Home
CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog between 31 August and 6 September 2026, split across three batches: two on 31 August, seven on 2 September, one on 4 September. Six of the ten carry a CVSS score of 9.0 or higher, all ten have confirmed in-the-wild exploitation behind their KEV listing, and at least two already have public proof-of-concept code circulating (JFrog Artifactory and Kestra). Patch Kestra’s unauthenticated workflow execution flaw first: it is rated CVSS 10.0, it is already being used to drop reverse shells and cryptocurrency miners, and its EPSS score is the highest of the week’s three CVSS-10.0 vulnerabilities. The pattern across the batch is authentication and access control, not memory corruption: seven of the ten added flaws let an attacker skip a login screen entirely, whether through SSRF, suffix-matched path bypass, or a forged bearer token.
Which vulnerabilities should you patch first this week?
Patch Kestra, SonicWall SMA1000, and PaperCut NG/MF first, in that order, because all three combine confirmed exploitation with unauthenticated, internet-facing access paths.
CVE-2026-49869, Kestra unauthenticated workflow execution, ranks first. It is rated CVSS 10.0, requires no authentication, and CISA confirms attackers have already used it to establish reverse shells, run Docker container discovery, and deploy cryptocurrency miners. Its EPSS score of 1.92 percent (78th percentile) is the highest of the week’s CVSS-10.0 vulnerabilities, and the federal remediation deadline is 5 September 2026. Upgrade to Kestra 1.0.45 or 1.3.21 now.
CVE-2026-83548, SonicWall SMA1000 pre-authentication SSRF, ranks second. It is also CVSS 10.0 and unauthenticated, but it sits on a VPN and remote-access appliance, the exact class of internet-facing edge device that has anchored the largest ransomware intrusions of 2026. SonicWall has confirmed exploitation predates disclosure, so patching alone does not rule out prior compromise. Federal deadline is 5 September 2026.
CVE-2026-81578, PaperCut NG/MF authentication bypass, ranks third. Rated CVSS 9.8 by NVD, it chains directly into a second flaw (CVE-2026-82078) that hands an attacker arbitrary code execution as the print server process, and PaperCut sits in enterprise and government environments at a scale few edge appliances match.
CVE-2026-49869: Kestra unauthenticated remote code execution
What it is: An authentication bypass in Kestra’s API filter lets an unauthenticated attacker reach any endpoint whose path ends in “/configs” because the filter matches on path suffix rather than an exact path, and because Kestra ships script-execution plugins enabled by default, that access converts directly into arbitrary workflow creation and execution as root inside the worker container.
Affected products and versions: Kestra versions before 1.0.45, and versions 1.1.0 through 1.3.20 inclusive.
Severity: CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, NVD entry for CVE-2026-49869). EPSS 1.92 percent (78th percentile) as of 2026-09-06.
Exploitation status: Confirmed in the wild. Added to CISA KEV on 2 September 2026. Federal remediation due date: 5 September 2026. A public vulnerability checker for this CVE is already circulating on GitHub.
Patch status: Fixed in Kestra 1.0.45 and 1.3.21, both released prior to the KEV addition.
What to do: Upgrade to 1.0.45 or 1.3.21 immediately. Audit worker container logs for unexpected workflow creation, outbound connections, or Docker discovery commands. If upgrading is not immediately possible, block external access to the Kestra API entirely rather than relying on authentication.
Why it matters: CISA’s own alert describes attackers using this flaw to establish a reverse shell, run Docker container environment discovery, and deploy a cryptocurrency miner, a full initial-access-to-impact chain in one unauthenticated request. Kestra’s growing use as a workflow and data orchestration layer means a compromised instance often sits with credentials to the systems it orchestrates.
CVE-2026-83548: SonicWall SMA1000 pre-authentication SSRF leading to unauthorized access
What it is: An unauthenticated server-side request forgery in the SMA1000 Work Place interface lets a remote attacker reach an unintended alternate access path and perform administrative operations without logging in, no credentials required.
Affected products and versions: SMA1000 models 6210, 7210, and 8200v running firmware 12.4.3-03453 platform-hotfix or earlier, and 12.5.0-02835 platform-hotfix or earlier.
Severity: CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, NVD entry for CVE-2026-83548). EPSS 0.71 percent (51st percentile) as of 2026-09-06.
Exploitation status: Confirmed in the wild, SonicWall has stated exploitation predates public disclosure. Added to CISA KEV on 2 September 2026. Federal remediation due date: 5 September 2026.
Patch status: Fixed in hotfix 12.4.3-03526 or higher, and 12.5.0-02952 or higher.
What to do: Apply the SonicWall hotfix immediately. Do not stop at patching: because exploitation preceded disclosure, contact SonicWall support for a compromise review, reset all administrator and user passwords, and reset TOTP tokens on any appliance that was internet-facing before the hotfix.
Why it matters: A remote-access appliance is the front door to the internal network by design, so a pre-auth SSRF on one is not a data-exposure bug, it is initial access. CVE-2026-83549, a post-auth OS command injection in the same product line rated CVSS 7.8, gives an attacker who has already gained administrative access through the SSRF a direct path to remote code execution, turning two separate flaws into a single unauthenticated-to-RCE chain.
CVE-2026-81578: PaperCut NG/MF authentication bypass and remote code execution chain
What it is: An access control flaw in PaperCut MF and NG’s web management interface lets an unauthenticated attacker trigger backend administrative actions before the application completes its access validation check, and a second flaw, CVE-2026-82078, an unsafe dynamic class loading bug in PaperCut’s database connection utilities, converts that initial access into arbitrary Java code execution as the print server process.
Affected products and versions: PaperCut MF and NG versions before 24.1.10, 25.0.13, and 26.0.5.
Severity: CVE-2026-81578: CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, NVD entry for CVE-2026-81578); the vendor’s CNA scores it 8.8 under CVSS v4.0. EPSS 1.62 percent (74th percentile) as of 2026-09-06. CVE-2026-82078: CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, NVD entry for CVE-2026-82078); the CNA scores it 9.4 under CVSS v4.0. EPSS 1.69 percent (76th percentile) as of 2026-09-06.
Exploitation status: Confirmed in the wild. Both added to CISA KEV on 31 August 2026. Federal remediation due date: see KEV entry.
Patch status: Fixed in PaperCut MF/NG 24.1.10, 25.0.13, and 26.0.5.
What to do: Upgrade to 24.1.10, 25.0.13, or 26.0.5 immediately. Huntress has documented real-world post-exploitation featuring whoami, ver, and tasklist run with SYSTEM privileges, so treat any unpatched, internet-facing PaperCut server as potentially already compromised and review for dropped Java class files in the installation directory.
Why it matters: This is a two-step chain from zero credentials to code execution as the print server process, and print management servers are deployed widely across enterprise and government networks with access to internal file shares and directory services. An attacker who lands here gains a foothold with a plausible pretext for staying quiet.
CVE-2026-59822: Berri LiteLLM MCP authentication bypass
What it is: An authentication bypass in LiteLLM’s Model Context Protocol Streamable HTTP endpoint lets an unauthenticated attacker send a fabricated Authorization header that triggers an OAuth2 passthrough fallback path, substituting a failed key check with an empty object and granting access to MCP tooling without valid credentials.
Affected products and versions: BerriAI LiteLLM versions before 1.84.0.
Severity: CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, NVD entry for CVE-2026-59822); also scored 8.8 under CVSS v4.0. EPSS 0.87 percent (56th percentile) as of 2026-09-06.
Exploitation status: Confirmed in the wild. Added to CISA KEV on 2 September 2026. Federal remediation due date: 16 September 2026.
Patch status: Fixed in LiteLLM 1.84.0.
What to do: Upgrade to 1.84.0 immediately. Audit which MCP tools and backend model providers are reachable through your LiteLLM gateway, and treat any unauthenticated exposure of that gateway as a direct path to whatever agents and tools it proxies.
Why it matters: LiteLLM is a gateway that sits between applications and the large language models and agent tools behind them, so an authentication bypass here does not expose a single application, it exposes every model call and MCP tool routed through the gateway. As agentic AI deployments grow, the gateway layer is becoming as attractive a target as the identity provider was in the previous decade, and it deserves the same AI-native application and API testing rigor as any other internet-facing service.
CVE-2026-85046: Google Chrome V8 type confusion remote code execution
What it is: A type confusion flaw in Chrome’s V8 JavaScript and WebAssembly engine, present in both the Maglev and Turbofan compilers, lets a remote attacker execute arbitrary code inside the browser sandbox via a crafted HTML page, no authentication or prior access required.
Affected products and versions: Google Chrome versions before 152.0.7977.82 (Linux) and before 152.0.7977.82/.83 (Windows and Mac).
Severity: CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, NVD entry for CVE-2026-85046).
Exploitation status: Confirmed in the wild, Google has confirmed an active exploit but declined to attribute it to a specific actor. Added to CISA KEV on 4 September 2026. Federal remediation due date: 18 September 2026.
Patch status: Fixed in Chrome 152.0.7977.82/.83.
What to do: Update Chrome and any Chromium-based browser in your environment now. Confirm auto-update is enabled fleet-wide rather than relying on user-initiated restarts, since exploitation requires only that a user open a crafted page.
Why it matters: This is the sixth actively exploited Chrome zero-day of 2026. Researcher Salvatore Gulizia reported the underlying bug on 4 August 2026 through Google’s bug bounty program, and the gap between report and in-the-wild exploitation shows how quickly browser rendering bugs move from disclosure to weaponization once the technical details are even partially understood.
New hacking technique: hidden GRE tunnels on Cisco IOS XR routers
What researchers demonstrated: Sygnia published research, corroborated in trade coverage on 31 August and 1 September 2026, documenting new activity by the China-nexus threat actor Fire Ant, which has shifted from compromising VMware hypervisors to directly compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts to build a covert monitoring platform on trusted network infrastructure.
How It Works
Step-by-step attack chain
Fire Ant gains access to a Cisco IOS XR router and deploys custom, purpose-built malware, including a component launched through a modified init script, that operates on the router’s control plane rather than through generic Linux tooling.
↓
The actor creates an active GRE tunnel interface that has no corresponding configuration entry or commit history, so the running state of the device no longer matches what administrators can see in configuration and audit records.
↓
A modified IOS XR syslog library intercepts log delivery through a custom wrapper that filters out messages containing the word “Health” before forwarding the rest, selectively suppressing telemetry about the compromise.
↓
A second component alters command output paths so that diagnostic commands appear to run normally, hiding the tunnel and the malware from an administrator running standard show commands.
↓
The tunnel carries outbound traffic to attacker infrastructure, and TACACS servers and Linux management hosts in the same environment are compromised in turn, extending the platform’s reach into connected high-value and critical infrastructure networks.
Why it matters: This targets exactly the infrastructure class that most vulnerability management programs do not test: routers, authentication servers, and management hosts, rather than applications and endpoints. Once an attacker controls the device that generates the logs, the absence of alerts stops being evidence of safety. Twenty percent of breaches now involve access through this kind of peripheral, unmanaged asset rather than a primary application.
What to do: Inventory GRE tunnel interfaces on edge and core routers against known configuration and commit history, not against what show commands currently report. Rotate TACACS credentials and audit for unexplained outbound connections from network infrastructure. Discover unmanaged network infrastructure and treat routers and management hosts as in-scope for exposure testing, not as trusted plumbing.
CISA KEV additions, 31 Aug to 6 Sep 2026
| CVE | Product | CVSS | Date added to KEV | Federal due date |
|---|---|---|---|---|
| CVE-2026-81578 | PaperCut NG/MF | 9.8 | 31 Aug 2026 | See KEV entry |
| CVE-2026-82078 | PaperCut NG/MF | 9.1 | 31 Aug 2026 | See KEV entry |
| CVE-2026-83548 | SonicWall SMA1000 | 10.0 | 2 Sep 2026 | 5 Sep 2026 |
| CVE-2026-83549 | SonicWall SMA1000 | 7.8 | 2 Sep 2026 | 5 Sep 2026 |
| CVE-2026-9586 | Sangoma Switchvox | 9.8 | 2 Sep 2026 | 5 Sep 2026 |
| CVE-2026-82329 | JFrog Artifactory | 9.8 | 2 Sep 2026 | 5 Sep 2026 |
| CVE-2026-49869 | Kestra OSS | 10.0 | 2 Sep 2026 | 5 Sep 2026 |
| CVE-2026-48710 | Kludex Starlette | 6.5 | 2 Sep 2026 | 16 Sep 2026 |
| CVE-2026-59822 | Berri LiteLLM | 8.2 | 2 Sep 2026 | 16 Sep 2026 |
| CVE-2026-85046 | Google Chrome (V8) | 8.8 | 4 Sep 2026 | 18 Sep 2026 |
No KEV additions were confirmed for 1, 3, 5, or 6 September 2026 in the alert pages checked for this report.
Two additional CVEs in this week’s batch did not get a standalone item above but round out the KEV picture. CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox (CVSS 9.8), exploited to run arbitrary PostgreSQL statements and deploy reverse shells. CVE-2026-82329 is an authentication bypass in JFrog Artifactory under default configuration (CVSS 9.8), used to obtain administrative privileges and mint admin tokens for credential harvesting, and a public proof of concept is already circulating on GitHub. CVE-2026-48710, a CVSS 6.5 HTTP request smuggling flaw in the Starlette ASGI framework, rounds out the batch; its EPSS score of 36.26 percent, the highest of the week, is worth tracking even at a moderate CVSS given how many Python API and AI-serving frameworks sit on Starlette underneath.
How FireCompass helps
Seven of this week’s ten KEV additions are authentication or access control failures on internet-facing software, not memory corruption bugs that require a research team to find. Knowing whether your own SonicWall, PaperCut, or LiteLLM instance is running the vulnerable version and is reachable from the internet is a discovery and validation problem before it is a patching problem, and it is exactly the gap between an asset inventory and a genuinely tested attack surface. FireCompass runs AI-native web application and API pentesting continuously rather than annually, closing the gap between when a flaw like these is disclosed and when it is confirmed exploitable in your own environment, at a false positive rate under 2 percent against the 40 to 70 percent typical of scanners. Annual pentests still cover roughly 20 percent of the surface attackers actually probe, and CVEs like Kestra’s are moving from disclosure to cryptominer deployment in days, not the weeks a point-in-time test cycle assumes.
Frequently asked questions
Which CVEs were actively exploited this week?
All ten vulnerabilities CISA added to its KEV catalog between 31 August and 6 September 2026 have confirmed in-the-wild exploitation, led by CVE-2026-49869 (Kestra, CVSS 10.0), CVE-2026-83548 (SonicWall SMA1000, CVSS 10.0), and the PaperCut NG/MF chain (CVE-2026-81578 and CVE-2026-82078).
What is the most critical CVE this week?
CVE-2026-49869, an unauthenticated remote code execution flaw in Kestra OSS, is the most critical: it is rated CVSS 10.0, requires no authentication, and CISA confirms it is already being used to deploy reverse shells and cryptocurrency miners as of its 2 September 2026 KEV addition.
Is CVE-2026-83548 being exploited?
Yes. SonicWall confirmed exploitation of this pre-authentication SSRF in the SMA1000 Work Place interface predates its public disclosure, and it was added to CISA KEV on 2 September 2026 with a federal remediation deadline of 5 September 2026.
How do I fix CVE-2026-81578?
Upgrade PaperCut MF or NG to version 24.1.10, 25.0.13, or 26.0.5, whichever branch you run, and also apply the fix for the chained flaw CVE-2026-82078 in the same update, since the two combine into a full remote code execution path.
Is the LiteLLM MCP flaw, CVE-2026-59822, being exploited?
Yes, CISA added it to the KEV catalog on 2 September 2026 with a federal remediation due date of 16 September 2026, and the fix is available in LiteLLM version 1.84.0.
How many vulnerabilities did CISA add to KEV this week?
Ten, across three batches: two on 31 August, seven on 2 September, and one on 4 September 2026. No additions were confirmed for 1, 3, 5, or 6 September in the sources checked for this report.
How should I decide what to patch first when several CVEs land in the same week?
Rank on confirmed exploitation first, then whether the flaw is reachable from the internet without authentication, and only then by CVSS or EPSS score. That is why Kestra and SonicWall SMA1000, both CVSS 10.0 and unauthenticated with confirmed active exploitation, outrank a higher-EPSS but lower-CVSS flaw like Starlette’s CVE-2026-48710 this week.
