Threat Intelligence Briefing

Tuesday, September 1, 2026 | Jonathan Brown

PaperCut publishes third emergency patch as active exploitation continues

PaperCut published Emergency Patch Release 3 on September 1 for an actively exploited vulnerability chain affecting all versions of PaperCut NG and PaperCut MF. The company has confirmed customer incidents and says the new release closes additional attack vectors observed in the wild, while also correcting SAML and legacy Microsoft SQL Server compatibility regressions introduced by earlier emergency patches.

The chain combines CVE-2026-81578, a CVSS 8.8 authentication bypass that allows unauthenticated requests to alter certain system configurations, with CVE-2026-82078, a CVSS 9.4 unsafe dynamic-class-loading flaw. Once the configuration is manipulated, the second vulnerability can execute arbitrary Java bytecode from the application classpath under the PaperCut server process. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on August 31 and set a September 14 remediation deadline for federal civilian agencies.

Release 3 supersedes the first two emergency patches. The corrected builds are PaperCut MF 76531 for version 26, 76532 for version 25, and 76534 for version 24; and PaperCut NG 76530 for version 26, 76533 for version 25, and 76535 for version 24. Customers running version 23 or earlier must upgrade to a current release. Site Servers and secondary print servers also require updating, while Mobility Print, Print Deploy server and client components, PaperCut Hive, and PaperCut Pocket are not affected.

PaperCut says this remains an emergency release that has not completed its usual maintenance-release process. Internet-facing web interfaces should therefore be restricted to trusted addresses immediately, even after an earlier emergency patch was installed. Hunt for child command shells launched by pc-app, deleted or truncated server logs, five-character class, command, or output files, the SimpleHelp Remote Access Service, unexpected AnyDesk installations, and reconnaissance commands including whoami, tasklist, nltest, and quser. Suspected Application Servers should be wiped, rebuilt, and restored from a verified pre-incident backup; the absence of published indicators does not establish that a server is clean.

Watch for: Further patch revisions, the planned quality-assured maintenance release, newly validated indicators, unexplained configuration changes, remote-access tooling, and secondary servers missed during remediation.

Sources: PaperCut, Urgent Security Advisory: PaperCut NG/MF Security Bulletin, updated September 1, 2026; CISA, Adds Two Known Exploited Vulnerabilities to Catalog, August 31, 2026.

JFrog Artifactory authentication bypass is reportedly under exploitation

JFrog disclosed CVE-2026-82329 on August 28, assigning the authentication weakness a critical CVSS score of 9.8. Under Artifactory’s default configuration, an unauthenticated attacker with network access can obtain administrative privileges on an affected self-hosted instance.

On September 1, watchTowr reported observing exploitation in which attackers minted administrator tokens. That is a credible but currently single-source exploitation report: JFrog had not independently confirmed the activity, SecurityWeek found no second exploitation report, and CISA had not added CVE-2026-82329 to its Known Exploited Vulnerabilities catalog at publication. Public reporting has not disclosed the exploit method or released proof-of-concept code.

JFrog Cloud environments have already been fortified and require no customer action for this vulnerability. Self-hosted customers should upgrade to the fixed release for their branch: 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20.

Administrative control of Artifactory could allow access to stored credentials and the modification or deletion of packages, binaries, containers, or other build inputs. Defenders should review administrator-token issuance, newly created privileged identities, permission and configuration changes, artifact writes or deletions, and downstream builds that consumed content after the suspected compromise time. Secrets accessible from a confirmed compromised instance should be rotated.

Watch for: Independent confirmation of exploitation, CISA catalog inclusion, unauthorized administrator tokens, altered artifacts, credential access, and downstream software built from untrusted repository content.

Sources: JFrog Security Advisories, CVE-2026-82329, August 28, 2026; watchTowr exploitation observation, September 1, 2026; SecurityWeek, Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild, September 1, 2026.

Langflow code-execution flaw moves from disclosure to observed exploitation

VulnCheck reported on September 1 that attackers were exploiting CVE-2026-0768, a critical unauthenticated remote-code-execution vulnerability in Langflow. The flaw involves insufficient validation of the code parameter supplied to a validation endpoint before that content is executed as Python. Trend Micro’s Zero Day Initiative says successful exploitation can execute code as root on the affected installation.

The vulnerability was reported to Langflow in July 2025 and disclosed by the Zero Day Initiative as a zero-day advisory on January 9, 2026. The official CVE record identifies version 1.4.2 as affected, while SecurityWeek reports that releases through 1.4.2 are vulnerable. Neither the CVE record nor the original Zero Day Initiative advisory provides a vendor-confirmed fixed-version boundary, so version 1.4.3 should not be treated as a validated safety threshold solely on that basis.

VulnCheck developed a functional exploit, version scanner, packet captures, and detection rules for its commercial intelligence service, and identified just under 2,500 internet-exposed Langflow instances. That establishes functional exploitability but is not evidence that public proof-of-concept code has been released. Langflow 1.11.6 is the latest upstream release as of September 1 and incorporates the later security hardening that removed code execution from the validation function.

Observed activity included queries for environment variables, secret keys, and SSH access. VulnCheck recorded more than 360 attempts against United Kingdom-based canaries by August 31, with many source addresses geolocated to Russia. Source-address geography does not establish attacker nationality or attribution. Organizations should remove Langflow from unnecessary public exposure, upgrade to the latest supported release, hunt for suspicious validation requests and Python or shell processes, and rotate secrets accessible to any suspected instance.

Watch for: CISA catalog inclusion, vendor clarification of the full affected-version range, broader exploitation telemetry, credential theft from AI workflows, SSH persistence, and confirmed downstream cloud or database access.

Sources: Trend Micro Zero Day Initiative, ZDI-26-034, January 9, 2026; VulnCheck Initial Access Intelligence, August 28, 2026; Langflow upstream releases, accessed September 1, 2026; SecurityWeek, Hackers Start Exploiting Critical Langflow Vulnerability, September 1, 2026.

WatchGuard patches critical Fireware and Dimension vulnerabilities

WatchGuard disclosed more than two dozen vulnerabilities on August 27, including five critical flaws. Three affect the Fireware Internet Key Exchange daemon: CVE-2026-19313, a heap buffer overflow; CVE-2026-19318, a stack buffer overflow; and CVE-2026-19315, a type-confusion vulnerability. Each carries a CVSS 4.0 score of 9.3 and can be reached without authentication by crafted IKE traffic, producing daemon crashes and a potential path to remote code execution.

Exploitability is not identical across the three flaws. CVE-2026-19318 requires the supported IKE payload diagnostic-logging option to be enabled; an attacker must complete the initial IKE security-association exchange before supplying a malicious authentication message containing an EAP-MSCHAPv2 payload. CVE-2026-19315 is triggered through a crafted authentication message containing two EAP payloads. WatchGuard’s public advisory does not identify an equivalent configuration precondition for CVE-2026-19313.

The Fireware updates also correct CVE-2026-13086, a critical stack overflow in the deprecated Mobile Security Endpoint Protection Manager service. Exploitation requires network-adjacent access through a trusted interface but can provide unauthenticated root code execution. Separately, Dimension 2.3.1 fixes CVE-2026-78174, which allows a low-privileged Dimension administrator to retrieve an active super-administrator’s session and cross-site-request-forgery tokens from diagnostic logs and take over the account.

Affected default Fireware branches are versions 2025.0 through releases before 2026.2.2 and version 12 releases before 12.12.2. T15 and T35 appliances running version 12 require 12.5.20. Dimension versions 2.0 through releases before 2.3.1 are vulnerable to the session-token flaw. WatchGuard reports no known exploitation of these vulnerabilities. Organizations should patch promptly, prioritize appliances accepting untrusted IKE traffic, disable diagnostic logging when it is not operationally required, and monitor for abnormal IKE exchanges, repeated daemon respawns, appliance instability, and unauthorized administrative changes.

Watch for: Exploit development, scanning of exposed IKE services, repeated daemon failures, abuse of diagnostic logs, unauthorized Dimension accounts, and any change to WatchGuard’s exploitation assessment.

Sources: WatchGuard Product Security Incident Response Team advisories, August 27, 2026; SecurityWeek, WatchGuard Patches Critical Vulnerabilities, September 1, 2026.

Firefox 155 closes sandbox escapes and memory-safety vulnerabilities

Mozilla released Firefox 155 on September 1 with fixes for ten individually identified high-impact vulnerabilities, CVE-2026-84117 through CVE-2026-84126. These include an Android privilege-escalation flaw, multiple use-after-free defects, two sandbox escapes, a WebGPU privilege-escalation path, and an incorrect boundary-condition flaw in grid layout processing.

Mozilla also assigned three high-impact aggregate identifiers to internally discovered security defects. CVE-2026-84143 is fixed in Firefox 155, Firefox Extended Support Release 153.2, and Extended Support Release 140.15. CVE-2026-84144 is fixed in Firefox 155 and Extended Support Release 153.2. CVE-2026-84145 is fixed in Firefox 155 and Extended Support Releases 153.2, 140.15, and 115.40.

Mozilla found evidence of memory corruption or other security-relevant defects in these aggregate groups and presumes that some could be exploited with sufficient effort. The advisory does not report active exploitation. Organizations should deploy Firefox 155 or the appropriate supported Extended Support Release update and verify installation through browser-management telemetry rather than relying solely on automatic-update configuration.

Watch for: Exploit demonstrations, targeted browser attacks, incomplete Extended Support Release deployment, and endpoints remaining on unsupported Firefox branches.

Sources: Mozilla Foundation Security Advisory 2026-82, September 1, 2026.

NovoCure discloses patient and contact-data exposure

NovoCure disclosed in a September 1 Securities and Exchange Commission filing that it became aware of unauthorized access to some of its information systems in mid-August. The filing says the company acted through a subsidiary in detecting and responding to the incident; it does not establish that the subsidiary was the attacker’s entry point.

The accessed data included internal company patient identifiers for more than 1,400 United States patient records. NovoCure says those identifiers are used only internally and were not accompanied by patient names or other identifying information. Fewer than 50 additional patients in the western United States had other identifying data exposed. General contact information for healthcare providers and NovoCure employees, including employee job titles and telephone numbers, was also affected.

NovoCure says no medical-treatment devices were accessed, its ability to operate was not compromised, and its systems are fully functional. The company does not currently expect a material financial or operational effect, but the investigation and regulatory-notification assessment remain open. The filing does not identify an attacker, initial-access mechanism, ransomware deployment, extortion demand, or exact duration of unauthorized access.

Watch for: Expansion of the affected population or data categories, patient notifications, regulatory action, identification of the initial-access method, and phishing or impersonation attempts using exposed contact information.

Sources: NovoCure, Form 8-K, September 1, 2026; Reuters, Oncology Firm NovoCure Says Cyberattack Exposed U.S. Patient Records, September 1, 2026.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.