erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: August 27, 2026

2 editorial briefs, 3 known exploited (cisa kev) additions and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV). Every organization running PaperCut NG or MF Application, Site or secondary servers below 24.1.10, 25.0.13 or 26.0.5, and anyone on version 23 or earlier, which gets no fix.
  • Check exposure: ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV. Anyone running self-hosted ownCloud Server (core) 10.6.0 through 10.13.x, especially internet-facing instances at research bodies, universities and agencies that rarely update.
  • Do you run any of these? JFrog Artifactory, Linux Kernel, ownCloud ownCloud. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-30.
  • PyPI: 1 critical advisory (litellm). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-81578, CVE-2026-82078

PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)

If a PaperCut NG/MF server below 24.1.10, 25.0.13 or 26.0.5 was reachable from the internet after late August, assume it was compromised: upgrade, then hunt and rebuild, because this chain gave unauthenticated attackers SYSTEM and was mass-exploited.

Must act: Every organization running PaperCut NG or MF Application, Site or secondary servers below 24.1.10, 25.0.13 or 26.0.5, and anyone on version 23 or earlier, which gets no fix.

Can relax: PaperCut Hive and Pocket customers (not affected), and servers already on the maintenance releases that have been checked for compromise; Mobility Print, Print Deploy and the client software need no update.

  1. Upgrade every PaperCut NG/MF Application Server, Site Server and secondary server to 26.0.5, 25.0.13 or 24.1.10, and schedule the move off version 23 or earlier now.
  2. Restrict the Application Server's web interfaces to trusted internal addresses and remove any internet exposure.
  3. On any server that was exposed while unpatched, capture a JVM heap or memory dump and copy the logs before restarting, because in-memory web shells vanish on restart.

Read the brief →

Check exposure

· Vulnerability · CVE-2023-49105

ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV

Up-to-date ownCloud servers are fine; any ownCloud core 10.6.0 to 10.13.0 still online should be upgraded today and treated as breached, because attackers are using this bug to empty file shares.

Must act: Anyone running self-hosted ownCloud Server (core) 10.6.0 through 10.13.x, especially internet-facing instances at research bodies, universities and agencies that rarely update.

Can relax: ownCloud Infinite Scale and ownCloud.Online users, which ownCloud says are not affected, and ownCloud Server installs already on a current 10.16.x or 11.0.x release.

  1. Find every ownCloud Server instance and record its version (occ status, or /status.php over HTTPS).
  2. Upgrade anything below 10.13.3 to a current release (10.16.6 or 11.0.1), or at minimum 10.13.3.
  3. If a vulnerable instance was internet-facing, assume files were read: review WebDAV logs and tell data owners.

Read the brief →

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-66384JFrog Artifactory
JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability		2026-09-10
CVE-2026-53362Linux Kernel
Linux Kernel Unspecified Vulnerability		2026-08-30
CVE-2023-49105ownCloud ownCloud
ownCloud Improper Authentication Vulnerability		2026-08-30

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)