cybr.cx Daily Digest — September 07, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-85046 | Google Chromium V8 | CVSS: N/A (KEV)
A type confusion vulnerability in Chromium's V8 JavaScript engine allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Every Chromium-based browser is in scope — Chrome, Edge, and derivatives alike. CISA's remediation deadline was September 18; if you haven't pushed the patch, stop reading and do it now.

⚠️ Actively exploited — CVE-2026-82329 | JFrog Artifactory | CVSS: N/A (KEV)
Under default configuration, an unauthenticated attacker with network access can obtain full administrative privileges on JFrog Artifactory. If your Artifactory instance faces the internet or an untrusted internal network, assume it's a target. Patch immediately and audit admin account activity for signs of compromise.

⚠️ Actively exploited — CVE-2026-49869 | Kestra OSS | CVSS: N/A (KEV)
Unauthenticated remote attackers can create and execute arbitrary workflows via OS command injection — no credentials required. The CISA remediation deadline has already passed (September 5), meaning exposed instances have had a window of unmitigated risk. Isolate or take offline any internet-facing Kestra deployments until patched.

⚠️ Actively exploited — CVE-2026-9586 | Sangoma Switchvox | CVSS: N/A (KEV)
A single crafted request is enough for an unauthenticated attacker to execute arbitrary SQL against the backend PostgreSQL database, with a path to remote code execution. VoIP infrastructure is a high-value target for toll fraud and espionage; treat this as critical regardless of your CVSS weighting philosophy.

⚠️ Actively exploited — CVE-2026-83548 / CVE-2026-83549 | SonicWall SMA1000 | CVSS: N/A (KEV)
Two vulnerabilities being exploited in tandem: an unauthenticated SSRF (CVE-2026-83548) enabling access to sensitive internal functionality, and an authenticated OS command injection (CVE-2026-83549) for full RCE. SonicWall edge appliances are a perennial favourite for initial access; these should be patched on an emergency basis.

⚠️ Actively exploited — CVE-2026-81578 / CVE-2026-82078 | PaperCut NG/MF | CVSS: N/A (KEV)
A missing authentication flaw (CVE-2026-81578) is being chained with an unsafe reflection vulnerability (CVE-2026-82078) to achieve arbitrary Java bytecode execution under the PaperCut server process context. Active exploitation is confirmed in the education sector (see Headline News). Both flaws must be remediated together — patching one without the other leaves the chain viable.

⚠️ Actively exploited — CVE-2026-59822 | BerriAI LiteLLM | CVSS: N/A (KEV)
The MCP Streamable HTTP endpoint in LiteLLM accepts arbitrary Bearer tokens to establish authenticated MCP sessions, bypassing authentication entirely. With LiteLLM widely deployed as an AI gateway in enterprise environments, exploitation here can mean access to upstream LLM APIs, credentials, and sensitive prompts.

⚠️ Actively exploited — CVE-2026-48710 | Kludex Starlette | CVSS: N/A (KEV)
An HTTP request/response smuggling flaw allows attackers to inject paths into the host component, potentially prepending them to the actual request path. The practical impact is authentication bypass in any application where auth logic depends on the reconstructed URL — a significant chunk of the FastAPI/Starlette ecosystem.

CVE-2026-86166 | Tenda HG10 Router | CVSS: 8.8 — HIGH
A remotely exploitable stack buffer overflow in the Boa web server's formWanRedirect handler can be triggered by manipulating the if argument. A public exploit exists. Consumer and SOHO routers running this firmware should be patched or isolated from untrusted networks; these devices are frequently absorbed into botnets within hours of a public PoC dropping.

CVE-2026-18056 | HivePress Authentication Plugin for WordPress (≤1.1.4) | CVSS: 7.5 — HIGH
The Facebook login flow passes the attacker-supplied access_token directly to the Graph API and trusts the returned email and user ID without independent verification. An attacker who knows a target's registered email can authenticate as any user, including administrators, on any affected WordPress site. Update to 1.1.5 or disable Facebook login.

CVE-2026-86250 | h3 (< 2.0.1-rc.18) | CVSS: 7.5 — HIGH
Malformed cookie headers with an inflated chunk count trigger an O(n²) cleanup loop in setChunkedCookie() and deleteChunkedCookie(), hanging the server process. This is a straightforward DoS via a single crafted request — low effort, high impact for any application relying on h3 for cookie management.

CVE-2026-86259 | OpenMAIC (< 1.0.1) | CVSS: 7.5 — HIGH
Non-production builds skip SSRF validation entirely, allowing unauthenticated attackers to reach cloud instance metadata services via the x-base-url header or baseUrl parameter. The risk is cloud credential theft — particularly dangerous if dev/staging environments share IAM roles with production.

CVE-2026-86159 / 86160 / 86161 / 86162 | SourceCodester Online Voting System 1.0 | CVSS: 7.3 — HIGH
Four separate SQL injection points across login, user save, vote deletion, and category deletion endpoints — all remotely exploitable with public exploits available. The product is widely used in academic and small-government deployments. If you're running this, assume full database compromise is trivial.

Headline News

PaperCut Exploits Hit Schools Across the US and Europe
Two freshly disclosed PaperCut NG/MF vulnerabilities — CVE-2026-81578 and CVE-2026-82078 — are being actively chained in attacks targeting educational institutions on both sides of the Atlantic. The attack chain works by first using the missing authentication flaw to modify system configurations, then leveraging unsafe reflection to load and execute arbitrary Java bytecode from the application classpath. Credential theft and privilege escalation are the confirmed outcomes so far, making lateral movement into broader school network infrastructure a near-certain next step. PaperCut is ubiquitous in education environments, which tend to have stretched IT teams and longer patch cycles — exactly the conditions attackers optimise for. Both CVEs carry CISA KEV listings with deadlines that have now passed; if you support any educational organisation, this should be your first call Monday morning.

Magento and Adobe Commerce Zero-Day Actively Backdooring Online Stores
An unpatched remote code execution vulnerability in Magento Open Source and Adobe Commerce is being exploited in the wild to implant backdoors on e-commerce servers, with no authentication required. The flaw allows attackers to execute arbitrary server-side code, giving them full control over the store environment — payment data, customer PII, and backend credentials are all in scope. Because no patch is currently available, the attack surface remains open across the entire Magento ecosystem. Defenders should prioritise web application firewall rules targeting the vulnerable component, review server-side file integrity for signs of webshell implants, and monitor outbound connections from web server processes for data exfiltration indicators. This is the kind of vulnerability that fuels payment card skimming campaigns at scale.

Trezor Breach Scope Grows Sixfold After "Deleted" Logs Resurface
What was initially a contained data breach affecting Trezor hardware wallet customers has expanded dramatically after shipping logs — believed to have been deleted — were recovered, pushing the confirmed exposure to approximately 80,689 affected users. The incident highlights a fundamental problem in breach response: data deletion is rarely as complete as vendors assume, particularly when third-party logistics providers retain their own copies of fulfilment records. For Trezor customers, the exposed data is physical shipping information rather than wallet keys or seed phrases — but that's cold comfort when your home address is now potentially in the hands of threat actors who know you own cryptocurrency hardware. The gap between "deleted" and "actually gone" is a recurring failure mode in breach notification; practitioners managing incident response should treat third-party data processors as separate retention domains requiring explicit verification.

Schrödinger's Feed

NEC has quietly exited the quantum hardware race, discontinuing development of its physical quantum computing system at the end of March — a striking withdrawal from a company that helped lay the theoretical groundwork for the field. The move underscores a point made in a concurrent ERVA engineering report: the primary limiter to quantum progress is no longer physics, it's engineering — specifically the messy, expensive, unglamorous work of building systems that actually scale. For cryptographers and security planners, NEC's retreat is a reminder that the timeline to cryptographically-relevant quantum computers remains genuinely uncertain; threat models built around specific "Q-Day" dates should be treated with scepticism. That said, post-quantum migration is a multi-year project — uncertainty about arrival time is not an argument for delay.

/dev/random

Asahi Linux has officially added support for Apple M3 Macs — meaning a community-driven reverse-engineering project now runs a general-purpose Linux kernel on hardware Apple hasn't publicly documented at the silicon level. The caveats are real: GPU acceleration is partial, some media engines remain dark, and sleep behaviour is described diplomatically as "a work in progress." Still, the fact that volunteer engineers have coaxed a foreign OS onto a tightly locked-down ARM SoC — without access to datasheets — says something either deeply inspiring or mildly alarming about the limits of hardware security through obscurity. Probably both.