ServiceNow's 27 August 2026 CVE record (CNA title: Unauthenticated Remote Code Execution in GraphQL Composite Data API) says it remediated a code-injection flaw in the ServiceNow AI Platform that could, in certain circumstances, let an unauthenticated user run arbitrary code and gain access to or change instance data beyond what was intended. ServiceNow scored it 10.0 (CVSS 4.0). Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of malicious exploitation. Self-hosted operators should apply the August 2026 CVE advisory updates (KB3152242). Affected CNA rows include Xanadu, Yokohama, Zurich and Australia patch families listed on the CVE record. Distinct from CVE-2026-74820 (SQL injection) and CVE-2026-18886 (privilege escalation) on this desk.
PaperCut Software's 27 August 2026 (AEST) security bulletin, last updated 10 September 2026, published Security Maintenance Releases on 10 Sep 2:00pm AEST: NG/MF 26.0.5, 25.0.13 and 24.1.10 are Regular Maintenance Releases that completed full QA, include all fixes from Emergency Patch Releases 1–3 plus extra hardening, and replace the emergency patches as the recommended builds. Earlier context: PaperCut says its response team is investigating active exploitation of PaperCut NG and PaperCut MF, with confirmed customer incidents. The advisory applies to all versions of both products. Immediate action: if the Application Server is reachable from the public internet, restrict web access to trusted addresses now. Emergency Patch Release 2 went out for NG/MF v24, v25 and v26 (Windows, Linux and macOS) with extra hardening after work with Huntress and watchTowr. Versions before v24 should upgrade to the latest. The bulletin lists CVE-2026-82078 (unsafe dynamic class loading in the database connector, CVSS 4.0 9.4 Critical) and CVE-2026-81578 (authentication bypass that can let an unauthenticated remote attacker modify certain system configurations, CVSS 4.0 8.8 High). Site Servers and secondary/print servers should be updated, not only the primary Application Server. Print Deploy and Mobility Print are not affected. Vendor-listed possible indicators include suspicious post-exploitation from pc-app.exe; missing, truncated or deleted server.log files; and server.log lines "ERROR No suitable driver found for jdbc:no:x" or "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST". Absence of those lines is not proof the server is clean. On 29 August 4:35pm AEST PaperCut added that some sites report the external-database Card/ID number lookup feature and SAML are not working as expected after the patch. Card/ID lookup from an external database is off by default after Release 2; sites that still need it must set security.card-number-lookup.enabled=Y in server/security.properties and restart the Application Server. On 30 August 10:34am AEST the vendor said customers using SQL Server for external card lookups with the legacy SourceForge jTDS driver should move to the latest supported Microsoft SQL JDBC driver; engineering is still working toward an official release and support remains available. On 30 August 3:35pm AEST PaperCut added further indicators of compromise: server.log strings such as DB URL jdbc:derby:memory:pwn;create=true, Database error looking up cardID: VALUES CAST(X'cafebabe, Database error looking up cardID: VALUES CAST(', and DB URL jdbc:no:x with a 5-character random DB Driver name; files under install/server/lib/<5-char-name>.class and install/server/data/content/<5-char-name>.cmd or .out (attackers may remove those files). Observed post-compromise behaviour includes pc-app.exe or pc-app spawning cmd.exe for whoami and ver, then reconnaissance and downloads of remote-access tooling (including a Windows service named Remote Access Service running SimpleService.exe from a JWrapper-Remote Access path, and unexpected AnyDesk under C:/ProgramData). Absence of those indicators is not proof a server is clean. On 31 August 2026 4:21pm AEST PaperCut posted a status update with no new technical information. On 1 September 2026 11:18am AEST it added FAQ clarifications, and at 2:10pm AEST it added build numbers to download links. PaperCut published Emergency Patch (Release 3) on 1 September 2026 at 6:22pm AEST. It supersedes Release 2, is an accumulation of all emergency releases, addresses two known regressions (broken SAML login flows; restored support for legacy Microsoft SQL Server drivers for external card lookup), and adds additional hardening and mitigation against potential attack chains. Customers with internet-facing Application Servers should install Release 3 even if they already applied Release 2 or an earlier emergency release. Download tables now show R3 builds (MF v26 76531, v25 76532, v24 76534; NG v26 76530, v25 76533, v24 76535). BleepingComputer (1 September) reported that Defused observed CVE-2026-81578 / CVE-2026-82078 honeypot activity since late 29 August UTC; an actor abused the auth bypass to hijack PaperCut's external user-lookup and dump database tables via Derby (a data-theft path, distinct from the public RCE writeups). CISA added CVE-2026-81578 and CVE-2026-82078 to the Known Exploited Vulnerabilities catalog on 31 August 2026. WA SOC advisory 20260901001 (1 September, TLP:CLEAR) points operators at the same vendor bulletin, lists the two CVEs (CVSS 9.4 and 8.8), and says it has not received reports of exploitation on Western Australian Government networks at the time of writing. On 2 September 2026 at 4:38pm AEST PaperCut added an 'Updates from the field' note to Current Status: it says a second wave of attacks is hitting servers that are not fully patched and remain publicly available, and that this wave appears to involve more sophisticated post-compromise behaviour than the first days of the incident. The vendor again stresses installing Emergency Patch Release 3 or keeping the Application Server off the public internet. Bulletin page header last-updated date moved to 5 September 2026; Current Status at 5 September 2026 10:30am AEST reported no new vendor technical information (work continues toward the official release); EPR3 remains the current emergency build (no EPR4 in this update). The Hacker News (5 September 2026) summarises Arctic Wolf Adversary Research Team observations: attackers exploiting CVE-2026-81578 and CVE-2026-82078 against education-sector PaperCut servers in the United States and Europe (K-12 through universities) for command execution, reconnaissance and privileged-account creation, with post-exploitation including Windows registry hive collection tools (including lsa_collect.exe used to reconstruct BootKey/SAM access paths), Metasploit/Meterpreter-related Java payloads, and host/user/process enumeration. Arctic Wolf published related pack alerts at github.com/rtkwlf/wolf-tools (202609-papercut-cve-exploitation). Still: keep Application Servers off the public internet or on EPR3; monitor pc-app.exe spawning cmd.exe/powershell and the vendor IoCs already on this card. NEW 10 September 2026 (BleepingComputer citing GreyNoise; The Hacker News also citing Blackpoint Cyber): a likely Russian-speaking actor used hundreds of AI agents (OpenAI Codex and DeepSeek plus commodity tools) to build and refine exploits for CVE-2026-81578 and CVE-2026-82078, generating target lists via Netlas. GreyNoise reports at least 440 PaperCut instances at 395 organisations across 48 countries compromised; credentials from 280 victims, OS/domain secrets from 147, and administrator privileges at 12 organisations; roughly half of victims in education; top countries US, UK, France, Spain, Canada. First RCE under four hours from an empty workspace; domain admin about two hours later. Still: EPR3 or take Application Servers off the public internet; monitor the vendor IoCs already on this card. UPDATE 15 October 2026 (Hunt.io): Hunt.io found three open directories on the campaign's orchestration host 45.142.193[.]132 (ports 8000, 18080 and 18081) holding the operator's working files, including a 3.9 GB AI-agent workbench whose AGENTS.md instructions (in Russian and English) describe OpenAI's Codex harness paired with a DeepSeek model. The files reveal a second remote-code-execution path that does not need the CVE-2026-81578 bypass: the XML-RPC Web Services API (/rpc/api/xmlrpc), using api.setConfigValue to change user-lookup settings and api.lookUpUserNameByCardNo to trigger the database execution path. It needs valid API authentication, but where no explicit API token is configured the built-in administrator password is accepted as a fallback token. Post-exploitation tooling collected Windows SECURITY and SYSTEM hives, machine-account and service credentials (lsa_read.exe, save_hives.exe, collect_custom.exe, lsa_collect_small.exe), and built reverse SOCKS5 tunnels with chisel and cron persistence on Linux (working directory /var/tmp/.rs_live46_v5/). The actor's files list 1,005 hosts in its reconnaissance pool across at least 45 countries, 2,165 logged exploitation attempts, 46 Active Directory domains in packaged victim kits and 45 targets with live reverse SOCKS5 pivots at capture (none listed in Australia). Australian angle: the recon pool includes 30 Australian hosts (23 confirmed vulnerable, 7 flagged from version checks). Hunt.io says it shared the victim data with national CERTs, which are notifying affected organisations. A second build server, 45.158.196[.]75, was also identified. Hunt.io advises anyone who ran an internet-facing PaperCut server between 15 August and 11 September to hunt for compromise rather than rely on patching: look for user-lookup.* configuration changes, .class files under the PaperCut server directory, files written under server/custom/web/ (pcp_<random>.txt output files), unexpected child processes, chisel tunnels and cron entries, and the account name Administrator17 (a GreyNoise campaign indicator).
ServiceNow's 27 August 2026 CVE record says it remediated an unauthenticated SQL injection in the ServiceNow AI Platform that could, in certain circumstances, let an unauthenticated user run arbitrary SQL against the instance database and read or change data beyond what was intended. ServiceNow scored it 10.0 (CVSS 4.0). Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of malicious exploitation. The same 27 August CNA batch includes CVE-2026-18885 (unauthenticated code injection in the GraphQL Composite Data API, CVSS 4.0 10.0; own card on this desk), CVE-2026-18886 (unauthenticated privilege escalation via image-upload processor, CVSS 4.0 10.0; own card on this desk) and CVE-2026-6876 (ServiceNow AI Platform sandbox escape, CVSS 4.0 10.0; own card on this desk). Self-hosted operators should apply the August 2026 CVE advisory updates. Affected CNA rows include Xanadu, Yokohama, Zurich and Australia patch families listed on the CVE record. Correction (24 Oct 2026): this card described CVE-2026-6876 as a Now Platform flaw scored 8.7; ServiceNow's CVE record (updated 1 September 2026) names the ServiceNow AI Platform and scores it 10.0 (CVSS 4.0). (source: https://www.cve.org/CVERecord?id=CVE-2026-6876)
Authenticated path-limitation flaw in JFrog Artifactory: under specific remote-repository conditions a user may write outside the intended Docker cache path. NVD affected builds end before 7.146.35, and 7.161.0 through builds before 7.161.16. CVSS 5.3. Patch to 7.146.35 or 7.161.16 (or later). Treat artifact caches as part of the software supply chain, not a side appliance. UPDATE (26 Oct 2026): CISA added CVE-2026-66384 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 10 September due date for US federal agencies, which means CISA has evidence it is being exploited. JFrog's advisory rates it Medium and its CVE record scores it 5.3 (CVSS 3.1). (source: CISA KEV catalog)
Out-of-bounds write in the Linux IPv6 send path (__ip6_append_data) when the paged-allocation branch undersizes the linear skb by fraggap bytes. An unprivileged local user can trigger it with a UDPv6 socket using MSG_MORE and MSG_SPLICE_PAGES. kernel.org rates CVSS 7.8. Red Hat describes the same flaw as a privilege-escalation and container-escape path on affected kernels. Patch to 6.1.177, 6.6.144, 6.12.95, 6.18.38 or 7.1.3, or the distro kernel that carries those stable commits. Red Hat documents a temporary workaround of user.max_user_namespaces=0; that setting breaks some container workflows. UPDATE (26 Oct 2026): CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 30 August due date for US federal agencies, which means CISA has evidence it is being exploited. (source: CISA KEV catalog)
ownCloud core before 10.13.1 accepts pre-signed WebDAV URLs even when the file owner has no signing-key configured (the default). If the victim username is known, an unauthenticated attacker can access, modify, or delete any of that user's files. ownCloud rates CVSS 9.8. Fixed in 10.13.1 by denying pre-signed URLs when no signing-key is set. Patch, then review access logs for unexpected WebDAV activity. UPDATE (25 Oct 2026): CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog on 27 August 2026, with a 30 August due date for US federal agencies, which means CISA has evidence it is being exploited. (source: CISA KEV catalog)
Ubuntu security tracker for CVE-2026-80521 (publication 26 August 2026; last updated 19 October 2026, checked 23 October) rates CVSS 3 severity 7.8 High (Ubuntu priority Medium): heap use-after-free in the kernel AF_UNIX garbage collector (unix_del_edge / scc_entry unlink) when SCM_RIGHTS file descriptors race with close. Reachable via ordinary socket syscalls allowed in default Docker/Kubernetes seccomp profiles, so a container process can escape to host root. Upstream fix landed 6 August 2026 (mainline commit credited to reporter Kyle Zeng). DepthFirst (research post; Google kernelCTF slot 24 July 2026) published exploit details and points to public exploit code; no confirmed in-the-wild exploitation and not in CISA KEV as of THN 23 Sep check. Ubuntu status (tracker): linux 26.04 resolute Vulnerable/work-in-progress; 24.04 noble Vulnerable; stock 22.04 jammy linux Not affected — but several HWE/cloud kernel packages on jammy (e.g. linux-aws-6.8, linux-azure-6.8) are Vulnerable. No Ubuntu temporary workaround published; DepthFirst recommends microVM isolation (Firecracker/Kata) for untrusted workloads until distro kernels ship. Primary: Ubuntu CVE tracker; research: DepthFirst; wire: The Hacker News 23 Sep 2026.
CVE-2026-80428 is an unauthenticated PHP object injection in ILIAS LMS (before 9.22 / 10.10 / 11.3). NVD: attackers inject serialized objects through the LTI authentication endpoint into session storage, then trigger unrestricted deserialization via the auth-exempt Shibboleth back-channel logout endpoint (SoapServer LogoutNotification), chaining a GuzzleHttp FileCookieJar POP gadget to write attacker-controlled PHP to a web-accessible path and achieve RCE as the web server user. CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CVSS 4.0 9.3 Critical (CVE record). Fixed in ILIAS 9.22, 10.10 and 11.3 (vendor docu advisories linked from NVD). NEW 11 September 2026: Exploit-DB 52682 publishes a remote exploit (DigiProSec) for the chain; notes v9/v10 exploitable as packaged, v11.x packaged shib_logout.php may not reach the vulnerable path. Category tech (LMS stack). No Australian exploitation reports on this pass. Primary: NVD/CVE; vendor: ILIAS docu; wire: Exploit-DB.
CISA added CVE-2026-8452 to KEV on 26 August 2026 (federal due date 29 August 2026). NVD describes a memory-overflow issue in NetScaler ADC and NetScaler Gateway that can cause unpredictable behaviour and denial of service when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Apply the fixed builds in Citrix bulletin CTX696604. This desk does not invent build numbers the bulletin page would not yield over a plain fetch.
CISA added CVE-2019-1068 to KEV on 26 August 2026 (federal due date 29 August 2026). NVD: a remote code execution issue when SQL Server incorrectly handles processing of internal functions. Apply the Microsoft security update from the MSRC advisory. Do not invent a cumulative update number here.
Wordfence (CNA) published CVE-2026-19949 for ServMask's All-in-One WP Migration and Backup WordPress plugin: unauthenticated second-order SQL injection in archive restore through 7.109. Jack Taylor reported it; Wordfence notified ServMask on 15 August 2026; fixed in 7.110 on 20 August 2026; CVE disclosed about 25 August. Incorrect parsing of escaped backslashes and quotes while rewriting database content lets an attacker plant SQL via trackbacks that runs when an admin restores a backup — core plugin use. Injected SQL can leak ai1wm_secret_key (e.g. via a public comment), then import a malicious .wpress archive for code execution and site takeover. Wordfence/BleepingComputer (2 September) cite about five million active installs and roughly 35% on the fixed build (~3.25 million still vulnerable). CVSS 3.1 8.8 High (Wordfence CNA). Patch to 7.110 or later; treat dormant installs that may be reactivated as in-scope.
Google's Stable Channel Update for Desktop (25 August 2026) promotes Chrome 152 and ships 152.0.7977.64 on Linux and 152.0.7977.64/.65 on Windows and Mac. Among Critical fixes, CVE-2026-79290 is a use-after-free in Aura that Google rates Critical and says can let a remote attacker run code outside the browser sandbox via a crafted HTML page (fixed prior to 152.0.7977.65). CVE-2026-79282 is a Critical use-after-free in ANGLE (reported by Goodluck). WA SOC shared advisory 20260831001 (31 August, TLP:CLEAR) points operators at this Chrome update for Windows, macOS and Linux prior to 152.0.7977.65, rates the Critical issues CVSS 9.6, and says it has not received reports of exploitation on Western Australian Government networks at the time of writing. WASOC's advisory table display text for the second CVE does not match its NVD href (CVE-2026-79282); this card follows the Google release notes and that href. Patch promptly to the fixed Chrome 152 builds.
