Weekly AppSec Threat Digest — Sep 4–11, 2026

The most defining pattern of this week's vulnerability landscape is uncomfortable: the systems organizations deploy to administer, operate, sell through, and protect their networks have themselves become the primary initial-access vector.

Over the past seven days, active exploitation in the wild was confirmed for a CVSS 10.0 arbitrary code execution flaw in Adobe Commerce and Magento, while CISA added an unauthenticated remote code execution zero-day in N-able's N-central RMM platform and an exploited Chrome V8 out-of-bounds write to the Known Exploited Vulnerabilities (KEV) catalog. Simultaneously, SAP released emergency updates for two critical flaws—including a CVSS 10.0 pre-auth memory corruption vulnerability in its Extended Passport parser—and Check Point disclosed dual pre-auth RCE vulnerabilities in its internet-facing VPN gateways.

Compounding the risk, new telemetry published by watchTowr demonstrated threat actors reproducing full remote code execution on honeypots in under five seconds following patch releases. The traditional assumption that defenders have a comfortable one-to-two week patch window against public-facing enterprise software is officially dead.

What to do first: September 4–11 Action Matrix

1. High-Severity CVEs

CVE-2026-75650 — Adobe Commerce / Magento (CVSS 10.0, Actively Exploited)

On September 7, Adobe released an emergency security bulletin (APSB26-146) disclosing a critical arbitrary code execution vulnerability affecting Adobe Commerce, Commerce B2B, and Magento Open Source across multiple 2.4.x release trains (including 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, and 2.4.4-p9).

Adobe explicitly confirmed that exploitation has been observed in the wild. The operational urgency is intensified by a critical deployment caveat: applying Adobe's standard September release alone does not protect your store. Adobe has shipped an isolated, dedicated hotfix that must be applied on top of or directly to the affected codebase.

Because Magento architectures process unauthenticated checkout and shopping cart requests via REST and GraphQL, this arbitrary code execution vector grants attackers access under the web-server user. In past campaigns, attackers have leveraged similar Magento primitives to deploy in-memory web shells, exfiltrate customer databases, and dynamically inject credit card skimmers (Magecart) directly into checkout forms.

Remediation: Immediately verify that Adobe's dedicated hotfix is active on every production and staging environment. Review web server access logs for anomalous POST requests hitting API endpoints, inspect var/log/exception.log, and audit theme files and database tables (specifically core_config_data and CMS blocks) for newly inserted external JavaScript tags.

CVE-2026-86218 — N-able N-central (Critical, Pre-Auth RCE / CISA KEV)

On September 6, N-able released Hotfix 4 for N-central 2026.3, remediating an unauthenticated remote code execution flaw affecting all versions prior to 2026.3.1.14. Following confirmation of active exploitation in the wild, CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on September 9.

This vulnerability represents an existential threat to Managed Service Providers (MSPs) and distributed enterprises. Remote Monitoring and Management (RMM) appliances exist to execute administrative tasks with high privileges across thousands of client workstations and servers. An attacker who obtains root or administrative execution on the central N-central server can pivot downstream through trusted agent connections, transforming the management plane into an automated ransomware deployment engine.

Remediation: Immediately upgrade all on-premises N-central instances to 2026.3 HF4 (version 2026.3.1.14+). Block public internet access to N-central administrative interfaces, restricting ingress strictly to trusted corporate VPNs or allowlisted management IPs. Perform incident response hunting across server logs, searching for unusual child processes spawned by the N-central service (such as cmd.exe, powershell.exe, or /bin/sh) and anomalous outgoing network sessions.

CVE-2026-44756 “OVERPASS” — SAP Extended Passport (CVSS 10.0)

On September 8, SAP's monthly security patch day was dominated by Security Note 3759472 and the disclosure of CVE-2026-44756, dubbed “OVERPASS” by researchers. The flaw is a critical memory-corruption vulnerability in the SAP Extended Passport (EP) handler.

Extended Passport is an internal SAP tracking and tracing mechanism that carries distributed context across multi-tier SAP components. Crucially, the vulnerable parser is reachable prior to authentication across virtually every SAP-facing network protocol:

• HTTP and HTTPS via SAP Web Dispatcher and the Internet Communication Manager (ICM).
• DIAG protocol (SAP GUI ports 3200–3299).
• RFC protocol (Remote Function Call ports 3300–3399).

By transmitting specially crafted Extended Passport byte sequences, a remote, unauthenticated attacker can trigger memory corruption that leads directly to arbitrary OS command execution under the SAP service account (<sid>adm). Because DIAG and RFC traffic frequently bypasses traditional HTTP-only Web Application Firewalls, perimeter WAF filtering alone cannot protect internal or exposed SAP instances.

Remediation: Patch the underlying SAP Kernel and Web Dispatcher binaries to the target patch levels specified in SAP Note 3759472. Do not rely solely on network perimeter rules.

CVE-2026-58240 “S4GET” — SAP NetWeaver Message Server (CVSS 9.8)

The second critical SAP flaw disclosed this week is CVE-2026-58240 (“S4GET”), carrying a CVSS score of 9.8. This flaw resides in the NetWeaver Message Server—the core component responsible for coordinating internal application servers within an SAP system.

A missing authentication check allows an unauthenticated remote attacker with network access to the Message Server port (36NN or 39NN, where NN is the instance number) to send crafted control messages. The attacker can register a rogue application server node into the SAP cluster, poison load-balancing and routing tables, intercept inter-process communication, and obtain trusted-node privileges that culminate in OS command execution.

Remediation: Ensure Message Server ports are strictly segregated from user networks and the public internet. Apply the patch from SAP Security Note 3759472 to enforce cryptographic validation of cluster nodes.

CVE-2026-85102 & CVE-2026-85103 — Check Point VPN (CVSS 9.8)

CERT-EU issued advisory 2026-012 highlighting two critical vulnerabilities in Check Point Security Gateway and Management Server VPN processing. Both CVE-2026-85102 and CVE-2026-85103 allow unauthenticated remote code execution on the underlying Gaia OS.

The flaws stem from memory safety vulnerabilities during certificate validation and ASN.1 structure parsing in the VPN daemon. Because the vulnerable code path executes during the initial cryptographic handshake before an identity is authenticated, any attacker capable of reaching the gateway's public VPN ports can trigger the vulnerability. Both Remote Access VPN and Site-to-Site VPN deployments are exposed.

Remediation: Check Point has released Jumbo Hotfixes and Live Patches for supported releases. Network teams should deploy these hotfixes immediately across all external-facing security gateways.

CVE-2026-87491 — Google Chrome V8 (CVSS 8.8, Actively Exploited)

Google released Chrome 153.0.8010.36 to resolve CVE-2026-87491, an out-of-bounds write vulnerability in the V8 JavaScript and WebAssembly engine. Google acknowledged active exploitation in targeted attacks, prompting CISA to add the vulnerability to KEV on September 9.

By tricking a user into navigating to a malicious web page, an attacker can trigger memory corruption inside the browser renderer process and execute arbitrary code. In enterprise environments, browser zero-days are frequently chained with sandbox escapes to target high-privilege engineers and administrators.

Remediation: Accelerate fleet-wide deployment of Chrome 153.0.8010.36 or higher, prioritizing systems used by IT, cloud, and security administrators.

2. Web App Security Research

watchTowr: PaperCut Weaponization in Under Five Seconds

Security research firm watchTowr published a technical analysis of recent in-the-wild attacks against PaperCut NG/MF (CVE-2026-81578 and CVE-2026-82078). Deploying high-interaction honeypots, watchTowr observed automated exploit scripts that achieved remote code execution, reconfigured the server's user-lookup connector, executed an in-memory payload, and restored the original configuration—all within a five-second window.

The attack sequence highlights modern adversary tradecraft:

• Zero-interaction entry: The authentication bypass (CVE-2026-81578) is invoked to reach administrative APIs without credentials.
• Transient reconfiguration: The attacker modifies the external user directory connector to point to a custom driver.
• Class-loading execution: Unsafe class loading (CVE-2026-82078) instantiates the attacker's payload directly in JVM memory.
• Anti-forensic cleanup: The connector is immediately reset to its original state, leaving zero traces in the UI configuration.

The strategic lesson for security teams is profound: the “patch within a week” metric is obsolete. Adversaries automated the diffing, weaponization, and scanning pipeline within hours of the patch dropping. Public-facing enterprise software cannot remain directly exposed on the open internet without zero-trust reverse proxies or continuous exploit verification.

GitHub Security Lab: CI/CD TOCTOU in Jupyter Maintainer Tooling (CVE-2026-84973)

GitHub Security Lab disclosed GHSL-2026-203, detailing CVE-2026-84973 in jupyterlab/maintainer-tools (update-snapshots-checkout). The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition arising from the resolution of commit timestamps.

GitHub commit timestamps have only one-second precision. When maintainer tooling validated whether a pull request branch had changed since approval, an attacker pushing a new commit in the exact same second could slip unauthorized code through the verification gate while preserving the approval state.

3. Bug Bounty Highlights (NASA Disclosures)

NASA International Mass Loading Service: Unauthenticated OS Command Injection (Bugcrowd P1)

A publicly disclosed NASA Vulnerability Disclosure Program (VDP) report on Bugcrowd identified an unauthenticated OS command injection vulnerability in the International Mass Loading Service endpoint at massloading.smce.nasa.gov/cgi-bin/eop_series.py.

The legacy Python CGI script accepted HTTP query string parameters and passed them directly into shell execution without sanitization or parameterization:

# Vulnerable legacy CGI pattern in eop_series.py
import cgi, os

form = cgi.FieldStorage()
series_type = form.getvalue("series")  # User controlled query parameter

# Direct shell interpolation allows command chaining with ; or |
cmd = f"/usr/local/bin/calc_eop --series {series_type}"
os.system(cmd)

An attacker supplying ?series=test;id; obtained immediate shell command execution under the web-server user account. NASA validated and remediated the flaw, and Bugcrowd awarded it a P1 Critical rating.

NASA Harmony Trajectory Subsetter: Authenticated GeoJSON Command Injection → Root RCE (Bugcrowd P1)

A second NASA disclosure revealed a subtle yet common engineering pitfall in the Harmony Trajectory Subsetter at harmony.earthdata.nasa.gov. Any user with a free NASA Earthdata account could execute arbitrary commands as root in the production processing container.

The application accepted a user-supplied GeoJSON payload via the subset=shape(...) parameter. To process the shape, the backend serialized the user object with json.dumps() and interpolated the string into a shell command invocation:

# VULNERABLE: False sense of security from json.dumps()
user_shape = request.json.get("shape")

# Developer assumed valid JSON is safe from shell injection
json_str = json.dumps(user_shape)

# BUT string interpolation inside single quotes with shell=True is exploitable:
cmd = f"/opt/subsetter/bin/process --shape '{json_str}' --output /tmp/out.nc"
subprocess.run(cmd, shell=True)

The fundamental fallacy is that json.dumps() escapes JSON syntax, not shell syntax. When a user placed a single quote followed by shell metacharacters inside a GeoJSON property value (e.g. {"type": "Point", "desc": "'; /bin/sh -c 'id' #"}), json.dumps() produced a valid JSON string that contained an unescaped single quote. When evaluated by /bin/sh, the single quote closed the literal string, and the payload executed with root privileges.

The safe engineering pattern requires passing arguments as an array and disabling the shell interpreter altogether:

# SECURE: Argument array with shell=False
user_shape = request.json.get("shape")
json_str = json.dumps(user_shape)

# Arguments are passed directly to execve(); shell meta-characters are inert
subprocess.run(
    ["/opt/subsetter/bin/process", "--shape", json_str, "--output", "/tmp/out.nc"],
    shell=False,
    check=True,
)

4. The Systemic Pattern: Control Planes as the Breachhead

Looking at this week's CVEs and research side by side, a unified picture emerges. Attackers are not hunting for obscure multi-hop pivots when they can attack the control plane directly:

• E-commerce management: Magento CVE-2026-75650 turns public shopping traffic directly into database and checkout access.
• IT management: N-central CVE-2026-86218 turns the MSP management server into a distributor of downstream endpoint malware.
• Enterprise ERP: SAP OVERPASS and S4GET convert unauthenticated requests into core business process takeover.
• Perimeter security: Check Point CVE-2026-85102 and 85103 turn the firewall VPN gateway into an unauthenticated entrypoint.

When patch diffs are weaponized in seconds and public endpoints are cataloged continuously by adversaries, point-in-time annual audits cannot keep pace. Defenders require continuous, exploit-verified penetration testing that probes exposed perimeters, flags unauthenticated command injection in real time, and proves risk before adversaries weaponize it.

5. Sources & Primary Advisories

• Adobe — Security Advisory APSB26-146 for Adobe Commerce and Magento Open Source
• N-able — N-central 2026.3 Hotfix 4 Advisory (CVE-2026-86218)
• SAP Support Portal — SAP Security Patch Day September 2026 (Notes 3759472 & OVERPASS)
• CERT-EU — Security Advisory 2026-012: Check Point Security Gateway & Management Server Flaws
• CSIRTS — Google Chrome V8 Vulnerability Advisory (CVE-2026-87491)
• watchTowr — PaperCut NG/MF Technical Exploitation Analysis & Honeypot Telemetry
• GitHub Security Lab — GHSL-2026-203: CI/CD TOCTOU Race Condition in jupyterlab/maintainer-tools
• Bugcrowd NASA Disclosure — Unauthenticated OS Command Injection in NASA International Mass Loading Service
• Bugcrowd NASA Disclosure — Command Injection in NASA Harmony Trajectory Subsetter gives Root RCE