August 31, 2026 | Jonathan Brown

Command View

Verification cutoff

15:42 UTC, August 31, 2026. This edition covers verified developments published or materially updated through the cutoff. August 28 stories were not carried forward unless new exploitation evidence, operational impact, affected scope, remediation, or attribution emerged.

Priority posture

  • RED: PaperCut confirms active exploitation of an unauthenticated two-vulnerability chain across PaperCut NG/MF. Boston Scientific remains operationally impaired. CISA now recognizes exploitation of ownCloud CVE-2023-49105 and JFrog Artifactory CVE-2026-66384.
  • AMBER: JFrog separately disclosed a critical unauthenticated Artifactory administrative-access flaw. ServiceNow disclosed three unauthenticated CVSS 10.0 vulnerabilities. Public attack details are available for critical Rails Active Storage flaw CVE-2026-66066. McKesson confirms third-party application access and data exfiltration.
  • WATCH: PaperCut’s normal release remains under development; its current package is an emergency patch. Boston Scientific has not supplied a full restoration timeline. McKesson has not identified the affected applications, data types, or population.
  • CONTEXT: Today’s highest-consequence events cluster around administrative platforms, artifact stores, file-sharing systems, remote management, and healthcare supply workflows. Product recovery and trust recovery are separate objectives.

Today’s decisions

  • RED — Print-platform owners: Remove public access to every PaperCut NG/MF Application Server, install Emergency Patch Release 2, and update Site Servers and secondary/print servers. Investigate formerly exposed systems before restoring trust.
  • RED — Healthcare continuity leaders: Validate Boston Scientific product availability, manual escalation paths, and the company’s current contingency guidance for new cardiac remote-monitoring activations.
  • RED — File-service owners: Move ownCloud Server 10 deployments to version 10.13.3 or obtain the vendor’s specific patch. Audit WebDAV access and verify file integrity.
  • RED — Software-supply-chain owners: Upgrade self-hosted JFrog Artifactory to the correct fixed build. Review administrators, tokens, remote repositories, cache writes, artifacts, and signing material.
  • AMBER — ServiceNow owners: Confirm the ServiceNow-deployed fix on hosted instances. Partners and self-hosted customers must apply the precise hotfix for their release branch.
  • AMBER — Application-security teams: Identify Rails applications using Active Storage with libvips and untrusted image uploads. Patch, investigate stored upload artifacts, and rotate secrets that the application process could read.
  • AMBER — Healthcare vendor managers: Map McKesson integrations and shared data involving Oncology & Multispecialty or Medical-Surgical services. Preserve SSO, API, service-account, support, and data-exchange logs.

Threat and Resilience Ledger

RED — Print-management control plane | Global — PaperCut confirms exploited pre-authentication code-execution chain

PaperCut’s August 31 update continues to identify active exploitation and confirmed customer incidents affecting all versions of PaperCut NG and MF. CVE-2026-81578 allows unauthenticated requests, under specific conditions, to modify system configuration before access validation completes. CVE-2026-82078 independently requires privileged configuration control but can execute arbitrary Java bytecode from the application classpath as the PaperCut server process. Chained together, the flaws provide an unauthenticated remote-code-execution path. Emergency Patch Release 2 mitigates both issues for versions 24, 25, and 26; customers on version 23 or earlier must upgrade first. Observed post-compromise activity includes shell execution, domain and user discovery, installation of a SimpleHelp agent as the LocalSystem “Remote Access Service,” and unexpected AnyDesk deployment. Missing indicators do not establish that a system is clean.

Evidence: Vendor-confirmed exploitation, customer incidents, reproduced vulnerability, and observed post-compromise activity.
Attribution: Unknown.
Confidence: High.
Uncertainty: The victim population, initial exploitation date, campaign structure, and complete payload set remain undisclosed. PaperCut had not completed its normal release process by the cutoff.
Sources: PaperCut — “URGENT Security Advisory: PaperCut NG/MF Security Bulletin (27 Aug 2026),” updated August 31, 2026; PaperCut — “Security Vulnerability Log,” updated August 2026; SecurityWeek — “More Details Emerge on Exploited PaperCut Vulnerabilities,” August 31, 2026.

RED — Medical-device supply and monitoring | Global — Boston Scientific disruption continues

Boston Scientific’s latest update says the August 25 incident remains limited to certain on-premises systems, with no detected unauthorized activity since August 25. Cloud applications were reportedly unaffected, but manufacturing, order processing, and shipping remain impaired. The company expects partial shipping restoration for some products during the week but has not provided a full restoration date. It reports no known effect on implanted-device function or devices already under remote cardiac monitoring. New monitoring activations remain affected: some new cardiac devices cannot activate communicators, while newly implanted insertable cardiac monitors require Clinic Assistant activation and may need in-person interrogation to transmit recorded episodes until phone pairing is restored.

Evidence: Company-confirmed cybersecurity incident, network outage, manufacturing disruption, order and shipping limitations, and remote-monitoring activation effects.
Attribution: Unknown; no verified public threat-actor claim.
Confidence: High for the disclosed operational effects.
Uncertainty: Initial access, persistence, whether data was accessed or exfiltrated, complete product impact, and full recovery time remain unknown. Statements about containment rely on the company’s ongoing investigation.
Sources: Boston Scientific — “Update on Recent Cybersecurity Incident,” latest update August 30, 2026; Boston Scientific — Form 8-K, August 26, 2026; SecurityWeek — “Boston Scientific Still Recovering From Cyberattack,” August 31, 2026.

RED — Enterprise file services | Global — CISA confirms exploitation of ownCloud authentication bypass

CISA added CVE-2023-49105 to the Known Exploited Vulnerabilities Catalog on August 27. The flaw affects ownCloud core versions 10.6.0 through 10.13.0. An unauthenticated attacker who knows a valid username can access, modify, or delete that user’s files when no signing key is configured, which is the default condition. The CVE record places the correction after 10.13.0, while ownCloud’s operational guidance directs Server 10 customers to version 10.13.3 or a specific support patch because that release contains the relevant security bundle. Infinite Scale, ownCloud.Online, and other managed services are excluded by the vendor. Updating prevents the known path but does not establish the confidentiality or integrity of previously exposed data.

Evidence: CISA-confirmed exploitation; vendor-confirmed vulnerability and remediation.
Attribution: Unknown.
Confidence: High.
Uncertainty: CISA has not identified the campaign, victim count, exploited configurations, or whether attackers used stolen files for follow-on access.
Sources: CISA — “CISA Adds Three Known Exploited Vulnerabilities to Catalog,” August 27, 2026; ownCloud — “WebDAV API Authentication Bypass Using Pre-Signed URLs,” November 21, 2023; ownCloud — “Immediate Action Required: Critical Security Updates for ownCloud,” December 1, 2023; CVE Program — “CVE-2023-49105,” updated August 27, 2026.

RED — Artifact and build infrastructure | Global — Exploited Artifactory write flaw coincides with new unauthenticated administrator bypass

Two independent Artifactory issues require different evidentiary treatment. CISA confirms exploitation of CVE-2026-66384, under which an authenticated user can write outside the intended Docker cache path under specific remote-repository conditions. Separately, JFrog disclosed CVE-2026-82329 on August 28: an authentication weakness in default configurations that may allow an unauthenticated network attacker to gain administrative privileges. No malicious exploitation of CVE-2026-82329 was established by the cutoff. Because Artifactory can control packages, build inputs, credentials, and release promotion, affected self-hosted systems require artifact and identity validation after patching. JFrog-hosted cloud environments were patched by the provider.

Evidence: CISA-confirmed exploitation of CVE-2026-66384; vendor-confirmed CVE-2026-82329 with no confirmed exploitation.
Attribution: Unknown for the exploited issue; not applicable to the vulnerability-only disclosure.
Confidence: High.
Uncertainty: CISA has not described the CVE-2026-66384 campaign. Public evidence does not establish attacks using CVE-2026-82329 or identify compromised artifacts.
Sources: CISA — “CISA Adds Three Known Exploited Vulnerabilities to Catalog,” August 27, 2026; JFrog — “JFrog Security Advisories,” updated August 28, 2026; CVE Program — “CVE-2026-66384” and “CVE-2026-82329,” August 2026.

AMBER — Healthcare distribution data | United States — McKesson confirms exfiltration through third-party applications

McKesson says unauthorized access to certain third-party applications resulted in data exfiltration involving a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. Its August 29 update said distribution centers remained operational, orders were being accepted, products continued shipping, and the company had reasonable assurance that unauthorized activity was no longer ongoing. McKesson has not named the applications, access method, affected data fields, customers, patients, or record count. Threat-actor claims about identity, access method, ransom, and data volume therefore remain unverified and are not treated as facts.

Evidence: Company-confirmed unauthorized access and data exfiltration; SEC-confirmed incident disclosure.
Attribution: Unconfirmed.
Confidence: High for the company’s disclosed facts; low for criminal claims.
Uncertainty: Affected applications, identities, data categories, time window, customer population, and downstream misuse remain unknown.
Sources: McKesson — “Customer Cybersecurity Information Center,” updated August 29, 2026; McKesson — Form 8-K, filed August 28, 2026; SecurityWeek — “McKesson Confirms Data Breach as Attacker Deadline Looms,” August 31, 2026.

AMBER — Enterprise workflow control plane | Global — ServiceNow fixes three unauthenticated CVSS 10.0 vulnerabilities

ServiceNow’s August advisory addresses three distinct vulnerabilities in the ServiceNow AI Platform. CVE-2026-18885 can permit unauthenticated code injection and arbitrary execution under certain circumstances. CVE-2026-18886 can permit unauthenticated creation or modification of instance data and privilege escalation. CVE-2026-74820 can permit unauthenticated SQL injection against the instance database. Each carries a CVSS 4.0 score of 10.0. ServiceNow patched hosted instances and supplied updates to partners and self-hosted customers. The vendor reported no known malicious exploitation, and no verified public proof of concept or victim compromise was established by the cutoff.

Evidence: Vendor-confirmed vulnerabilities and patches; no confirmed exploitation.
Attribution: Not applicable.
Confidence: High for vulnerability and remediation details.
Uncertainty: ServiceNow describes exploitation as possible “under certain circumstances” without publishing full prerequisites, limiting independent exposure validation.
Sources: ServiceNow — “August 2026 CVE Advisory Notification,” KB3152242, August 27, 2026; CVE Program — “CVE-2026-18885,” “CVE-2026-18886,” and “CVE-2026-74820,” August 2026; SecurityWeek — “ServiceNow Patches 3 Critical Code Injection Vulnerabilities,” August 31, 2026.

AMBER — Internet applications | Global — Rails Active Storage technique is public; exploitation reporting remains incomplete

CVE-2026-66066 affects Rails applications using Active Storage with libvips to process untrusted image uploads. A crafted upload can invoke unsafe libvips operations and read arbitrary files accessible to the Rails process, including environment variables and application secrets. Those secrets may then enable session forgery, remote code execution, or lateral movement; RCE is a potential escalation, not the direct result in every configuration. Rails has published detailed forensic guidance and tools for determining whether an application was vulnerable and which files may have been read. Secondary reporting attributes recent exploitation observations to VulnCheck, but no public incident record or authoritative victim details were available at the cutoff.

Evidence: Vendor-confirmed critical vulnerability, public technical path, and forensic tooling; exploitation reported but not independently substantiated.
Attribution: Unknown.
Confidence: High for vulnerability mechanics and fixed versions; moderate for current malicious exploitation.
Uncertainty: The number and identity of attacked applications, success rate, and downstream use of stolen secrets remain unknown.
Sources: Ruby on Rails — “Possible Arbitrary File Read and Remote Code Execution in Active Storage Variant Processing,” GHSA-xr9x-r78c-5hrm, July 29, 2026; Ruby on Rails — “[CVE-2026-66066] Attack Details, and Tools to Perform a Forensic Investigation,” July 31, 2026; SecurityWeek — “Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs,” August 31, 2026.

Defensive Posture Changes

Treat print-management servers as remote-management infrastructure

PaperCut’s observed compromise sequence progressed from application execution to reconnaissance and persistent remote-access tooling. Restricting the web interface and applying Emergency Patch Release 2 are necessary, but exposed systems also require process-tree, service, filesystem, log-integrity, remote-tool, account, and outbound-connection review. Rebuild from trusted media when integrity cannot be established.

Validate healthcare continuity at the workflow level

Boston Scientific’s incident demonstrates that an unaffected implant can still sit inside an impaired clinical workflow. Continuity testing must cover manufacturing, stock, ordering, shipping, communicator activation, application pairing, in-person interrogation, escalation contacts, and deferred-data reconciliation.

Reset trust around artifact and application control planes

An Artifactory administrator bypass or filesystem write can affect much more than the server. Review administrative identities, access tokens, remote repositories, cached artifacts, build provenance, promotion history, signing keys, and downstream deployments. Apply the same principle to Rails secrets and ownCloud file integrity.

Demand integration-level scope from suppliers

“Third-party application” is not enough information for a customer impact decision. Vendor-management teams should be able to map each supplier to federated identities, API credentials, exchanged files, support systems, data categories, retention periods, and an internal owner before an incident occurs.

Regional and Sector Pulse

Global enterprise infrastructure — RED

PaperCut, ownCloud, and self-hosted JFrog deployments create global exposure across education, government, healthcare, software development, and large enterprises. Only the disclosed PaperCut incidents and KEV-designated ownCloud and Artifactory flaws carry confirmed-exploitation status.

North American healthcare — RED

Boston Scientific’s continuing manufacturing, shipping, and monitoring-activation disruption creates confirmed availability consequences. McKesson’s incident establishes confidentiality risk to healthcare customers, but its distribution operations remained available at the cutoff.

Europe and United Kingdom — WATCH

The globally affected products are present across the region, but no separate August 31 operational incident passed the verification threshold. Product exposure must not be presented as evidence of a regional campaign.

Indo-Pacific — WATCH

PaperCut is headquartered in Australia, but the vendor has not published a geographic victim distribution. No evidence supports characterizing the exploitation as an Australia- or Asia-focused campaign.

Middle East, Africa, Latin America, and Caribbean — WATCH

The product vulnerabilities apply globally. Reviewed public evidence did not establish a distinct campaign or operational critical-infrastructure incident in these regions by the cutoff.

Vulnerability and Supplier Watchlist

PaperCut NG and MF

Issue: CVE-2026-81578 authentication bypass chained with CVE-2026-82078 unsafe dynamic class loading.
Affected scope: PaperCut says all NG/MF versions are potentially affected. CVE records identify affected branch builds before 24.1.10, 25.0.13, and 26.0.5.
Fixed release: Emergency Patch Release 2 for versions 24, 25, and 26; earlier customers must upgrade. A normal official release was still under development.
Severity: CVSS 4.0 scores 8.8 High and 9.4 Critical.
Status: RED — confirmed active exploitation and customer compromise.

ownCloud Server

Issue: CVE-2023-49105, WebDAV pre-signed URL authentication bypass.
Affected scope: ownCloud core 10.6.0 through 10.13.0 when the victim has no signing key configured. Infinite Scale and vendor-managed services are excluded.
Fixed release: Vendor remediation target is ownCloud Server 10.13.3 or the specific support patch.
Severity: CVSS 3.1 score 9.8, Critical.
Status: RED — CISA KEV; confirmed exploitation.

JFrog Artifactory

Issue: CVE-2026-66384, authenticated Docker-cache path write; CVE-2026-82329, potential unauthenticated administrative access.
Affected scope: CVE-2026-66384 affects builds before 7.146.35 and 7.161.0–7.161.15. CVE-2026-82329 affects builds before 7.111.21 and specified 7.117, 7.125, 7.133, 7.146, and 7.161 branch thresholds.
Fixed release: For CVE-2026-82329: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20. These later targets also supersede the CVE-2026-66384 fixes on applicable maintained branches.
Severity: CVE-2026-82329 is Critical, CVSS 3.1 score 9.8; CVE-2026-66384 is Medium.
Status: RED — confirmed exploitation applies only to CVE-2026-66384; no verified exploitation of CVE-2026-82329.

ServiceNow AI Platform

Issue: CVE-2026-18885 code injection, CVE-2026-18886 improper access control, and CVE-2026-74820 SQL injection.
Affected scope: Vulnerable Xanadu, Yokohama, Zurich, and Australia release branches before their designated hotfixes.
Fixed release: Xanadu Patch 11 Hot Fix 7a; Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4; Zurich Patch 7b Hot Fix 3, Patch 8 Hot Fix 5, Patch 9 Hot Fix 6, Patch 10 Hot Fix 2m/3, Patch 11, or Patch 12; Australia Patch 2 Hot Fix 3, Patch 3 Hot Fix 2, Patch 3m, Patch 4, or Patch 5.
Severity: CVSS 4.0 score 10.0 for each vulnerability.
Status: AMBER — critical and remotely reachable, but no confirmed exploitation.

Ruby on Rails Active Storage

Issue: CVE-2026-66066, arbitrary file read with possible RCE or lateral movement through stolen secrets.
Affected scope: Active Storage before 7.2.3.2, versions 8.0 through 8.0.5, and versions 8.1 through 8.1.3 where applications use libvips and accept untrusted image uploads. Older Rails configurations may be exposed when vips was enabled manually.
Fixed release: Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1, with libvips 8.13 or later.
Severity: CVSS 4.0 score 9.5, Critical.
Status: AMBER — public attack path and reported exploitation, but no independently confirmed victim compromise.

Outlook and Uncertainty

Next 24 hours

Watch for PaperCut’s official release, additional indicators, KEV action, or evidence of ransomware and data theft; Boston Scientific restoration milestones; identification of McKesson’s affected applications and data; and credible exploitation evidence for JFrog CVE-2026-82329, the ServiceNow trio, or Rails CVE-2026-66066.

What is not known

The PaperCut victim population and complete post-compromise activity remain unresolved. Boston Scientific has not disclosed initial access, data impact, or a full restoration date. McKesson has not identified the affected applications or stolen data. The current ownCloud and Artifactory exploitation campaigns remain undescribed. Public reporting does not yet substantiate successful ServiceNow exploitation or fully document the reported Rails activity.

Trigger for escalation

Escalate immediately upon finding PaperCut log tampering, suspicious pc-app child processes, SimpleHelp or AnyDesk installation; unauthorized ownCloud file access or modification; unexpected Artifactory administrators, tokens, cache writes, or altered artifacts; Rails forensic evidence of crafted uploads or file reads; or unauthorized ServiceNow data and privilege changes. Escalate healthcare continuity measures if Boston Scientific restoration slips, product availability deteriorates, or remote-monitoring contingencies cannot be maintained.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.

© 2026 Border Cyber Group. All rights reserved.

  1. PaperCut NG/MF Exploitation Chain (CVE-2026-81578 / CVE-2026-82078)
    PaperCut Official Advisory: https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/

PaperCut Release Notes & Patch History: https://www.papercut.com/products/mf/release-history/

Rapid7 Emergency Threat Response Analysis: https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild/

SecurityWeek Coverage: https://www.securityweek.com/more-details-emerge-on-exploited-papercut-vulnerabilities/

NIST National Vulnerability Database CVE-2026-81578): [https://nvd.nist.gov/vuln/detail/CVE-2026-81578

  1. Boston Scientific Operations & Patient Services Disruption
    Boston Scientific Official Incident Update Page: https://news.bostonscientific.com/update-on-recent-cybersecurity-incident

SEC Form 8-K Disclosure (Boston Scientific): https://investors.bostonscientific.com/financials-and-filings/sec-filings

SecurityWeek Incident Report: https://www.securityweek.com/boston-scientific-still-recovering-from-cyberattack/

  1. ownCloud Core WebDAV Pre-Signed URL Flaw (CVE-2023-49105)
    CISA Known Exploited Vulnerabilities (KEV) Catalog
  2. ownCloud Official Security Advisory (WebDAV Pre-Signed URLs): https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/

ownCloud Security Action Notice: https://owncloud.com/news/immediate-action-required-critical-security-updates-for-owncloud/

NIST National Vulnerability Database (CVE-2023-49105): https://nvd.nist.gov/vuln/detail/CVE-2023-49105

  1. JFrog Artifactory Vulnerabilities (CVE-2026-66384 & CVE-2026-82329)
    JFrog Official Security Advisories Hub: https://jfrog.com/help/r/jfrog-security-advisories/

CISA KEV Entry for CVE-2026-66384

IONIX Technical Vulnerability Analysis (CVE-2026-82329): https://www.ionix.io/threat-center/cve-2026-82329/

NIST National Vulnerability Database (CVE-2026-82329): https://nvd.nist.gov/vuln/detail/CVE-2026-82329

  1. McKesson Customer Data Exfiltration Incident
    McKesson Customer Cybersecurity Information Center: https://www.mckesson.com/cybersecurity/

SEC Form 8-K Disclosure (McKesson): https://www.sec.gov/edgar/browse/?CIK=0000927653

SecurityWeek Data Breach Report: https://www.securityweek.com/mckesson-confirms-data-breach-as-attacker-deadline-looms/

  1. ServiceNow AI Platform Critical Vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820)
    ServiceNow Knowledge Base Advisory (KB3152242): https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242

SecurityWeek Vulnerability Coverage: https://www.securityweek.com/servicenow-patches-3-critical-code-injection-vulnerabilities/

NIST National Vulnerability Database (CVE-2026-18885): https://nvd.nist.gov/vuln/detail/CVE-2026-18885

  1. Ruby on Rails Active Storage Flaw (CVE-2026-66066)
    GitHub Security Advisory (GHSA-xr9x-r78c-5hrm): https://github.com/advisories/GHSA-xr9x-r78c-5hrm

Ruby on Rails Official Security Announcement: https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441

Rapid7 Technical Vulnerability Analysis (KindaRails2Shell): https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails/

SecurityWeek Analysis: https://www.securityweek.com/critical-ruby-on-rails-vulnerability-in-attackers-crosshairs/