CISA KEV Flash: 11 CVEs Added — PaperCut, Citrix NetScaler & Linux Kernel Under Active Exploitation | Security Arsenal

Between August 26 and August 31, 2026, CISA added eleven CVEs to the Known Exploited Vulnerabilities (KEV) catalog. A KEV listing is not a theoretical warning — it is federal confirmation that adversaries are actively exploiting these flaws in the wild right now. Every product on this list should be treated as compromised-until-patched.

This wave is unusually diverse: internet-facing print infrastructure (PaperCut NG/MF), edge gateways (Citrix NetScaler ADC/Gateway), software supply chain tooling (JFrog Artifactory), file sync platforms (ownCloud), two Linux Kernel privilege escalations, legacy Microsoft SQL Server RCE, .NET deserialization, and two decade-old Red Hat local privilege escalation flaws that attackers are clearly still monetizing.

Analyst note: CISA has not yet publicly attributed ransomware campaigns to any CVE in this batch (all marked "Ransomware: Unknown"), and several of the 2026 identifiers are too new to have finalized CVSS scores. Where data is unconfirmed, we say so. Do not let the absence of attribution lull you — PaperCut CVE-2023-27350 taught this industry how fast print-server exploitation converts to ransomware deployment.

1. Active Exploitation Intelligence

CVE-2026-82078 — PaperCut NG/MF | Unsafe Reflection → Config Manipulation / Code Execution

What it is: An unsafe reflection vulnerability allowing an attacker to manipulate system configuration parameters and ultimately execute code on the server.
Exploitation method: Remote code execution via abuse of reflection to alter configuration values — functionally similar to the CVE-2023-27350 attack path (config abuse → scripted code execution via the print scripting interface).
Threat actors: Ransomware linkage unconfirmed, but PaperCut servers are a documented favorite of ransomware affiliates (Bl00dy, LockBit, and Cl0p ecosystems historically). Expect rapid adoption.
CVSS: Not yet finalized at time of writing — treat as Critical (9.x-class) given RCE on an internet-adjacent service.
PoC: No confirmed public PoC yet; exploitation observed in the wild per CISA.
CISA required action: Apply vendor mitigations/patches per the KEV directive or discontinue use. Federal deadline per BOD 22-01 — typically ~3 weeks from listing (verify exact due date in the catalog).

CVE-2026-81578 — PaperCut NG/MF | Missing Authentication for Critical Function

What it is: A critical administrative function is reachable without authentication, allowing an unauthenticated remote attacker to modify system state.
Exploitation method: Authentication bypass leading directly to configuration tampering — chainable with CVE-2026-82078 for unauthenticated RCE.
Threat actors: Unconfirmed attribution; dual PaperCut listings in one batch strongly suggest a coordinated campaign or a public exploit chain circulating in criminal forums.
CVSS: Not yet finalized — treat as Critical. PoC: Not public as of this writing.
CISA required action: Patch or apply vendor workaround; federal remediation deadline applies.

CVE-2023-49105 — ownCloud | Improper Authentication (graphapi app)

What it is: Improper authentication in the ownCloud graphapi app exposes phpinfo output, leaking environment variables including admin credentials, mail server credentials, and license keys in containerized deployments.
Exploitation method: Unauthenticated information disclosure → credential theft → full platform compromise. Access, modify, or delete any file without authentication downstream.
CVSS: 10.0 (Critical). Originally disclosed November 2023; its KEV addition now signals renewed or sustained exploitation — likely driven by unpatched Docker/legacy deployments.
PoC: Public — exploit details have circulated since late 2023. Trivial to weaponize.
CISA required action: Patch (graphapi 0.2.x ≥ 0.2.1 / 0.3.x ≥ 0.3.1), rotate all exposed credentials, and review ownCloud's three-CVE advisory from November 2023.

CVE-2026-53362 — Linux Kernel | IPv6 Subsystem Privilege Escalation

What it is: An unspecified vulnerability in the kernel's IPv6 networking subsystem allowing privilege escalation.
Exploitation method: Local privilege escalation (LPE) — attacker with a foothold (web shell, container escape, compromised user) escalates to root. IPv6-facing bugs can also carry a remote pre-auth trigger component; treat internet-facing IPv6-enabled hosts as exposed.
CVSS: Not yet finalized. PoC: Not confirmed public; in-the-wild use confirmed by CISA.
CISA required action: Apply kernel updates from your distribution immediately.

CVE-2026-66384 — JFrog Artifactory | Path Traversal (Authenticated)

What it is: Improper limitation of a pathname to a restricted directory — an authenticated user can traverse outside intended repository paths.
Exploitation method: Authenticated path traversal → arbitrary file read/write on the Artifactory host. In a supply chain context this means poisoning build artifacts — one of the highest-leverage attack outcomes possible.
Threat actors: Unattributed, but Artifactory compromise is a classic staging point for supply chain intrusion by both criminal and nation-state operators.
CVSS: Not yet finalized. PoC: Not confirmed public.
CISA required action: Upgrade per JFrog advisory; audit repository contents for tampering.

CVE-2021-23758 — Ajax.NET Professional (AjaxPro) | Deserialization of Untrusted Data

What it is: Insecure deserialization enabling remote code execution via crafted payloads to AjaxPro endpoints in ASP.NET applications.
Exploitation method: Unauthenticated RCE via malicious serialized objects — the .NET equivalent of the ysoserial attack class.
CVSS: 9.8 (Critical). PoC: Public exploit research exists since 2021; KEV listing confirms it is now being fired in volume — almost certainly scanning-driven opportunistic exploitation of legacy ASP.NET apps.
CISA required action: Patch to AjaxPro 2 (version 21.10.30.1 or later) or remove the library.

CVE-2015-3246 — Red Hat libuser | Race Condition → /etc/passwd Corruption

What it is: A race condition in libuser allowing authenticated local users to corrupt /etc/passwd — usable for denial of service or privilege escalation.
Why now: An 11-year-old bug hitting KEV means attackers are still finding unpatched RHEL/CentOS estates — typically forgotten legacy servers, or as an LPE payload inside post-exploitation toolkits.
CVSS: 5.9 (Moderate) — but as a post-compromise root enabler it punches far above its score. PoC: Public since 2015.

CVE-2015-5287 — Red Hat ABRT | Local Privilege Escalation

What it is: The Automatic Bug Reporting Tool allows local users with specific permissions to escalate to root via abused crash-handling paths.
CVSS: 7.8 (High). PoC: Public. Frequently bundled with CVE-2015-3246 in the same 2015 "libuser/ABRT" disclosure — and evidently still effective against unpatched legacy Linux.

CVE-2022-0995 — Linux Kernel (watch_queue) | Out-of-Bounds Write

What it is: An out-of-bounds memory write in the kernel's watch_queue event notification subsystem.
Exploitation method: Local privilege escalation to root, or denial of service. A reliable LPE primitive widely integrated into exploit chains.
CVSS: 7.8 (High). PoC: Public exploit code has been available since 2022. Patch level: kernel 5.17+ / backported distro kernels.

CVE-2026-8452 — Citrix NetScaler ADC & Gateway | Improper Memory Buffer Restriction

What it is: Improper restriction of operations within the bounds of a memory buffer in NetScaler ADC/Gateway.
Exploitation method: Memory corruption class — the same vulnerability family as CitrixBleed (CVE-2023-4966). Expect remote exploitation against internet-facing gateway appliances, with session theft or code execution as the likely outcome.
Threat actors: NetScaler exploitation is historically dominated by ransomware initial access brokers and nation-state groups (CitrixBleed was used by LockBit affiliates and APT actors within days). Assume the same playbook is activating now.
CVSS: Not yet finalized — treat as Critical. PoC: Not confirmed public.
CISA required action: Apply Citrix security update immediately; then terminate all active sessions (as with CitrixBleed, patching alone does not evict stolen sessions).

CVE-2019-1068 — Microsoft SQL Server | Remote Code Execution

What it is: RCE in SQL Server allowing code execution in the context of the SQL Server service account (Database Engine privilege-checking flaw).
Exploitation method: Authenticated attacker with query access executes OS-level code as the service account — a stepping stone to lateral movement across database estates.
CVSS: 7.1 (High). PoC: Public. Its 2026 KEV debut suggests attackers are harvesting still-unpatched SQL Server 2016/2017 instances — common in healthcare, finance, and manufacturing environments that defer database patching for uptime reasons.

2. Affected Organizations Assessment

Internet-facing exposure (highest urgency):

PaperCut NG/MF — pervasive in education, legal, healthcare, and government print environments. Post-CVE-2023-27350 telemetry showed thousands of internet-exposed instances; many organizations never fully remediated that wave and will be equally slow here.
Citrix NetScaler ADC/Gateway — front-door infrastructure for Fortune 500 remote access. CitrixBleed demonstrated that NetScaler patch adoption lags badly; Shodan-visible exposure historically numbers in the tens of thousands globally.
ownCloud — containerized and self-hosted file platforms in SMB and research/academic sectors. CVE-2023-49105 remains trivially exploitable anywhere graphapi < 0.2.1/0.3.1 runs.
ASP.NET apps with AjaxPro — legacy enterprise line-of-business applications, frequently internet-facing and unmaintained.

Internal / post-compromise exposure:

Linux Kernel (CVE-2026-53362, CVE-2022-0995) + Red Hat libuser/ABRT — every unpatched Linux estate. These are the LPE payloads that turn a minor web-shell foothold into full root and ransomware deployment.
JFrog Artifactory — software factories in technology, finance, and defense. Compromise cascades into every downstream build consumer.
Microsoft SQL Server — database tiers in healthcare, finance, manufacturing; notoriously patch-lagged due to uptime constraints.

Fastest-exploited sectors historically: Education and government lead for PaperCut; healthcare and critical infrastructure for NetScaler; technology/SaaS for build-tooling flaws; finance and healthcare for SQL Server. Ransomware initial access brokers inventory these product types continuously.

3. Detection Engineering

Sigma Rules

YAML

---
title: PaperCut NG/MF Exploitation - Suspicious Child Process of Print Server Application
id: 7f3a1c2e-8b41-4d9a-a1e2-3c5d6e7f8091
status: experimental
description: Detects suspicious child processes spawned by the PaperCut application server (pc-app.exe), consistent with exploitation of CVE-2026-82078 / CVE-2026-81578 leading to script- or config-driven code execution. Mirrors tradecraft seen in CVE-2023-27350 campaigns.
author: Security Arsenal Threat Intel
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/31
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\pc-app.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
      - '\curl.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate PaperCut print scripting with cmd invocation (rare; baseline per host)
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - cve.2026.82078
  - cve.2026.81578
---
title: Citrix NetScaler Gateway Exploitation - Anomalous Session or Web Shell Artifact
id: 9d2b4e6a-1c35-4f78-b2d4-5e6f7a8b9c0d
status: experimental
description: Detects indicators consistent with exploitation of memory-corruption flaws in NetScaler ADC/Gateway (CVE-2026-8452), including anomalous long-duration sessions (session hijack pattern as seen in CitrixBleed CVE-2023-4966) and unexpected files written to the NetScaler web directory.
author: Security Arsenal Threat Intel
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/31
logsource:
  product: citrix
  service: netscaler
detection:
  selection_files:
    target|contains:
      - '/netscaler/ns_gui/'
      - '/var/vpn/'
    target|endswith:
      - '.php'
      - '.jsp'
      - '.pl'
  selection_session:
    session_duration|gt: 86400
  condition: 1 of selection_*
falsepositives:
  - Legitimate custom portal themes; long-lived admin sessions (baseline and tune per environment)
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1505.003
  - cve.2026.8452
---
title: Linux Kernel Privilege Escalation Exploit Indicators - CVE-2026-53362 / CVE-2022-0995 / Red Hat LPEs
id: 4a8c1d3f-6e27-4b59-c3a1-7d8e9f0a1b2c
status: experimental
description: Detects common execution patterns of Linux local privilege escalation exploits including watch_queue OOB write (CVE-2022-0995), IPv6 subsystem LPE (CVE-2026-53362), and legacy libuser/ABRT abuse (CVE-2015-3246, CVE-2015-5287) - unprivileged users invoking passwd corruption, abrt tooling, or sudden UID transitions.
author: Security Arsenal Threat Intel
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
date: 2026/08/31
logsource:
  category: process_creation
  product: linux
detection:
  selection_abrt:
    Image|endswith:
      - '/abrt-action-save-package-data'
      - '/libuser-helper'
  selection_passwd_write:
    CommandLine|contains:
      - '/etc/passwd'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/python3'
      - '/perl'
  selection_exploit_build:
    Image|endswith:
      - '/gcc'
      - '/cc'
      - '/clang'
    CommandLine|contains:
      - 'watch_queue'
      - 'exploit'
      - 'pwn'
  condition: 1 of selection_*
falsepositives:
  - Developer workstations compiling code; system administration of user accounts. Correlate with non-root initiating user.
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2022.0995
  - cve.2026.53362

KQL — Microsoft Sentinel Hunt Query

KQL — Microsoft Sentinel / Defender

// Multi-CVE KEV hunt: PaperCut RCE, ownCloud graphapi credential leak,
// AjaxPro deserialization, Artifactory path traversal - Security Arsenal
let Lookback = 7d;
// 1) PaperCut: suspicious child processes of the app server
let PaperCut = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName =~ "pc-app.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","curl.exe","certutil.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Indicator="PaperCut CVE-2026-82078/81578 child process";
// 2) ownCloud: unauthenticated hits to graphapi phpinfo endpoint
let OwnCloud = W3CIISLog
| where TimeGenerated > ago(Lookback)
| where csUriStem has "graphapi" and csUriQuery has "phpinfo"
| project TimeGenerated, Computer, cIP, csUriStem, csUserAgent, scStatus, Indicator="ownCloud CVE-2023-49105 phpinfo probe";
// 3) AjaxPro deserialization: POSTs to ajaxpro endpoints
let AjaxPro = W3CIISLog
| where TimeGenerated > ago(Lookback)
| where csUriStem has "ajaxpro" and csMethod == "POST"
| summarize Hits=count(), DistinctIPs=dcount(cIP) by Computer, csUriStem
| extend Indicator="AjaxPro CVE-2021-23758 deserialization probe";
union PaperCut, OwnCloud, AjaxPro
| sort by Timestamp desc

Remediation & Inventory Script (PowerShell)

PowerShell

# Security Arsenal - KEV Wave 2026-08-26..31 Exposure Inventory & Validation
# Covers: PaperCut NG/MF, JFrog Artifactory, ownCloud graphapi, Windows-side checks
# Run as administrator on candidate hosts or against remote targets.

$report = @()

# --- 1) PaperCut NG/MF version check (local install) ---
$pcPath = "C:\Program Files\PaperCut NG\version.txt", "C:\Program Files\PaperCut MF\version.txt"
foreach ($p in $pcPath) {
    if (Test-Path $p) {
        $ver = (Get-Content $p -Raw).Trim()
        $report += [pscustomobject]@{
            Product = "PaperCut ($(Split-Path $p -Parent | Split-Path -Leaf))"
            Version = $ver
            CVEs    = "CVE-2026-82078; CVE-2026-81578"
            Status  = "EXPOSED - compare against vendor-fixed build in PaperCut security bulletin; apply hotfix immediately"
        }
    }
}

# --- 2) JFrog Artifactory version via REST ---
$artifactoryHosts = @("https://artifactory.corp.example.com")  # EDIT: add your instances
foreach ($h in $artifactoryHosts) {
    try {
        $v = Invoke-RestMethod -Uri "$h/artifactory/api/system/version" -TimeoutSec 10 -SkipCertificateCheck
        $report += [pscustomobject]@{
            Product = "JFrog Artifactory"; Version = $v.version
            CVEs    = "CVE-2026-66384"
            Status  = "VERIFY - cross-check version against JFrog fixed-release advisory"
        }
    } catch { Write-Warning "Artifactory query failed for $h : $_" }
}

# --- 3) ownCloud graphapi exposure probe (remote, read-only) ---
$ownCloudHosts = @("https://cloud.corp.example.com")  # EDIT
foreach ($h in $ownCloudHosts) {
    try {
        $r = Invoke-WebRequest -Uri "$h/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php" -TimeoutSec 10 -SkipCertificateCheck -ErrorAction Stop
        if ($r.StatusCode -eq 200) {
            $report += [pscustomobject]@{
                Product = "ownCloud graphapi"; Version = "unknown"
                CVEs    = "CVE-2023-49105"
                Status  = "VULNERABLE - phpinfo endpoint reachable; patch graphapi >=0.2.1/0.3.1 and ROTATE ALL CREDENTIALS"
            }
        }
    } catch {
        $report += [pscustomobject]@{ Product="ownCloud graphapi"; Version="n/a"; CVEs="CVE-2023-49105"; Status="Not reachable / likely patched ($h)" }
    }
}

# --- 4) AjaxPro presence in IIS web apps ---
Get-ChildItem "C:\inetpub" -Recurse -Filter "AjaxPro*.dll" -ErrorAction SilentlyContinue | ForEach-Object {
    $fv = $_.VersionInfo.FileVersion
    $report += [pscustomobject]@{
        Product = "Ajax.NET Professional"; Version = $fv
        CVEs    = "CVE-2021-23758"
        Status  = if ([version]$fv -lt [version]"21.10.30.1") { "VULNERABLE - upgrade to AjaxPro 2 >= 21.10.30.1" } else { "Patched" }
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\KEV_2026-08_Wave_Exposure.csv" -NoTypeInformation
Write-Host "`nInventory complete. For NetScaler: verify build via 'show ns version' against Citrix advisory, then run 'kill system session -all' post-patch. For Linux: check 'uname -r' against distro fixed kernels for CVE-2026-53362 / CVE-2022-0995." -ForegroundColor Yellow

4. Patch & Remediation Priorities

Tier 1 — Internet-facing, active exploitation, ransomware-adjacent (patch within 24–72 hours):

Citrix NetScaler ADC/Gateway (CVE-2026-8452) — Apply the fixed build from the Citrix Security Bulletin at https://support.citrix.com — then kill all active sessions and review for webshells in /netscaler/ns_gui/. Patching without session termination leaves stolen sessions valid (CitrixBleed lesson).
PaperCut NG/MF (CVE-2026-82078, CVE-2026-81578) — Apply the latest release/hotfix per https://www.papercut.com/kb/Main/SecurityBulletins. Remove internet exposure of admin ports (9191/9192) permanently. Audit for unauthorized admin accounts and print-script modifications.
ownCloud graphapi (CVE-2023-49105) — Update graphapi to ≥ 0.2.1 (0.2.x) / ≥ 0.3.1 (0.3.x) per https://owncloud.com/security-advisories/. Rotate admin, mail, and license credentials — assume prior disclosure.

Tier 2 — Supply chain & application tier (patch within 1 week): 4. JFrog Artifactory (CVE-2026-66384) — Upgrade per https://jfrog.com/help/ (Security Advisories). Audit repositories for artifact tampering and anomalous authenticated API activity. 5. Ajax.NET Professional (CVE-2021-23758) — Upgrade AjaxPro to 21.10.30.1+ (NuGet) or remove the library; it is unmaintained in most deployments.

Tier 3 — Privilege escalation layer (patch within CISA window; breaks post-compromise chains): 6. Linux Kernel (CVE-2026-53362, CVE-2022-0995) — Apply current distro kernels (RHEL/Ubuntu/SUSE security channels). Where patching lags, restrict unprivileged user namespaces and monitor with the Sigma rule above. 7. Red Hat libuser / ABRT (CVE-2015-3246, CVE-2015-5287) — Update libuser and abrt packages; decommission any RHEL/CentOS systems old enough to still carry these unpatched — their presence is itself a risk signal. 8. Microsoft SQL Server (CVE-2019-1068) — Apply the cumulative update per Microsoft MSRC guidance (July 2019 CU or later for SQL Server 2016/2017); restrict service-account OS privileges as defense-in-depth.

Workarounds where patches can't land immediately: isolate PaperCut/NetScaler/ownCloud behind VPN-only access; disable the ownCloud graphapi app entirely; block AjaxPro handler paths at the WAF; enforce SELinux in enforcing mode on legacy Red Hat systems.

Compliance: All eleven CVEs carry binding CISA BOD 22-01 remediation deadlines for federal civilian agencies — check the KEV catalog for the exact due date assigned to each entry. Non-federal organizations should adopt the same ~21-day (or faster for Tier 1) window as policy.

Security Arsenal's managed detection teams have deployed the detections above across monitored environments. If you need exposure validation or incident response for any product in this bulletin, contact us.

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 11 CVEs Added — PaperCut, Citrix NetScaler & Linux Kernel Under Active Exploitation