cybr.cx Daily Digest — September 04, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-82329 | JFrog Artifactory | No CVSS in NVD feed
Under default configuration, an unauthenticated attacker with network access can obtain full administrative privileges in JFrog Artifactory. No credentials required — just network reachability. CISA's patch deadline is September 5, meaning if you haven't acted yet, you're already late. A second Artifactory flaw, CVE-2026-66384 (also KEV-listed), allows authenticated users to write data outside the intended Docker cache path via a path traversal, potentially enabling further compromise when chained with the auth bypass.

⚠️ Actively exploited — CVE-2026-49869 | Kestra OSS | No CVSS in NVD feed
An unauthenticated remote attacker can create and execute arbitrary workflows on Kestra OSS — no credentials, no interaction, full command execution. CISA deadline is September 5. If Kestra is exposed to any untrusted network, treat this as a fire drill now.

⚠️ Actively exploited — CVE-2026-83548 & CVE-2026-83549 | SonicWall SMA1000 | No CVSS in NVD feed
Two chained bugs in SonicWall's SMA1000 appliances — an unauthenticated SSRF (CVE-2026-83548) enabling access to sensitive internal functionality, paired with an authenticated OS command injection (CVE-2026-83549) giving remote code execution as admin. SonicWall edge appliances are perennially attractive targets; the CISA deadline is September 5.

⚠️ Actively exploited — CVE-2026-9586 | Sangoma Switchvox | No CVSS in NVD feed
A single crafted unauthenticated HTTP request can execute arbitrary SQL against Switchvox's PostgreSQL backend, and the description confirms the path extends to remote code execution. VoIP infrastructure being exploitable pre-auth via SQL injection is a nightmare scenario for organisations running on-prem telephony. Patch deadline: September 5.

⚠️ Actively exploited — CVE-2026-59822 | BerriAI LiteLLM | No CVSS in NVD feed
The MCP Streamable HTTP endpoint in LiteLLM accepts any arbitrary Bearer token as valid, allowing unauthenticated attackers to establish fully authenticated MCP sessions. Given how widely LiteLLM is deployed as an AI gateway in enterprise environments, this is a high-value target for lateral movement into model infrastructure. Patch deadline: September 16.

⚠️ Actively exploited — CVE-2026-48710 | Kludex Starlette | No CVSS in NVD feed
HTTP request/response smuggling in the Starlette ASGI framework allows attackers to inject paths into the host header, prepending them to the actual request path. Authentication middleware that relies on reconstructed URL paths can be bypassed entirely. Starlette underpins a large chunk of the Python web ecosystem — FastAPI included — making blast radius significant. Patch deadline: September 16.

⚠️ Actively exploited — CVE-2026-82078 & CVE-2026-81578 | PaperCut NG/MF | No CVSS in NVD feed
PaperCut is back in the KEV for the second time in three years. CVE-2026-81578 allows unauthenticated modification of system configurations; when chained with CVE-2026-82078 (unsafe Java reflection), an attacker can execute arbitrary bytecode under the PaperCut server's security context. This is a known-bad pattern from 2023 repeating itself. Patch deadline: September 14.

CVE-2026-85174 & CVE-2026-85175 | SiYuan | CVSS 8.8
Two related flaws in the SiYuan note-taking application (pre-v3.8.2). The first logs API tokens in plaintext to a recoverable log file when search queries exceed timing thresholds. The second reveals that the IsForbiddenAbsPath() blocklist only protects conf.json by exact name — TLS private keys (key.pem) and CA keys (ca.key) in the same directory are freely readable via the getFile endpoint. Any authenticated attacker can exfiltrate credentials and pivot to permanent admin access. Update to v3.8.2 immediately.

CVE-2026-71963 | Hermes Agent 0.18.2–0.21.0 | CVSS 8.8
Opening a malicious Git repository in Hermes Agent is sufficient for remote code execution. A crafted .git/config sets core.fsmonitor to an attacker-controlled command; when the user sends any message, the agent triggers a git status refresh and executes the payload. This is a classic supply chain delivery mechanism — malicious repos shared via collaboration channels. Fixed in commit f6234d0.

CVE-2026-85178 | Helicone VaultManager | CVSS 7.7
Admin or owner users in any Helicone organisation can call GET /v1/vault/key/{providerKeyId} with an arbitrary key ID and receive decrypted upstream API credentials — including plaintext OpenAI, Anthropic, and Bedrock keys — belonging to entirely different tenants. In a multi-tenant AI platform, this is a cross-customer credential theft vulnerability with significant downstream consequences.

Headline News

AI Infrastructure Breach: The OpenAI / Hugging Face Incident Dissected

An investigative report released by AI safety evaluator METR has provided the most detailed public accounting yet of a significant security incident involving both OpenAI and Hugging Face infrastructure. The report examines how the breach unfolded, what access was obtained, and — critically — where the detection and containment failures occurred. For practitioners, the key takeaway is how the shared, interconnected nature of modern AI infrastructure creates lateral movement opportunities that traditional network segmentation models don't adequately address. Model registries, API keys, and training pipelines are now first-class attack surfaces, not incidental ones. The incident also raises hard questions about incident response readiness in organisations that have scaled their AI infrastructure faster than their security programs. This report is required reading for anyone responsible for securing ML pipelines or AI-adjacent cloud environments.

ICE's Zero-Click Mobile Spyware Contract

U.S. Immigration and Customs Enforcement holds a $2 million contract for commercial spyware capable of compromising mobile devices without any user interaction — no link to click, no file to open. Zero-click exploits of this class typically target vulnerabilities in image parsing, iMessage processing, or baseband firmware, and have historically been associated with nation-state tooling. The existence of a domestic law enforcement contract for such capability raises significant questions about operational oversight, targeting constraints, and the legal frameworks governing its use. From a technical standpoint, practitioners should note that zero-click implants at this capability level are rarely contained to a single jurisdiction or vendor ecosystem — once the underlying exploit chains exist, they circulate. Mobile device management policies, network traffic monitoring for anomalous beacon patterns, and prompt OS patching remain the primary — if imperfect — mitigations.

Schrödinger's Feed

MIT has published details on a new qubit architecture that enables faster and more accurate quantum operations, describing it as a meaningful step toward scalable, practical quantum computation. The advance targets one of the field's most persistent problems: gate fidelity degrading as qubit counts increase. For cryptographers, "scalable and practical" are the two words that matter most — current harvest-now-decrypt-later attacks assume that timeline will eventually arrive. If architectural improvements start compressing that runway, organisations still running RSA-2048 or ECC without a PQC migration plan have less runway than they think.

/dev/random

Cerebras is now serving Qwen 3's 27-billion-parameter model at 1,500 tokens per second — roughly 10–15x faster than what GPU clusters typically deliver for a model of this size. The throughput is achieved via Cerebras's wafer-scale chip architecture, which eliminates the inter-chip communication bottlenecks that make large models slow on conventional hardware. The practical implication is that a model capable of sophisticated reasoning is now fast enough to feel instantaneous in interactive use. Whether that's exciting or mildly terrifying probably depends on which side of a social engineering attack you're on.