ThreatScope by DIAMATIX:

PaperCut, NetScaler, ownCloud and Software Supply Chain Risks | August 26 – September 1, 2026

Reporting period: August 26 – September 1, 2026
Threat level: Critical

🎧 Listen to this week’s ThreatScope (audio brief)

Executive Snapshot

This week’s ThreatScope is dominated by 11 vulnerabilities newly added to the CISA Known Exploited Vulnerabilities (KEV) Catalog, including a newly exploited pre-authentication attack chain affecting PaperCut NG/MF.

The most urgent development involves CVE-2026-81578 and CVE-2026-82078 in PaperCut NG/MF. Used together, the vulnerabilities can provide a path from unauthenticated access to arbitrary Java bytecode execution on the PaperCut server.

PaperCut has confirmed customer incidents and issued a second emergency patch after additional bypasses were identified. Observed post-exploitation activity includes system reconnaissance, installation of SimpleHelp and AnyDesk remote-access software and attempts to establish persistent privileged access.

NetScaler ADC/Gateway systems operating as VPN or AAA gateways are also under active exploitation. Although the vendor describes CVE-2026-8452 primarily as a memory-overflow issue capable of causing unpredictable behaviour or denial of service, separate exploitation telemetry has reported web-shell deployment and discovery activity. Exposed vulnerable appliances should therefore be treated as potentially compromised.

Other priorities include ownCloud, where active exploitation may provide unauthenticated access to user files; an actively exploited Linux IPv6 privilege-escalation vulnerability; and JFrog Artifactory, where a Medium-severity vulnerability creates a potentially significant software-supply-chain integrity risk.

The reporting period also demonstrates that older vulnerabilities remain operationally useful. CISA added legacy issues affecting Ajax.NET Professional, Microsoft SQL Server, Linux and Red Hat after continued exploitation against internet-facing servers.

The practical lesson this week is clear: active exploitation, external exposure and the role of a system in the wider environment matter more than CVSS alone.

Is This Report Relevant to Your Organization?

This report is particularly relevant if your organisation operates any of the following technologies or environments.

If these technologies are not present in your environment, the individual vulnerabilities may not require immediate remediation. However, this week’s activity highlights three broader risks that are relevant across many organisations: control-plane compromise, software-supply-chain compromise and increasingly automated exploitation of exposed infrastructure.

Executive Summary

The reporting period saw 11 vulnerabilities newly added to the CISA KEV Catalog.

Six were added on August 26, three more on August 27 and two PaperCut vulnerabilities on August 31.

The highest-priority development is the actively exploited PaperCut NG/MF chain:

• CVE-2026-81578 allows unauthenticated modification of security-sensitive configuration;
• CVE-2026-82078 uses unsafe dynamic class loading to execute arbitrary Java bytecode.

When combined, they provide a pre-authentication remote-code-execution path.

PaperCut has confirmed customer incidents. Observed activity after exploitation includes reconnaissance, AnyDesk and SimpleHelp deployment and attempts to establish persistent privileged access.

NetScaler CVE-2026-8452 affects customer-managed ADC/Gateway systems configured as VPN or AAA gateways. The vulnerability can cause memory corruption and service disruption, while separate exploitation telemetry has reported attempts to deploy PHP web shells and execute discovery commands.

ownCloud CVE-2023-49105, with a CVSS score of 9.8, allows unauthenticated access, modification or deletion of user files under affected configurations.

Linux CVE-2026-53362 is an actively exploited IPv6 networking vulnerability that may enable a low-privileged attacker to escalate to root, corrupt kernel memory or potentially escape a container under affected configurations.

JFrog Artifactory CVE-2026-66384 provides one of the most important prioritisation lessons this week. Its CVSS score is only 5.3, but confirmed exploitation and Artifactory’s role in storing trusted packages, container images and build dependencies substantially increase its operational significance.

CISA also added several older vulnerabilities following continued exploitation against Windows and Linux web servers. Related campaign activity shows attackers combining public exploits, web shells, privilege-escalation tools and agentic AI to automate reconnaissance and post-compromise operations.

Key Vulnerabilities

Vulnerability Analysis

PaperCut NG/MF – CVE-2026-81578 and CVE-2026-82078

Status: Actively exploited / CISA KEV

The two PaperCut vulnerabilities form the highest-priority attack chain of this reporting period.

CVE-2026-81578 allows unauthenticated requests targeting administrative functions to trigger backend actions before access validation completes. This can enable modification of selected security-sensitive configuration.

CVE-2026-82078 affects database-connection functionality. Attacker-controlled configuration can cause PaperCut to dynamically load arbitrary Java classes from the application classpath and execute them with the privileges of the PaperCut server process.

Used together, the vulnerabilities provide a pre-authentication remote-code-execution path.

PaperCut has confirmed customer incidents and issued Emergency Patch Release 2 for versions 24, 25 and 26 after additional bypasses were identified. Organisations that installed the first emergency patch still need to apply the second release. Version 23 and earlier should be upgraded to a supported version.

Site and secondary servers must also be updated.

Most Relevant For

• enterprises using centralised print management;
• education;
• healthcare;
• government and public sector;
• organisations integrating PaperCut with Active Directory, LDAP, databases or other business systems.

How to Verify Exposure

Security teams should investigate for:

• pc-app.exe or pc-app launching cmd.exe, PowerShell or reconnaissance tools;
• missing, truncated or deleted server.log;
• jdbc:derby:memory:pwn;create=true;
• database errors containing VALUES CAST;
• unexpected five-character .class, .cmd or .out files in PaperCut directories;
• execution of whoami, tasklist, nltest or quser;
• unexpected AnyDesk installation;
• a Windows service named Remote Access Service running a SimpleHelp agent;
• newly created administrative accounts or unexplained configuration changes.

The absence of published indicators should not be interpreted as evidence that compromise did not occur.

Required Response

Remove PaperCut management interfaces from public exposure and install Emergency Patch Release 2 across application, site and secondary servers.

Before remediation, preserve server.log, endpoint detection and response (EDR) telemetry and relevant firewall logs.

Search for suspicious Java classes, child processes and remote-access tools. Rotate PaperCut service, database, LDAP/Active Directory and integration credentials.

Where compromise is suspected, rebuild the application server and restore from a known-clean backup rather than relying on patching alone.

NetScaler ADC/Gateway – CVE-2026-8452

Status: Actively exploited / CISA KEV / CVSS 8.8

CVE-2026-8452 affects customer-managed NetScaler ADC/Gateway systems configured as:

• SSL VPN;
• ICA Proxy;
• CVPN;
• RDP Proxy;
• AAA virtual servers.

The vendor describes the vulnerability as a memory-overflow condition that can cause unpredictable behaviour or denial of service.

However, separate exploitation telemetry has reported attempts to deploy x.php and z.php web shells and execute system-discovery commands.

This difference between the documented vulnerability impact and observed exploitation activity is operationally important. An exposed vulnerable appliance should therefore be treated as a potential compromise, not simply as an availability issue.

How to Verify Exposure

Identify:

• all internet-facing VPN and AAA virtual servers;
• affected NetScaler versions;
• unexplained appliance crashes or restarts;
• recent configuration changes;
• unexpected PHP files;
• web-shell-like behaviour;
• unusual outbound connections originating from the appliance.

Required Response

Upgrade to the corrected NetScaler release.

Review local administrator accounts and rotate LDAP, RADIUS and service credentials where necessary.

If access to certificates or private keys cannot be excluded, reissue them.

Where compromise is confirmed, rebuild the appliance using trusted firmware and configuration.

ownCloud – CVE-2023-49105

Status: Actively exploited / CISA KEV / CVSS 9.8

CVE-2023-49105 allows an unauthenticated attacker to access, modify or delete a user’s files when the username is known and the user does not have a signing key configured.

The original affected range includes ownCloud Core 10.6.0 through 10.13.0.

Because ownCloud may contain business documents, shared files and integrated storage, successful exploitation can affect both confidentiality and integrity.

How to Verify Exposure

Determine:

• whether affected ownCloud versions remain deployed;
• whether WebDAV endpoints are externally reachable;
• whether unusual file downloads, modifications or deletions occurred;
• whether abnormal pre-signed URL activity is present;
• whether administrative accounts, applications or OAuth tokens changed unexpectedly.

Required Response

Upgrade ownCloud Server to the latest supported version.

Review file activity during the exposure window and validate sensitive files against trusted backups.

If unauthorized access is suspected, rotate storage and integration credentials and review OAuth tokens and administrative accounts.

Linux IPv6 Privilege Escalation – CVE-2026-53362

Status: Actively exploited / CISA KEV / CVSS 7.8

An incorrect length calculation in the Linux IPv6 networking subsystem allows a low-privileged attacker capable of creating UDP sockets to overwrite kernel memory.

Potential consequences include:

• escalation to root;
• container escape under affected configurations;
• kernel-memory corruption;
• system crash.

Unlike the internet-facing vulnerabilities above, this is primarily a post-compromise escalation path. Its operational significance is highest on shared Linux systems, container hosts, CI/CD runners and hosting platforms where low-privileged access may already be available to users or workloads.

Required Response

Apply the corrected kernel package supplied by the operating-system vendor.

Prioritise container hosts, CI/CD runners and shared Linux servers.

Reboot systems into the corrected kernel and verify the running version. Review unexpected privilege transitions, suspicious UDP/IPv6 socket activity and evidence of container-to-host interaction.

Disabling unused IPv6 functionality may provide temporary risk reduction, but only after assessing operational dependencies.

JFrog Artifactory – CVE-2026-66384

Status: Actively exploited / CISA KEV / CVSS 5.3

CVE-2026-66384 demonstrates why CVSS should not be used as the sole measure of remediation priority.

Under specific remote Docker-repository conditions, an authenticated low-privileged user can write data outside the intended Docker cache path.

The base severity is Medium. The operational risk may be substantially higher.

Artifactory commonly stores packages, container images and build dependencies that development and deployment systems implicitly trust. Manipulated artifacts may therefore propagate from the repository into downstream CI/CD processes and production environments.

Required Response

Upgrade self-managed Artifactory to the applicable corrected release: 7.146.35 or 7.161.16.

Review low-privileged and recently created accounts, Docker remote-repository configuration and cache contents.

Compare critical artifacts against signed or trusted hashes and identify builds that consumed cached artifacts during the potential exposure window.

Rotate access tokens associated with suspicious identities and validate signing, promotion and release controls.

Legacy Exploitation Still Matters

Several older vulnerabilities were also added to CISA KEV during the reporting period:

• CVE-2021-23758 – Ajax.NET Professional: unsafe deserialization and remote code execution;
• CVE-2019-1068 – Microsoft SQL Server: code execution under the database service account;
• CVE-2022-0995 – Linux Kernel: out-of-bounds write and privilege escalation;
• CVE-2015-5287 – Red Hat ABRT: local privilege escalation;
• CVE-2015-3246 – Red Hat libuser: /etc/passwd corruption and privilege escalation.

Their age does not make them irrelevant.

Ongoing campaign activity against Windows and Linux web servers demonstrates that attackers continue to use older public exploits wherever vulnerable systems remain accessible.

Cisco Talos observed the UAT-10147 threat group using large-scale target lists, public exploits, privilege-escalation tools, web shells and agentic AI to automate reconnaissance, exploit refinement and persistence.

Observed post-compromise techniques include QuasarRAT, Gh0stCringe, BadIIS and SPECTRE malware, Windows Defender exclusions, EfsPotato privilege escalation, malicious IIS modules and scheduled tasks disguised as Chrome components.

A target list containing approximately 170,000 URLs illustrates how automation can increase the scale at which known vulnerabilities are identified and exploited.

OT/ICS Security Watch

CISA published several new industrial control system advisories on August 27.

Xiiaozet LK100W

Issues include missing authentication, weak authorisation and operating-system command injection. Versions before 2.1.240 should be updated.

All-Line Fuel-Boss

Legacy PHP and IMAP weaknesses may allow remote command or code execution. Some product variants did not have fixes available at the assessment cut-off.

Rockwell Automation OTTO Fleet Manager

Weak password hashing may facilitate offline brute-force attacks against captured password material.

Ebyte NA111-M

Multiple vulnerabilities may enable full compromise of the serial-to-Ethernet device.

These devices should not be directly accessible from the internet or general corporate-user networks.

Required OT Actions

• Inventory affected gateways, fuel-management and fleet-management systems.
• Isolate devices for which security updates are unavailable.
• Restrict web administration to dedicated engineering networks.
• Replace default and reused passwords.
• Monitor communication between serial gateways and PLCs or field devices.
• Preserve and validate configuration backups.
• Apply updates through approved OT change-control procedures.

What Deserves Attention This Week?

Print and Application Infrastructure

Priority: PaperCut NG/MF.

Focus: public exposure, Emergency Patch Release 2, compromise indicators, remote-access tooling, credentials and administrative changes.

Remote Access Infrastructure

Priority: NetScaler ADC/Gateway.

Focus: VPN and AAA exposure, unexpected restarts, web shells, configuration changes, outbound connections and credential rotation.

Collaboration and File Infrastructure

Priority: ownCloud.

Focus: externally reachable WebDAV services, file access and modification, OAuth tokens and storage credentials.

Linux and Container Infrastructure

Priority: CVE-2026-53362 and continuing legacy kernel vulnerabilities.

Focus: shared servers, container hosts, CI/CD runners, privilege transitions and running kernel versions.

Software Supply Chain

Priority: JFrog Artifactory.

Focus: repository integrity, cached artifacts, low-privileged accounts, access tokens and builds produced during the exposure period.

Operational Technology

Priority: affected gateways and management platforms covered by the August 27 CISA advisories.

Focus: segmentation, management access, credentials, firmware and configuration integrity.

Recommended Management Actions

Immediate Actions (0–7 Days)

• Identify all PaperCut NG/MF, NetScaler ADC/Gateway, ownCloud and JFrog Artifactory systems in the environment.
• Remove PaperCut management interfaces from direct public access and deploy Emergency Patch Release 2.
• Preserve PaperCut logs and endpoint telemetry and investigate published indicators before rebuilding or cleaning affected systems.
• Upgrade exposed NetScaler VPN and AAA gateways and assess them for potential compromise.
• Patch externally accessible ownCloud instances and review file access, modification and deletion activity.
• Upgrade affected self-managed JFrog Artifactory deployments and validate critical artifact integrity.
• Apply corrected Linux kernel packages for CVE-2026-53362, prioritising container hosts, CI/CD runners and shared systems.
• Identify legacy Ajax.NET Professional, SQL Server, Linux and Red Hat systems affected by newly added KEV vulnerabilities.
• Rotate credentials held by PaperCut, NetScaler, ownCloud and Artifactory where compromise or unauthorized access cannot be excluded.
• Review OT environments against the August 27 CISA advisories and isolate vulnerable devices where patches are unavailable.

Actions Within 30 Days

• Complete documented compromise assessments for every internet-exposed KEV asset.
• Validate remediation through authenticated vulnerability scanning.
• Review administrative accounts, service accounts, API tokens and integration credentials associated with affected systems.
• Assess software builds that consumed Artifactory artifacts during the exposure window.
• Strengthen integrity validation through signed packages, trusted hashes and controlled promotion processes.
• Review external exposure of print-management, VPN, file-sharing and repository infrastructure.
• Validate endpoint detection and response coverage on print, application, repository and other high-value servers.
• Update SIEM detections for suspicious Java child processes, web shells, abnormal WebDAV activity, remote-access tooling and unusual privilege transitions.
• Test restoration of PaperCut, ownCloud and Artifactory from known-clean backups.
• Review OT administrative access and segmentation between engineering systems and general corporate networks.

Strategic Actions (Within 90 Days)

• Remove unnecessary direct internet exposure from management and control-plane systems.
• Establish formal exposure-management processes that combine vulnerability data with external reachability and asset criticality.
• Incorporate active exploitation and system role into vulnerability prioritisation rather than relying primarily on CVSS.
• Strengthen software-supply-chain controls around repositories, artifact signing, promotion and build provenance.
• Review segmentation between CI/CD infrastructure, artifact repositories and production environments.
• Establish compromise assessment as a formal closure criterion for internet-exposed KEV vulnerabilities.
• Improve monitoring for remote-access tools and administrative utilities appearing unexpectedly on infrastructure servers.
• Review unsupported and legacy technologies and establish replacement or isolation plans.
• Strengthen OT segmentation and dedicated administrative pathways for field and management devices.
• Test incident-response scenarios involving control-plane compromise and software-supply-chain manipulation.

Enterprise Exposure Assessment

This week’s vulnerabilities should be assessed through four questions.

1. Was the Asset Externally Reachable?

PaperCut, NetScaler and ownCloud require substantially higher priority when their vulnerable interfaces were accessible from untrusted networks.

External exposure should therefore be established before remediation priority is determined from severity scores alone.

2. What Does the System Control or Distribute?

The affected systems occupy different but highly trusted positions.

PaperCut integrates with identity, databases and enterprise print infrastructure.

NetScaler controls remote access into internal environments.

ownCloud stores and distributes organisational files.

Artifactory distributes software artifacts and dependencies trusted by development and deployment systems.

A compromise at these layers can therefore affect systems beyond the original vulnerable asset.

3. Was Exploitation Possible Before Remediation?

For KEV-listed assets, installing the update does not establish that compromise did not occur during the exposure window.

Logs, administrative changes, credentials, persistence mechanisms and downstream systems should be reviewed before remediation is considered complete.

4. Could Downstream Trust Have Been Affected?

This question is particularly important for Artifactory.

If a repository was manipulated, teams must determine not only whether Artifactory itself is now secure, but also whether affected artifacts were consumed by builds, containers or production deployments.

The same principle applies to credentials stored by PaperCut, NetScaler and ownCloud.

Ongoing Security Controls

Beyond immediate remediation, security teams should:

• maintain an accurate inventory of internet-facing assets;
• correlate vulnerability severity with active exploitation and external exposure;
• monitor infrastructure servers for unexpected child processes and remote-access tools;
• restrict administrative interfaces to trusted management networks;
• monitor administrator and service-account changes;
• validate critical software artifacts using trusted hashes or signatures;
• review CI/CD repository and promotion permissions;
• monitor WebDAV and file-sharing platforms for abnormal activity;
• verify running kernel versions after Linux patching;
• isolate unsupported OT devices where remediation is unavailable;
• maintain trusted configuration and application backups;
• verify remediation through authenticated scanning and compromise assessment.

Questions for Leadership

Boards and executive teams should ask:

• Do we operate PaperCut, NetScaler, ownCloud or JFrog Artifactory?
• Which affected systems were accessible from the internet while vulnerable?
• Have all 11 newly added KEV vulnerabilities been mapped against our asset inventory?
• Have exposed systems been investigated for compromise after patching?
• Could compromised credentials provide access to additional systems?
• Could manipulated Artifactory content have entered software builds or production environments?
• Are legacy internet-facing applications still present in the environment?
• Are remote-access and management systems adequately isolated?
• Are vulnerable OT devices accessible from corporate-user networks?
• Can critical affected services be restored from known-clean backups?
• Which remediation exceptions remain open and who owns the associated risk?

ISO 27001 Alignment

The actions in this report support several areas of an Information Security Management System (ISMS), including:

• asset inventory and ownership;
• vulnerability and exposure management;
• identity and access management;
• secure configuration;
• network segmentation;
• logging and monitoring;
• incident response;
• software and supply-chain integrity;
• backup and recovery;
• operational technology security;
• business continuity;
• risk treatment and management review.

Evidence should be retained for remediation and compromise-assessment activities.

For internet-facing KEV assets, patch status alone should not be considered sufficient evidence of risk closure where exploitation was possible before remediation.

ISO 9001 Alignment

The response activities also support quality-management principles through:

• defined ownership;
• controlled change management;
• documented corrective actions;
• validation of remediation results;
• evidence-based decision-making;
• management review;
• continual improvement.

The objective is to confirm that corrective action has reduced operational risk rather than simply verifying that an update was installed.

Need Help Assessing Your Exposure?

If your organisation operates any of the technologies covered in this report, the first step is establishing whether affected versions and configurations are present and whether they were accessible during the exposure window.

The next step is determining whether suspicious activity occurred before remediation and whether credentials, artifacts, administrative changes or connected systems require further investigation.

DIAMATIX supports organisations with exposure assessment, continuous security monitoring, Managed Detection and Response as a Service (MDRaaS), Security Operations Center as a Service (SOCaaS) and Incident Response.

Contact our team to discuss your environment.

Conclusion

This reporting period illustrates why vulnerability management cannot be reduced to severity scores and patch installation.

PaperCut demonstrates the risk of control-plane compromise. A vulnerable print-management server can provide privileged code execution and access to credentials and connected enterprise services.

NetScaler demonstrates the importance of treating exposed remote-access infrastructure as potentially compromised when exploitation telemetry exceeds the impact described in the original vulnerability advisory.

JFrog Artifactory demonstrates the limits of CVSS-based prioritisation. A vulnerability with a Medium base score can become a significant enterprise risk when exploitation affects a trusted software repository capable of influencing downstream builds and deployments.

The continued exploitation of vulnerabilities dating back to 2015 also shows that attackers do not require new zero-days when old weaknesses remain exposed.

Finally, the observed use of automation and agentic AI increases the speed and scale at which vulnerable infrastructure can be identified, tested and exploited.

For internet-facing KEV assets, the appropriate closure sequence is therefore:

containment → patching → compromise assessment → credential rotation → downstream validation.

Installing an update is necessary. Establishing that trust can safely be restored is the actual endpoint.

Sources

• CISA Known Exploited Vulnerabilities Catalog
• PaperCut Security Advisory
• NetScaler Security Bulletin
• ownCloud Security Advisories
• Red Hat CVE Advisory
• JFrog Security Advisory
• Cisco Talos UAT-10147 Campaign Analysis
• CISA ICS Advisories – August 27, 2026

Methodology

This report is based on open-source vulnerability and threat intelligence, prioritising confirmed active exploitation, CISA KEV status, vendor advisories, external accessibility and the operational role of affected systems.

Applicability should always be validated against the organisation’s actual asset inventory, deployed versions and configuration.

The presence of a vulnerable version does not by itself confirm compromise. Likewise, successful patching does not establish that exploitation did not occur before remediation.

Trusted · Innovative · Vigilant