The MSP Security Gap
The MFA prompt at 2am
The scenario:
Your client’s operations manager wakes to their phone buzzing. An MFA prompt. Deny. Ten minutes later, another. Deny. By the sixth prompt at 2am, half asleep, they tap approve to make the phone stop.
That is the whole attack.
How it unfolds:
The attacker already had the password, bought from an infostealer dump or phished weeks earlier. The only thing between them and the account was the approval prompt, so they sent it again and again until a tired human made it stop.
Inside, they register their own device for MFA. The prompts end, and from that night the attacker signs in silently as a trusted device. Mail rules go in, the finance folder gets read, and the account waits for a use.
The pattern is common enough that attackers gave it a name: prompt bombing. It has beaten household-name companies with mature security teams, because the control it attacks is not a system. It is a tired person at 2am who wants the phone to stop, and every estate employs one of those.
The warning signs:
MFA prompts the user did not trigger, at any hour, in any volume.
A burst of denied prompts followed by a single approval.
A new MFA method or device registered shortly after an odd-hours approval.
Sign-ins from new locations right after the approval.
Stop it:
Switch from tap-to-approve to number matching, where the user types a code shown on the sign-in screen. Fatigue attacks die instantly, because the attacker sees the code, not the victim.
Alert on new MFA method registration, and treat it as an incident out of hours.
Tell staff plainly: a prompt you did not cause means someone has your password. Report it, never approve it, and change the password that night.
-
P.S. The password was already gone before the first prompt buzzed. The prompt storm is the loudest part, and the device registration two minutes after approval is the part that matters. That registration event is exactly the kind of signal worth having eyes on at 2am.
Patch first this week:
This week’s KEV additions, ranked by what MSPs run across client fleets. Verified against NVD, CISA, and vendor advisories.
• Arista VeloCloud Orchestrator On-Prem CVE-2026-16812 (10.0).
OS command injection reaching privileged internal functions and the orchestrator host. Arista confirms active exploitation.
Who runs it: any client with SD-WAN managed from an on-premises VeloCloud Orchestrator. Hosted and Dedicated VCO were patched before disclosure. Affected: 5.2.0 to 5.2.3.13, 6.1.0 to 6.1.3.3, 6.4.0 to 6.4.2.3, and 7.0.0.
Fix: 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1. KEV July 27. Block and hunt for the three attacker IPs in Arista’s advisory: 8.19.75.217, 206.72.242.124, 206.72.242.162. Preserve VCO web access logs, backend application logs, system logs, database logs, and file-system timestamps before you remediate.
• WordPress core CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API route confusion).
Chained, they hand an unauthenticated attacker remote code execution on a default install. Researchers named the chain wp2shell. Proof-of-concept exploits are public and attackers are dropping webshells.
Who runs it: every client site you host, plus the marketing sites you inherited and stopped watching. Affected: 6.8.x below 6.8.6, 6.9.x below 6.9.5, 7.0.x below 7.0.2.
Fix: 6.8.6, 6.9.5, or 7.0.2. KEV July 21. Look for new PHP files under wp-content/uploads and admin users nobody created before you call a site clean.
• Fortinet FortiOS CVE-2025-68686 (5.9).
Bypasses the patch Fortinet shipped to kill symbolic link persistence. An attacker needs filesystem access first, so treat any hit as proof of an earlier compromise you missed.
Who runs it: any client behind a FortiGate. Affected: 6.4 all versions, 7.0 all versions, 7.2 all versions, 7.4.0 to 7.4.6, and 7.6.0 to 7.6.1.
Fix: 7.4.7 or 7.6.2. KEV July 27. Vendor advisory FG-IR-25-934.
• DD-WRT below build 45724 CVE-2021-27137 (8.1).
Stack overflow in the UPnP handler, reachable with an unauthenticated M-SEARCH request. The c0xmo botnet, a Gafgyt variant, is spreading through it now.
Who runs it: branch offices, workshops, and small sites where someone flashed a consumer router years ago and nobody has touched it since. Exploitation needs UPnP switched on, which is off by default.
Fix: build 45724 or later, or turn UPnP off. KEV July 21. Federal deadline July 24, already passed.