cybr.cx Daily Digest — September 03, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-82329 | JFrog Artifactory | CVSS: N/A (KEV)
Under default configuration, an unauthenticated attacker with network access can obtain full administrative privileges on JFrog Artifactory. CISA's remediation deadline is September 5 — patch or isolate immediately. If your build pipeline touches Artifactory, assume it's a target.

⚠️ Actively exploited — CVE-2026-49869 | Kestra OSS | CVSS: N/A (KEV)
An unauthenticated remote attacker can create and execute arbitrary workflows via OS command injection — no credentials required. Remediation deadline is September 5. Kestra is widely used for data and ML orchestration, making this a high-value supply chain pivot point.

⚠️ Actively exploited — CVE-2026-9586 | Sangoma Switchvox | CVSS: N/A (KEV)
A single crafted unauthenticated HTTP request can execute arbitrary SQL against the backend PostgreSQL database, including operations that lead to remote code execution. Deadline September 5. VoIP infrastructure is a perennially underpatched attack surface — treat this as urgent.

⚠️ Actively exploited — CVE-2026-83548 & CVE-2026-83549 | SonicWall SMA1000 | CVSS: N/A (KEV)
Two chained issues: an unauthenticated SSRF (CVE-2026-83548) enabling access to sensitive internal functionality, and an OS command injection (CVE-2026-83549) allowing authenticated admins to achieve RCE. SonicWall edge appliances are a recurring favourite for threat actors — deadline September 5, patch now.

⚠️ Actively exploited — CVE-2026-82078 & CVE-2026-81578 | PaperCut NG/MF | CVSS: N/A (KEV)
These two chain cleanly: CVE-2026-81578 allows an unauthenticated attacker to modify system configurations, which feeds directly into CVE-2026-82078's unsafe reflection flaw to execute arbitrary Java bytecode under the PaperCut server process context. PaperCut has been repeatedly targeted since 2023 — deadline September 14, but treat as critical today.

⚠️ Actively exploited — CVE-2026-59822 | BerriAI LiteLLM | CVSS: N/A (KEV)
An improper authentication flaw in the MCP Streamable HTTP endpoint allows any unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. As LiteLLM proxies proliferate across enterprise AI stacks, this is a significant lateral movement risk — deadline September 16.

⚠️ Actively exploited — CVE-2026-48710 | Kludex Starlette | CVSS: N/A (KEV)
HTTP request/response smuggling in this widely-used Python ASGI framework allows attackers to inject paths into the host portion of a reconstructed URL, enabling authentication bypass wherever auth decisions depend on that URL path. Starlette underpins FastAPI — check your entire Python web stack.

CVE-2026-14982 | WP File Download (WordPress plugin) | CVSS: 8.1 — HIGH
Subscriber-level authenticated attackers can delete arbitrary files on the server due to missing path validation in the delete function. Deleting wp-config.php forces WordPress into reinstallation mode, trivially leading to full site takeover. Patch or deactivate the plugin immediately.

CVE-2026-78408 | util-linux (nsenter) | CVSS: 7.9 — HIGH
The nsenter --join-cgroup option leaves a root-opened file descriptor for cgroup.procs accessible after credential changes and across execve(). A process in an attacker-controlled container can inherit root's ability to move host processes between cgroups — a meaningful container escape primitive in shared environments.

CVE-2026-78410 | util-linux mount | CVSS: 7.8 — HIGH
A TOCTOU race in SUID mount(8) allows an unprivileged local user to redirect bind mounts to arbitrary host directories by swapping the authorized source path before it's pinned. When combined with X-mount.owner or X-mount.mode fstab options, root then hands out ownership or permissive modes to attacker-controlled paths.

CVE-2026-84484 | ION-DTN (before 4.2.0) | CVSS: 7.5 — HIGH
An out-of-bounds read in the decodeSdnv function can be triggered unauthenticated by sending a truncated SDNV value over UDP to the LTP link service port, reading up to nine bytes past buffer boundaries. Niche but notable: ION-DTN is NASA's delay-tolerant networking implementation used in space communications research.

Headline News

Six curl CVEs: Human Researchers Beat AI Bug Hunters

A security research team disclosed six new CVEs in curl after both OpenAI and Anthropic's AI-assisted analysis returned zero findings against the same codebase. The vulnerabilities span memory handling and protocol parsing bugs in one of the most widely deployed network libraries on the planet — embedded in virtually every Linux distribution, container image, and firmware stack in existence. The result is an uncomfortable data point for the AI-augmented security testing narrative: the bugs were real, reproducible, and demonstrably missed by frontier LLM-based tooling. For practitioners, the takeaway isn't that AI tools are useless, but that their false-negative rates on mature, complex C codebases remain poorly characterised. Until that changes, retiring traditional fuzzing, static analysis, and human review in favour of AI assistants would be premature.

OpenAI's Unreleased Model Incident Cascades Into Development Delays

The fallout from July's Hugging Face breach — in which an unreleased OpenAI model was exfiltrated and caused significant international disruption — continues to reshape the company's internal roadmap. OpenAI has confirmed it paused development of a separate unreleased model suite, internally called Astra, specifically to conduct additional safety and security hardening work in the aftermath. The incident represents one of the first publicly acknowledged cases where a model theft directly altered a major AI lab's engineering priorities. For security practitioners, this highlights a maturing threat category: AI model repositories and training infrastructure are now high-value targets, and the blast radius from a single stolen model extends well beyond IP loss into operational and safety consequences. Organisations running internal model registries should be auditing access controls and egress monitoring on those systems now.

Malware Found in 19 Chrome Extensions Targeting Crypto and Credentials

Google has pulled 19 Chrome extensions from the Web Store after researchers identified injected malware capable of draining cryptocurrency wallets and harvesting sensitive user data including session tokens and credentials. The extensions had collectively accumulated a significant user base before detection, following a pattern where initially legitimate extensions are later compromised — either through developer account takeover or deliberate malicious updates pushed post-publication. The malware exfiltrated data to attacker-controlled infrastructure and specifically targeted Web3 wallet interfaces, intercepting transaction signing events. Enterprise security teams should audit installed browser extensions across managed endpoints, enforce allowlisting where possible, and treat any extension requesting broad host permissions or storage access as requiring formal review.

Schrödinger's Feed

QuSecure's QuProtect R3 post-quantum cryptography platform has achieved Technology Readiness Level 7 (TRL-7) — meaning operational prototype demonstrated in an operational environment — during the U.S. Army's Project Convergence Capstone 6 exercise at Fort Irwin. This is a meaningful milestone: TRL-7 is the threshold at which a technology transitions from laboratory curiosity to something the military will actually consider deploying on real networks. The exercise specifically tested PQC-secured communications under field conditions, validating that NIST-standardised algorithms can perform within operational latency constraints. Practitioners overseeing long-lifecycle systems — defence contractors, critical infrastructure operators, anyone encrypting data that must remain confidential past 2030 — should note that the procurement pipeline for PQC-capable hardware and software is now moving faster than many migration timelines account for.

/dev/random

Mistral AI's help documentation quietly confirms that by default, inputs and outputs processed through their API are used for model training — but users can opt out, provided they know to ask. The discovery surfaced when someone actually read the terms, which is apparently now a notable enough event to generate significant practitioner discussion. The opt-out requires an explicit flag per API call or a blanket account-level setting, neither of which is surfaced prominently during onboarding. If your organisation is piping anything sensitive through a third-party LLM API on default settings, this is a good week to audit exactly which data is going where — and whether your data processing agreements cover "used to improve the model" as a processing activity.