--- title: "Security digest: August 27, 2026" url: https://erroneo.us/security/2026-08-27/ description: "August 27, 2026 vulnerability digest: 2 briefs (PaperCut NG/MF: Mass-Exploited Pre-Auth RCE…); 3 CISA KEV additions (JFrog, Linux, ownCloud); 1 critical…" type: security-digest-day section: "Security Digest" date_published: 2026-08-27 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: August 27, 2026 2 editorial briefs, 3 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Act now: PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV) . Every organization running PaperCut NG or MF Application, Site or secondary servers below 24.1.10, 25.0.13 or 26.0.5, and anyone on version 23 or earlier, which gets no fix. - Check exposure: ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV . Anyone running self-hosted ownCloud Server (core) 10.6.0 through 10.13.x, especially internet-facing instances at research bodies, universities and agencies that rarely update. - Do you run any of these? JFrog Artifactory, Linux Kernel, ownCloud ownCloud. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-30. - PyPI: 1 critical advisory ( litellm ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [PaperCut NG/MF: Mass-Exploited Pre-Auth RCE Chain (KEV)](https://erroneo.us/security/briefs/papercut-ng-mf-cve-2026-81578-82078-auth-bypass-rce/index.md): If a PaperCut NG/MF server below 24.1.10, 25.0.13 or 26.0.5 was reachable from the internet after late August, assume it was compromised: upgrade, then hunt and rebuild, because this chain gave unauthenticated attackers SYSTEM and was mass-exploited. - **Check exposure** [ownCloud CVE-2023-49105: 2023 WebDAV Bypass Now in KEV](https://erroneo.us/security/briefs/owncloud-cve-2023-49105-webdav-presigned-url-bypass-kev/index.md): Up-to-date ownCloud servers are fine; any ownCloud core 10.6.0 to 10.13.0 still online should be upgraded today and treated as breached, because attackers are using this bug to empty file shares. ## Known exploited (CISA KEV) - [CVE-2026-66384](https://erroneo.us/security/cve/CVE-2026-66384/index.md) JFrog Artifactory: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability (CISA due 2026-09-10) - [CVE-2026-53362](https://erroneo.us/security/cve/CVE-2026-53362/index.md) Linux Kernel: Linux Kernel Unspecified Vulnerability (CISA due 2026-08-30) - [CVE-2023-49105](https://erroneo.us/security/cve/CVE-2023-49105/index.md) ownCloud ownCloud: ownCloud Improper Authentication Vulnerability (CISA due 2026-08-30) ## Critical advisories - [CVE-2026-37004](https://erroneo.us/security/cve/CVE-2026-37004/index.md) LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint — PyPI litellm < 1.83.7 → 1.83.7 --- Source page: https://erroneo.us/security/2026-08-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt