and CVE-2026-124194 (CISA KEV deadlines 2026-10-16 and 2026-11-24)
• Upgrade NVIDIA Container Toolkit to 1.17.8 or later and GPU Operator per NVIDIA bulletin
• Upgrade mcp-remote to 0.1.16 or later and connect only to trusted MCP servers over HTTPS
• Upgrade Docker Model Runner to 1.0.16 / Docker Desktop to 4.61.0 or later
• Rotate long-lived CI/CD credentials, GitHub OAuth tokens and shared connector credentials

Workarounds

• NVIDIA legacy mode: set disable-cuda-compat-lib-hook = true under [features] in /etc/nvidia-container-toolkit/config.toml
• GPU Operator: add disable-cuda-compat-lib-hook to NVIDIA_CONTAINER_TOOLKIT_OPT_IN_FEATURES via Helm
• Do not expose the Docker Model Runner API beyond trusted local callers

Longer-term hardening

• Measure and target exposure window from disclosure to fix in hours
• Include AI assets (agents, models, MCP servers, libraries, shadow AI) in asset inventory and SBOM
• Replace static agent credentials with short-lived, scoped, dedicated identities with least privilege
• Break the lethal trifecta: private data access, untrusted input, outbound channel
• Require signed hooks/plugins/MCP servers and verify AI-recommended packages before install
• Deploy kernel-level runtime detection for exploitation without a CVE and red-team agents and MCP servers before release

Affected and fixed versions

• NVIDIA — Container Toolkit
  Vulnerable versions: <= 1.17.7 (CDI mode only for < 1.17.5)
  Fixed in: 1.17.8
• NVIDIA — GPU Operator
  Vulnerable versions: <= 25.3.1 as stated by Wiz
  Fixed in: Deploy toolkit v1.17.8 per NVIDIA bulletin
• mcp-remote (open source) — mcp-remote
  Vulnerable versions: 0.0.5 - 0.1.15
  Fixed in: 0.1.16
• Docker — Model Runner
  Vulnerable versions: < 1.0.16
  Fixed in: 1.0.16; Docker Desktop 4.61.0
• Microsoft — Windows Shell
  Vulnerable versions: Not stated in source; see MSRC entry for CVE-2026-96951
  Fixed in: October 2026 security update
• Microsoft — Outlook
  Vulnerable versions: Not stated in source; see MSRC entry for CVE-2026-124194
  Fixed in: November 2026 security update

Timeline

• 2025-05-17 Wiz Research reports the NVIDIA Container Toolkit container escape (later CVE-2025-23266) to NVIDIA at Pwn2Own Berlin
• 2025-07-09 JFrog publishes CVE-2025-6514, an OS command injection in mcp-remote 0.0.5-0.1.15 fixed in 0.1.16
• 2025-07-15 NVIDIA publishes its security bulletin and CVE-2025-23266; toolkit 1.17.8 is the fix
• 2026-02-27 CVE-2026-28400 (Docker Model Runner unauthenticated /engines/_configure runtime flag injection) disclosed; fixed in 1.0.16
• 2026-07-09 Start of the Hugging Face Kubernetes intrusion by an autonomous AI agent (about 17,600 actions over five days, cluster-admin in about 13 hours)
• 2026-08-26 Qualys publishes detection mapping for the Hugging Face agent intrusion
• 2026-10-13 Microsoft October 2026 Patch Tuesday fixes exploited Windows Shell zero-day CVE-2026-96951; CISA KEV deadline 2026-10-16
• 2026-11-10 Microsoft November 2026 Patch Tuesday fixes exploited Outlook spoofing zero-day CVE-2026-124194; CISA KEV deadline 2026-11-24
• 2026-11-12 Qualys publishes analysis arguing AI collapsed the time to exploit pre-existing exposures

Sources cited

• NVD: CVE-2025-6514 NVD (NIST) · Advisory
• NVD: CVE-2026-28400 (Docker Model Runner) NVD (NIST) · Advisory · 2026-02-27
• NVIDIAScape: CVE-2025-23266 in NVIDIA Container Toolkit (Wiz Research) Wiz · Research · 2025-07-17
• Critical RCE Vulnerability in mcp-remote: CVE-2025-6514 (JFrog) jfrog.com · Research · 2025-07-09
• Google/Mandiant M-Trends 2026 Google Cloud · Research
• Google/Mandiant AI Risk and Resilience 2026 Google Cloud · Research
• AI Didn't Create a New Kind of Risk. It Removed the Time You Had to Fix the Old One. (Qualys) blog.qualys.com · Blog · 2026-11-12
• Hugging Face AI agent intrusion: Qualys detection mapping blog.qualys.com · Blog · 2026-08-26
• Microsoft Patch Tuesday, October 2026 Security Update Review (Qualys) blog.qualys.com · Blog · 2026-10-13
• Microsoft Patch Tuesday, November 2026 Security Update Review (Qualys) blog.qualys.com · Blog · 2026-11-10

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Other reports on CVE-2026-96951

• October 2026 Microsoft Patch Tuesday: Exploited Windows Shell MotW Bypass (CVE-2026-96951), 1,417 Vulnerabilities Patched

Other reports on CVE-2026-124194

• Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194)
• Microsoft November 2026 Patch Release: 1,093 Vulnerabilities Fixed, Outlook Spoofing Zero-Day CVE-2026-124194 Actively Exploited
• Microsoft November 2026 Patch Tuesday (1,093 bugs) - Exploited Outlook CVE-2026-124194, Barracuda CVE-2026-116606/CVE-2026-111560 (CISA-directed), N-able N-central PoC scanning
• Microsoft November 2026 Patch Tuesday: Outlook Zero-Day CVE-2026-124194 Exploited to Steal NTLM Hashes (1,235 Flaws Fixed)

Previous and next in vulnerability

• CVE-2025-13902: Authenticated Cross-Site Scripting (CWE-79) in Schneider Electric Modicon M241/M251/M258/LMC058 Controller Web Server (Claroty also lists M262) Previous report
• CVE-2026-21660 - Hardcoded credentials in Johnson Controls Frick Controls Quantum HD industrial refrigeration controller Next report