68 MCP Server CVEs in One Month Expose a Systemic Agent Supply Chain Gap

What happened

Why it matters

• ·Most enterprise vendor due diligence programs assess the AI model or agent platform, but not the MCP server layer those platforms depend on. With 68 vulnerabilities catalogued in a single month, including SSRF flaws that can harvest cloud metadata credentials, the MCP server tier now represents a material, ungoverned segment of the agent supply chain that procurement risk assessments must explicitly cover.
• ·SSRF and SQL injection flaws in MCP servers can compromise the integrity of agent audit trails and expose regulated data, creating direct exposure under data protection regimes and sector-specific rules. Organizations in financial services, healthcare, and critical infrastructure face the highest consequence if an MCP server vulnerability enables credential exfiltration or unauthorized data access during an agent workflow.
• ·The pattern documented across prior MCP audits and this month's findings signals that MCP server insecurity is structural, not episodic. Compliance teams that have not added MCP server dependency mapping and vulnerability tracking to their agent governance programs are operating with a control gap that regulators and insurers are increasingly likely to treat as a failure of reasonable care.

Governance controls affected

What to do now

• ☐Inventory every MCP server your agentic platforms connect to, including third-party and open-source implementations, and confirm whether each has been assessed for SQL injection, SSRF, path traversal, and prompt template injection vulnerabilities.
• ☐Map the Deadbugz campaign indicators and the three named CVEs from the Adversa AI September 2026 report against your current MCP server deployments and initiate patching or isolation for any confirmed matches.
• ☐Extend your AI vendor due diligence questionnaire to explicitly cover MCP server security controls, including authentication mechanisms, input validation practices, and patch cadence, for all agent toolchain dependencies.
• ☐Apply network-layer isolation controls to MCP servers so that cloud metadata service endpoints are unreachable from agent-accessible server processes, directly mitigating the SSRF class of vulnerabilities documented in this report.
• ☐Establish a recurring MCP server vulnerability monitoring workflow, tied to your existing CVE tracking process, so that newly disclosed flaws in this layer trigger re-assessment of deployed agent toolchains within a defined SLA.

What to watch next

Adversa AI has signaled ongoing audit activity across MCP server implementations, and the Deadbugz campaign suggests active exploitation interest in this vulnerability class. Compliance teams should monitor whether any of the three named CVEs attract CISA Known Exploited Vulnerability designations, which would trigger mandatory remediation timelines for organizations subject to federal contract requirements. The OWASP GenAI MCP server security baseline and the MCP Project sandboxing guidance are both live reference points that regulators and auditors are beginning to cite as minimum standards, and teams that have not yet mapped controls against those baselines should prioritize that gap before the next audit cycle.