cybr.cx Daily Digest — August 29, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2023-49105 | ownCloud | CVSS 9.8 (Critical)
CISA's KEV patch deadline is tomorrow, August 30. ownCloud's improper authentication flaw allows unauthenticated attackers to access, modify, or delete any file if the target username is known and the victim has no signing-key configured. If you're running ownCloud in any capacity, treat this as an emergency. Unauthenticated file access at this scale means credential theft, data exfiltration, and full content manipulation are all on the table.

⚠️ Actively exploited — CVE-2026-53362 | Linux Kernel (IPv6 subsystem) | CVSS unspecified
CISA patch deadline: August 30. An unspecified privilege escalation flaw in the Linux kernel's IPv6 networking subsystem is being actively exploited in the wild, affecting SUSE, Red Hat, and any downstream distribution. The breadth of exposure here is enormous — patch or apply vendor mitigations immediately. This one touches nearly everything.

⚠️ Actively exploited — CVE-2022-0995 | Linux Kernel | CVSS 7.8
Another Linux kernel KEV, with a patch deadline of September 9 — but active exploitation means don't wait. An out-of-bounds memory write allows a local user to gain privileged access or cause a denial of service. Combined with CVE-2026-53362, Linux hardening should be the top priority for any infrastructure team this weekend.

⚠️ Actively exploited — CVE-2066-66384 | JFrog Artifactory | CVSS unspecified
CISA patch deadline: September 10, but already being exploited. An authenticated attacker can write data outside the intended Docker cache path under specific remote-repository conditions — a path traversal primitive that could be leveraged for persistent access or supply chain tampering within CI/CD pipelines. Check your Artifactory remote repository configurations now.

⚠️ Actively exploited — CVE-2026-8452 | Citrix NetScaler ADC & Gateway | CVSS unspecified
Patch deadline was today. An out-of-bounds memory buffer vulnerability can cause denial of service on NetScaler appliances. Given that NetScaler sits at the perimeter for many enterprises, availability impact here translates directly to business disruption. If you haven't patched, you're overdue.

⚠️ Actively exploited — CVE-2021-23758 | Ajax.NET Professional (AjaxPro) | CVSS unspecified
A five-year-old deserialization flaw enabling remote code execution via arbitrary .NET class instantiation is back in active exploitation. CISA notes the product may be end-of-life — if you're still running AjaxPro, the answer is migration, not a patch cycle.

⚠️ Actively exploited — CVE-2015-3246 / CVE-2015-5287 | Red Hat libuser & ABRT | CVSS ~6.7
Two bugs from 2015 are on CISA's KEV list as of August 26. The libuser race condition allows corruption of /etc/passwd; the ABRT symlink attack enables privilege escalation. Eleven-year-old vulnerabilities being exploited in production environments in 2026 is a reminder that legacy Red Hat systems remain live targets.

⚠️ Actively exploited — CVE-2026-60004 | Gitea | CVSS unspecified
Anyone with repository write access can submit a malicious patch to Gitea's diffpatch API endpoint, planting an executable Git hook and running shell commands as the Gitea service account. Self-hosted Gitea instances — common in enterprises avoiding GitHub — should be patched or isolated immediately.

CVE-2026-72984 | Microsoft Edge (Chromium) | CVSS 8.8
A type confusion vulnerability in Edge allows an unauthenticated network attacker to execute arbitrary code. Type confusion bugs in browser engines have historically seen rapid weaponisation; enterprise Edge deployments should prioritise the update cycle this weekend.

CVE-2026-82278 | BISHENG (before 2.6.0) | CVSS 8.8
Authenticated users of the BISHENG AI workflow platform can submit crafted Code node definitions to the /api/v1/workflow/run_once endpoint, where Python is executed via exec() with zero sandboxing — giving attackers direct access to the filesystem, credentials, and internal network. If you're running BISHENG in any internal AI pipeline, upgrade to 2.6.0 and audit recent workflow executions.

CVE-2026-82021 | Hermes Agent (before 0.19.0) | CVSS 8.3
A supply chain vulnerability in Hermes Agent's bundled MCP catalog references upstream repositories via mutable branch names rather than pinned commit SHAs. A compromised upstream repo propagates malicious code to every host that installs the affected catalog. This is a textbook mutable reference attack — pin your dependencies.

Headline News

Dark Caracal Returns With Blockchain-Backed Malware Infrastructure

The Lebanese-linked threat actor Dark Caracal has resurfaced with a significantly upgraded toolset, deploying a new Go-based malware strain — dubbed GoCaracal — against targets in Venezuela. Researchers have tied a June 2026 intrusion campaign to the group's evolved Bandook toolkit, but the headline technical development is the use of Ethereum smart contracts as a fallback command-and-control mechanism. When primary C2 infrastructure is unavailable or blocked, the malware resolves Ethereum contract state to retrieve updated C2 addresses — a technique that makes traditional domain-based blocklisting almost entirely ineffective. For defenders, this represents a maturation of blockchain-abused C2 techniques that researchers have theorised for years but rarely seen deployed at this fidelity in the wild. Network-layer controls that inspect and block cryptocurrency node communications may need re-evaluation, and teams should review their detection coverage for Go-compiled implants, which continue to proliferate across the APT ecosystem.

The Exploit Pipeline That Starts With a Rumour

A technically sharp analysis making the rounds among practitioners examines an increasingly dangerous dynamic in vulnerability research: the gap between a rumoured bug and a working exploit has collapsed to near-zero. The piece documents how public disclosure of a vulnerability's existence — even without any technical detail — is now sufficient to trigger a race among both researchers and threat actors to independently discover and weaponise the underlying flaw. Patch-gap exploitation has always been a concern, but the new wrinkle is pre-patch exploitation driven by inference, where actors reverse-engineer the patch before it's even published by studying changelogs, commit diffs, or even social media speculation. For security teams, this reframes the responsible disclosure debate: the clock starts not when a CVE drops, but when the first credible whisper surfaces. Defenders operating on a 30-day patch SLA in this environment are, in practice, operating with no SLA at all.

Schrödinger's Feed

IonQ researchers have demonstrated real-time quantum error correction (QEC) decoding at MegaQuOp scale — running an end-to-end QEC pipeline for large-scale trapped-ion quantum computers entirely on a single Apple M4 Max CPU. The result, published on arXiv, suggests that the classical decoding bottleneck — long considered a major obstacle to fault-tolerant quantum computing — may be addressable with commodity off-the-shelf hardware rather than purpose-built infrastructure. For the cryptography community, this is worth watching closely: fault-tolerant quantum computers capable of running Shor's algorithm at scale require precisely this kind of efficient error correction to be practical. Every incremental milestone in QEC narrows the timeline that practitioners have to complete post-quantum cryptographic migrations.

/dev/random

The security community is grappling with a genuinely uncomfortable epistemological problem: it turns out that simply announcing a bug exists — with no CVE, no proof-of-concept, no technical write-up — is enough for skilled researchers to find and weaponise it independently. The specific mechanism documented involves analysts scanning git commit histories, changelog entries reading "fixed an edge case in authentication," or even conference talk abstracts that mention a product category, and reverse-engineering their way to a fully working exploit from that single data point. In one discussed case, a vague mailing list post saying a "serious issue" had been found in a networking component was enough to produce public PoC code within 72 hours — before the official advisory. The lesson, apparently, is that operational security now extends to the changelog.