CISA's exploit list now includes your model registry, and Microsoft took eight months to patch your employee's Copilot

CISA added CVE-2026-64849(opens in a new tab) to its Known Exploited Vulnerabilities catalog on Wednesday. It is a 9.3 unauthenticated server-side request forgery in MLflow, the experiment tracking and model registry layer that sits between a data science team and the cloud account it runs in. An attacker who can reach the server makes it fetch the instance metadata endpoint and reads back temporary IAM role credentials. No login required. watchTowr saw widespread scanning within hours of the CVE being assigned on August 17, and federal civilian agencies have until September 2 to patch. MLflow takes more than 30 million downloads a month, so the installed base is large, and most of it was put in place by people who do not keep a patch calendar.

The day before, Microsoft shipped a fix for CVE-2026-24301(opens in a new tab), a chain Varonis named CoSnitch. An undocumented autorun parameter in Copilot Personal let a single malicious link execute an attacker's prompt and pull message bodies, calendar entries, Drive filenames, saved memory rules, and prior chat content out of whatever accounts the user had connected. Varonis reported it in December 2025. The patch landed on August 18, 2026.

That gap is the number worth writing down. Roughly eight months from a credible report of one-click data exfiltration to a shipped fix, on a product employees connect to corporate identity without a purchase order.

The two flaws have nothing technically in common and one thing operationally in common. Neither asset appears in a configuration database. MLflow runs on a VM a data science team stood up in a sandbox account. Copilot Personal is an employee's own consumer account holding a live OAuth grant into a corporate mail and file tenant. Both arrived outside procurement, so neither carries a patch SLA, a named owner, or a renewal review. IBM's 2025 breach study found one in five organizations reporting a breach tied to shadow AI(opens in a new tab), at roughly $670,000 in added cost, and 97 percent of those organizations had no AI access controls at all.

The governance program most enterprises have built over the past two years points somewhere else. Model risk committees, EU AI Act conformity files, and vendor security questionnaires all describe the sanctioned estate. This week's exploitation happened in the other one.

There is a second and cheaper conclusion here, about contracts. Uptime, data residency, and indemnity are standard terms in an AI vendor agreement. Disclosure to patch latency is not, and CoSnitch put a number on what its absence is worth.

One more item sets the clock. Google's threat intelligence group published the architecture(opens in a new tab) of the multi-agent system Mandiant used to find more than 100 verified high-severity flaws in two days of source code review. Defenders get a blueprint. So does everyone reading it for the other reason. The interval between a component being exposed and being found is compressing, which is what makes an unpatched server nobody owns a different class of problem than it was a year ago.