Weekly AppSec threat digest: PaperCut, SonicWall, Artifactory, and AI gateways

This week's most important AppSec story is not simply that another group of critical CVEs appeared. It is where they appeared. PaperCut, SonicWall SMA, JFrog Artifactory, Kestra, and LiteLLM all sit on privileged paths: they administer infrastructure, move trusted artifacts, create workflows, or connect an AI model to tools. A failure at one of these control points can reach much farther than the vulnerable HTTP request itself.

Six vulnerabilities across those products are now in CISA's Known Exploited Vulnerabilities catalog. PaperCut has confirmed customer incidents and a more sophisticated second wave. SonicWall says its SMA1000 flaws are being exploited. CISA has separately confirmed exploitation of the Artifactory, Kestra, and LiteLLM issues. The response has to combine patching, exposure reduction, evidence preservation, compromise hunting, and—in the cases where privileged execution is plausible—credential rotation or rebuilds.

What to do first

1. PaperCut: Release 3 is the floor, not the finish line

The PaperCut incident is a useful example of why severity scores must be read as an attack path rather than as isolated rows. CVE-2026-81578 is a missing-authentication flaw in the NG/MF web management interface. Under specific conditions, an unauthenticated request can reach administrative backend actions and modify selected system configuration. PaperCut scores it 8.8 under CVSS 4.0.

CVE-2026-82078 is the second half of the path. PaperCut's database utilities could instantiate a driver class selected by configuration without checking it against an allowlist. An attacker able to manipulate that configuration could execute Java bytecode already on the application classpath as the PaperCut server process. The vulnerability scores 9.4. Chained together, the first bug supplies the configuration access needed to reach the second bug's code-execution impact.

PaperCut's response moved quickly through three emergency releases. Release 3, published on 1 September for supported v24, v25, and v26 deployments, supersedes the first two releases, fixes SAML and legacy SQL-driver regressions, and adds further hardening against observed attack paths. PaperCut explicitly tells customers to install Release 3 even if an earlier emergency patch is already present. Customers on v23 or older should move to a current version.

That upgrade is containment, not proof of a clean host. PaperCut has confirmed customer incidents and says the second wave against public, incompletely patched servers shows more sophisticated post-compromise behavior. Its published investigation pivots include unexpected child shells from pc-app, missing or truncated server.log files, unexpected class or command-output files under the application directories, a suspicious Windows service named Remote Access Service, and unplanned AnyDesk installation. PaperCut warns that attackers may remove artifacts, so their absence cannot clear a server.

• Restrict the Application Server web interfaces to trusted addresses now. Do this even before the maintenance window and even when no suspicious activity is visible.
• Apply Release 3 to primary, site, and secondary servers as PaperCut directs; validate the exact build and the affected SAML or external-card-lookup workflows after the change.
• Preserve host, EDR, firewall, proxy, identity, and PaperCut logs before destructive remediation. Hunt from the first period of public exposure, not only from patch time.
• If compromise is suspected, follow PaperCut's guidance to rebuild the Application Server and restore a known-clean backup. Rotate credentials and secrets reachable from the server as part of the incident, not as an optional postscript.

2. SonicWall and Artifactory put control planes in the blast radius

SonicWall SMA1000: pre-auth SSRF on the remote-access edge

CVE-2026-83548 is a pre-authentication server-side request forgery flaw in the SMA1000 Work Place interface. SonicWall gives it a 10.0 score and says the bulletin's vulnerabilities are actively exploited. The affected platform-hotfix lines are 12.4.3-03453 and earlier and 12.5.0-02835 and earlier. Fixed builds are 12.4.3-03526 and 12.5.0-02952.

CISA added CVE-2026-83548 to KEV on 2 September with a federal due date of 5 September. The urgency comes from both reachability and position: a remote-access appliance is intentionally exposed and sits beside identities, sessions, and protected internal routes. SonicWall advises organizations to apply the latest hotfix and work with support to review indicators. If indicators are found, its guidance is to re-image hardware or redeploy virtual appliances, change user and administrator passwords, and reset TOTP tokens.

JFrog Artifactory: unauthenticated administrative access

CVE-2026-82329 is an improper-authentication vulnerability that, under the default configuration, can allow an unauthenticated network attacker to obtain administrative privileges. JFrog rates it Critical; CISA added it to KEV on 2 September and marked it for forensic triage. JFrog says affected cloud environments have already been fortified, while self-hosted customers must upgrade to the fixed build for their branch.

Administrative control of an artifact repository can have downstream consequences: the exact blast radius depends on repository permissions, build integrations, tokens, and release workflows in that deployment. Review unexpected administrators and access tokens, authentication and repository configuration changes, package uploads or overwrites, unusual downloads, and publishing activity. Then verify artifacts against trusted provenance rather than assuming a clean UI means a clean repository.

3. Kestra and LiteLLM show why AI and workflow auth bugs multiply capability

Kestra: a suffix check becomes unauthenticated worker RCE

Kestra's AuthenticationFilter intended to leave a narrow configuration endpoint public, but it used a path suffix check rather than an exact route match. Any API path whose final segment matched the trusted suffix could skip authentication. Because Kestra can create and execute workflows and ships with shell and Python execution plugins, the bypass could become unauthenticated code execution as root inside the worker container.

CVE-2026-49869 affects Kestra OSS through 1.3.20 and is fixed in 1.0.45 and 1.3.21. CISA added it to KEV on 2 September with forensic triage required. Beyond upgrading, review newly created or modified flows, execution history, namespace key-value changes, worker child processes, outbound connections, and secrets available to the worker. A container boundary may limit host impact, but it does not make the credentials and services reachable from that worker disposable.

LiteLLM: a failed key check could fall through to MCP access

CVE-2026-59822 affected LiteLLM before 1.84.0. Its MCP Streamable HTTP authentication handler supported OAuth2 passthrough for upstream MCP servers. In the vulnerable fallback, failed LiteLLM-key validation could be replaced with an empty authenticated-user object, allowing a fabricated bearer token to establish an MCP session and list or call configured tools. GitHub rates the issue High at 8.8 under CVSS 4.0.

Upgrade to 1.84.0 or later. If that cannot happen immediately, the vendor advisory says to disable MCP routes or block /mcp/ and related endpoints at the reverse proxy or API gateway. Also audit MCP session and tool-call history, map every connected service and credential the gateway could use, rotate secrets that may have been exposed, and verify the downstream systems for unexpected actions. CISA added this CVE to KEV on 2 September; its federal due date is 16 September.

The design lesson is broader than these two products. An agent gateway should fail closed when authentication is ambiguous, bind the authenticated principal to a specific tool policy, and re-authorize each sensitive action. It also needs short-lived credentials, narrow egress, immutable tool-call logs, request and cost limits, and an operator-visible kill switch. A valid session should not automatically mean permission to use every tool the runtime knows about.

4. Skyvern: the dangerous second interpretation

CVE-2026-82447 is a different kind of agentic-application failure. In Skyvern before 1.0.45, a TextPromptBlock could render attacker-influenced input twice: first through a sandboxed Jinja environment and then through an unsandboxed environment. Template syntax that survived the first pass could become executable during the second. The GitHub Advisory Database reports a High 8.7 CVSS 4.0 score and server-process code-execution impact.

This is a recurring AppSec pattern: validation at stage one says nothing about safety after stage two changes the data's meaning. The same risk appears in nested templates, generated SQL, shell wrappers, archive restores, Markdown-to-HTML pipelines, and AI systems that feed model output into another interpreter. Track taint across the entire pipeline, eliminate unnecessary second rendering, and keep every unavoidable evaluation stage sandboxed with a narrow data model.

• Upgrade Skyvern to 1.0.45 or later and verify the deployed container or package version.
• Treat workflow parameters and upstream block output as untrusted at every render, not only where they first enter the application.
• Add tests in which inert-looking output from one interpreter becomes syntax in the next; assert both rejection and lack of side effects.
• Constrain the server process and browser workers with least privilege, filesystem isolation, network policy, and secrets that are scoped to a single task.

5. WordPress: a dormant SQL payload and a 2FA bypass

All-in-One WP Migration: second-order SQL injection during restore

Jack Taylor earned a $5,761 Wordfence bounty for CVE-2026-19949, an unauthenticated second-order SQL injection in All-in-One WP Migration and Backup, a plugin with more than five million active installations. Versions through 7.109 are affected; 7.110 is the fixed release.

“Second-order” is the key. Attacker-controlled trackback data is stored in WordPress first. It becomes dangerous later when an administrator performs the plugin's normal export and import cycle and the restore pipeline reinterprets the stored data while rewriting SQL. Wordfence showed that the chain can disclose the plugin's import secret and ultimately let an attacker drive a malicious archive import, leading to remote code execution. The attacker remains unauthenticated, but execution depends on the later administrator action.

Update to 7.110 or later before performing another export or restore. Review recent trackbacks and comments, unexpected import activity, unknown administrator accounts, unfamiliar must-use plugins, and modified application files. A payload can remain dormant in stored content while the vulnerable plugin is inactive and become relevant when a later restore processes it, so “we rarely use the plugin” is not a sufficient control.

Really Simple SSL: alternate-path authentication bypass

CVE-2026-84777 is an unauthenticated 2FA bypass in Really Simple SSL through version 9.8.0, credited to Patchstack researcher Ananda Dhakal. The CVE record assigns a 7.4 High score and identifies authentication bypass through an alternate path or channel. Version 9.8.1 is marked unaffected. The public record did not report exploitation at this digest's cut-off, so it should not be described as another KEV.

Update to at least 9.8.1 and review login, password-recovery, 2FA, session, role-change, and administrator-creation events. The research lesson is to test every state transition around authentication: enrollment, challenge, recovery, remember-device behavior, API routes, and alternate login channels. The strongest primary login path does not help if another path reaches the same authenticated state without proving the second factor.

6. The weekly pattern: verify boundaries and transitions

The common denominator is not a language or framework. It is a misplaced trust transition. PaperCut trusted an administrative path too early, Artifactory and Kestra failed at an authentication boundary, LiteLLM's failed key validation fell through to an MCP identity, Skyvern reinterpreted data after a sandboxed pass, and the WordPress migration flaw turned stored content into executable SQL during a trusted maintenance operation.

For security testing, that means mapping what changes after each request rather than only fuzzing endpoints in isolation. Ask which data is stored, re-read, transformed, rendered, signed, imported, or handed to another tool. Then verify the resulting side effect from an independent vantage point. The highest-value bugs often live between two individually ordinary operations.

Defender checklist for this week

• Inventory the control planes. Find every internet-reachable PaperCut, SMA1000, Artifactory, Kestra, LiteLLM, and Skyvern deployment, including forgotten staging and disaster-recovery systems.
• Verify exact running builds. Package files, containers, clustered nodes, secondary servers, and restarted processes must all reflect the fixed version—not merely the repository or deployment manifest.
• Separate patching from incident closure. For KEV-listed or vendor-confirmed exploitation, preserve telemetry and investigate the full exposure window before declaring the asset clean.
• Map downstream authority. Enumerate tokens, repositories, tools, workflows, service accounts, internal routes, and secrets each vulnerable control plane could reach; rotate or re-validate them according to evidence.
• Test the second step. Add security cases for data that is stored and later imported, rendered twice, passed through an authentication fallback, or converted from model output into a tool action.
• Keep emergency mitigations observable. Log denied routes, WAF matches, tool calls, configuration changes, and administrative actions so a control failure leaves evidence rather than silence.

Primary sources

• PaperCut — urgent NG/MF security advisory and Emergency Patch Release 3.
• SonicWall — SMA1000 product notice SNWLID-2026-0016.
• JFrog — Artifactory security advisories and CVE-2026-82329 fixed-version matrix.
• Kestra — GHSA-5vc5-wxxq-3fjx / CVE-2026-49869; LiteLLM — GHSA-7488-6r32-c95q / CVE-2026-59822.
• CISA — Known Exploited Vulnerabilities catalog and machine-readable KEV feed.
• GitHub Advisory Database — Skyvern CVE-2026-82447.
• Wordfence — All-in-One WP Migration CVE-2026-19949 analysis.
• CVE Program — Really Simple SSL CVE-2026-84777 record.