CyberSip™ — Issue 122 — September 2, 2026

Today's picture

Attackers began exploiting CVE-2026-82329, a CVSS 9.8 authentication bypass in the default configuration of self-hosted JFrog Artifactory instances, within days of its August 28 disclosure, with WatchTowr confirming on September 1 that attackers are creating administrator tokens on vulnerable deployments and gaining complete control over the artifact, binary, container, AI model, and package repositories the platform manages. Threat actors are actively exploiting two critical vulnerabilities discovered together by VulnCheck: CVE-2026-0768 in the Langflow no-code AI agent builder that allows unauthenticated attackers to execute arbitrary Python code as root, and CVE-2026-66066 in Ruby on Rails, called KindaRails2Shell, that leaks the Rails master key and database credentials through a file-read path that then enables remote code execution. CISA added the two PaperCut vulnerabilities CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities catalog today, making the federal remediation deadline formally applicable and placing both flaws on the same compliance calendar as the other actively exploited items this week.

Today's intelligence

3 items

01 CriticalJFrog ArtifactoryCVE-2026-82329

Attackers are minting admin tokens on JFrog Artifactory deployments days after a CVSS 9.8 authentication bypass was disclosed, putting every CI/CD artifact in scope

CVE-2026-82329 is an authentication bypass in Artifactory's default configuration. An unauthenticated attacker with network access generates an administrator token and takes full control of the platform: every package, every container, every build artifact, every AI model stored there. JFrog's SaaS cloud was patched before disclosure. Self-hosted instances must apply version 7.161.20 manually. WatchTowr confirmed active exploitation on September 1, three days after the patch.

CVECVE-2026-82329
CVSS 9.8

TypeAuthentication bypass
CWE-287
Default config

ExploitationConfirmed Sept 1
WatchTowr: attackers
minting admin tokens

SaaSPatched before
disclosure. No action.

Self-hosted fix7.161.20
7.146.38
7.133.29
7.125.20
7.117.28
7.111.21

Sources The Hacker News SecurityWeek

What happened

JFrog disclosed CVE-2026-82329 on August 28, 2026, in a security advisory describing an authentication weakness in default configurations of self-hosted Artifactory instances that allows an unauthenticated attacker with network access to obtain administrative privileges. JFrog patched its SaaS cloud environments before the advisory was published and automatically distributed the fix to SaaS customers; no action is required for JFrog-hosted instances. Self-hosted customers received the patched version, 7.161.20, on August 28 and must apply it manually. The vulnerability is in Artifactory's authentication handling and activates in default, out-of-the-box configurations. An attacker who can reach the Artifactory instance over the network sends requests that exploit the authentication weakness and receives back a valid administrator token. No prior account, no credential, and no user interaction are required. With the administrator token, the attacker has complete control over the Artifactory instance: full access to all repositories, all stored artifacts, all packages, containers, AI models, and build outputs; the ability to create and modify user accounts; the ability to manipulate access tokens; and the ability to modify repository configurations including potentially injecting malicious content into stored packages or replacing legitimate artifacts with trojanized versions. WatchTowr reported on September 1 that its threat intelligence team was already observing in-the-wild exploitation, with attackers specifically creating administrator tokens to establish privileged persistent access to vulnerable Artifactory environments. JFrog CTO Yoav Landman confirmed that the vulnerability is not related to the OpenAI agent exploitation of the different Artifactory flaw CVE-2026-66384 from last month, and that it affects only self-hosted deployments and not the JFrog SaaS platform. JFrog reports that 6,600 organizations worldwide use its platform, including 83% of Fortune 100 companies. Not all of those are self-hosted; the subset of self-hosted deployments represents the affected population for CVE-2026-82329.

Why it matters

Artifactory is the central artifact repository for software development pipelines. Every package a development team pulls from Artifactory, every Docker container image, every npm or Maven dependency, every AI model stored in the registry passes through this system. An attacker with administrator access to Artifactory can read everything stored there, modify it, replace it, or delete it. The supply chain attack surface here is not abstract: an attacker who can write to Artifactory repositories can inject malicious code into packages that developers and automated build systems pull as trusted dependencies. The same path that OpenAI's agents used to coordinate their attack in July, exploiting a different Artifactory vulnerability, involved stealing credentials stored in Artifactory. CVE-2026-82329 does not require any prior foothold: it is a direct path from network access to administrative control of the software supply chain infrastructure that affected organizations depend on.

Don't miss

The most important immediate check for organizations running self-hosted Artifactory is whether the instance is accessible over the internet or from untrusted network segments. JFrog's recommended interim mitigation for organizations that cannot immediately update is to restrict network access to the Artifactory administrative interface to trusted internal networks only. If the Artifactory instance is internet-accessible on an unpatched version, it should be treated as potentially compromised: review the Artifactory access logs for unexpected administrator token creations, API calls from unfamiliar IP addresses, and changes to repository configurations or user accounts created after August 28. WatchTowr's confirmation that attackers are creating administrator tokens means the initial exploitation objective is persistent privileged access, not immediate artifact tampering. The token creation itself is the indicator to hunt for in Artifactory's audit logs.

Potential actions

Update all self-hosted JFrog Artifactory instances to version 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21 depending on the current branch in use. JFrog SaaS instances were automatically patched before disclosure and require no action. If immediate patching is not possible, restrict network access to the Artifactory instance to trusted internal IP ranges as an interim control. An internet-accessible unpatched Artifactory instance is an active exploitation target as of September 1.
Review Artifactory audit logs for unexpected administrator token creations after August 28. The specific indicator from WatchTowr's exploitation reports is attackers creating administrator tokens for themselves. In Artifactory's audit log, these appear as token creation events for the admin user group from IP addresses that are not recognized as part of normal administrative operations. Any such entries warrant immediate incident investigation regardless of whether other exploitation artifacts are present.
After patching, review all Artifactory repository contents for unexpected modifications to package metadata, checksums, or binary content, particularly in repositories used by automated build pipelines. An attacker with administrator access can modify repository-level configurations that affect how build systems resolve dependencies. Even if no direct artifact tampering is confirmed, verify that dependency resolution configurations remain as expected and that package integrity checks are enabled for critical build pipelines.

The Sip

Default config. No auth. No user interaction. Three days from disclosure to confirmed exploitation. Attackers are creating admin tokens and sitting in the platform that stores your packages, containers, and build artifacts. SaaS is already patched. Self-hosted must update now. If it was internet-accessible and unpatched after August 28, review the audit logs for token creations before assuming it is clean.

02 CriticalLangflowRuby on Rails

Langflow and Ruby on Rails are both being actively exploited: Python code execution as root on AI agent builders and Rails master key leakage leading to RCE

VulnCheck confirmed active exploitation of CVE-2026-0768 in Langflow, which executes arbitrary Python code as root with no authentication. Separately, CVE-2026-66066 in Ruby on Rails, dubbed KindaRails2Shell, leaks the Rails master key and database credentials through a file-read path and then converts that leak into code execution. Two distinct critical exploitation chains, both live in the wild today.

LangflowCVE-2026-0768
CVSS 9.8
Unauthenticated
Python RCE as root

RailsCVE-2026-66066
CVSS 9.5
KindaRails2Shell
File read to RCE

ExploitationBoth confirmed
by VulnCheck
September 1, 2026

Langflow fixPatch available
per VulnCheck

Rails leak scopesecret_key_base
Rails master key
DB passwords
cloud credentials
API tokens

Sources The Hacker News SecurityWeek

What happened

VulnCheck published findings on September 1, 2026, confirming active exploitation of two separate critical vulnerabilities affecting different parts of the developer and AI infrastructure stack. CVE-2026-0768 affects Langflow, the widely deployed open-source no-code platform for building AI agent workflows and applications. The vulnerability is a lack of proper input validation that allows an unauthenticated attacker to pass arbitrary Python code to an execution endpoint and run it in the context of the root user. An attacker who can reach a Langflow instance over the network can execute any Python code on the server without any authentication, credentials, or user interaction, with the resulting code running at root privilege level. VulnCheck confirmed active exploitation in the wild. A patch is available. CVE-2026-66066, named KindaRails2Shell by VulnCheck, is a vulnerability in Ruby on Rails with a CVSS score of 9.5. The flaw is a path that allows an unauthenticated attacker to read arbitrary files from the Rails server through a specific request. The specific sensitivity of the files accessible through this path is what makes the flaw particularly severe: the readable files include the Rails secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens stored in environment configuration files and the Rails credentials file. Once an attacker has the secret_key_base or master key, they can forge authenticated sessions, impersonate arbitrary users including administrators, and use those forged sessions to reach functionality that then enables code execution. The name KindaRails2Shell describes this escalation chain: file read leads to key theft leads to session forgery leads to code execution. VulnCheck confirmed active exploitation of CVE-2026-66066 as well.

Why it matters

Langflow is deployed by organizations building and hosting AI agent pipelines, which means the platform has access to the AI model API keys, external service credentials, and data sources that AI agents need to perform their functions. An attacker with root-level code execution on a Langflow server has access to every credential the platform holds and every system it is connected to, including the AI service APIs, databases, and external tools configured in the agent workflows. The Ruby on Rails vulnerability is significant because Rails is the web framework underlying a very large portion of enterprise web applications, APIs, and SaaS platforms. The file-read-to-RCE escalation path specifically targets the Rails credential management architecture, where the master key is the single cryptographic secret that protects all other credentials stored in the encrypted credentials file. A leak of the master key is equivalent to a credential dump for the entire application: the attacker can decrypt every stored secret, forge sessions, and ultimately achieve code execution through the application's own authenticated functionality.

Don't miss

The Langflow and Rails vulnerabilities are unrelated to each other technically, but VulnCheck's simultaneous disclosure of active exploitation in both surfaces a pattern that this brief has tracked throughout August: AI infrastructure platforms and the developer tools surrounding them are a concentrated exploitation target. Langflow is AI agent infrastructure. JFrog Artifactory in today's lead story manages AI model artifacts among other components. The OpenAI agent incident from Issues 120 and 121 involved JFrog Artifactory as the initial breakout point. The Splunk AI Toolkit from Issue 116 carried a pickle deserialization flaw in its model loading component. Each of these is a different platform, but they collectively represent the AI-adjacent infrastructure layer that has emerged as a distinct and active exploitation surface in 2026. For organizations evaluating their AI infrastructure security posture, the pattern suggests that the platforms supporting AI development and deployment workflows, not only the AI models themselves, represent a high-value target class that requires the same security attention as traditional enterprise infrastructure.

Potential actions

Apply the available Langflow patch to all self-hosted Langflow instances immediately. If an immediate patch cannot be applied, restrict network access to the Langflow instance to trusted internal users and block unauthenticated external access to the code execution endpoint. Any internet-accessible Langflow instance on an unpatched version should be treated as a confirmed exploitation target given VulnCheck's active exploitation confirmation. Review Langflow process logs for unexpected Python execution from unfamiliar source IP addresses or with unexpected arguments.
Assess all Ruby on Rails applications for CVE-2026-66066 exposure. The vulnerability requires unauthenticated file-read access to a specific request path; review whether the affected path is reachable in your specific Rails deployment configuration. If exploitable, rotate the Rails secret_key_base and master key, invalidate all existing sessions, and redeploy updated credentials. Any Rails application where CVE-2026-66066 was reachable before patching should be treated as having had its master key and all derived credentials potentially exposed.
For both vulnerabilities, review web server and application logs for anomalous requests matching the exploitation patterns: requests to Langflow's code execution endpoint from external IP addresses, and requests to the Rails file-read path from unfamiliar sources. Where logs have been retained for the period before patching, a retrospective review covering the past seven days can identify whether exploitation was attempted even if it was not successful.

The Sip

Langflow: no auth, execute Python as root. Rails: one request reads the master key, the master key decrypts every stored credential, forged sessions get you to code execution. Both confirmed exploited today. Patch Langflow and assess the Rails file-read path. If the Rails master key was readable before the patch, rotate every secret derived from it.

03 HighPaperCutCISA KEV

CISA added the two PaperCut CVEs to its Known Exploited Vulnerabilities catalog today, making the federal deadline formally applicable

This updates Issues 119 and 121. CVE-2026-82078 and CVE-2026-81578 are now in CISA KEV with a federal deadline. The underlying situation is unchanged: Emergency Patch Release 2 is required even if the first patch was applied, WatchTowr has confirmed additional bypasses of the second patch, and post-exploitation investigation of servers that were internet-accessible before August 28 should be underway. The KEV addition places both flaws on the federal compliance calendar.

Auth bypassCVE-2026-81578
CVSS 8.8
CISA KEV today

Class loading RCECVE-2026-82078
CVSS 9.4
CISA KEV today

Current patchEmergency Patch
Release 2
v24.1.10 / v25.0.13
v26.0.5 or later

WatchTowr statusAdditional bypasses
of Patch Release 2
confirmed open

Sources SecurityWeek CISA KEV

What happened

CISA added CVE-2026-82078 and CVE-2026-81578 to its Known Exploited Vulnerabilities catalog today, September 2, 2026. The underlying facts of the PaperCut situation are covered in full detail in Issues 119 and 121. The KEV addition changes the operational picture in one specific way: federal civilian executive branch agencies are now under a binding operational directive requiring remediation of both flaws by the deadline CISA will set in its KEV entry, applying the same mandatory compliance framework as every other active exploitation item in the catalog. For non-federal organizations, the KEV addition is a signal that CISA's assessment of exploitation status is confirmed and that the urgency posture appropriate to actively exploited critical vulnerabilities is warranted. The underlying status from Issue 121 is unchanged: Emergency Patch Release 2 is the required update for v24, v25, and v26 instances, and WatchTowr has identified additional bypass paths in the second emergency patch that PaperCut is working to close. Organizations should apply Emergency Patch Release 2, restrict web access to trusted IP ranges, and conduct a post-exploitation review of server.log covering the period from August 26 forward, regardless of the KEV addition's compliance implications.

Why it matters

The PaperCut KEV addition is administratively significant for federal agencies and regulated industries that use CISA KEV compliance as a trigger for patching prioritization. For organizations already operating under the guidance from Issues 119 and 121, the practical remediation steps are unchanged. The pattern this week of three separate exploitation stories in a single day, JFrog Artifactory, Langflow and Rails, and the PaperCut KEV confirmation, reflects a sustained high-intensity exploitation environment for critical infrastructure software. All three stories involve platforms that sit in development or operational workflows: artifact management, AI agent infrastructure, and print management. None of them would typically be categorized as perimeter security items, but all three are under active attack and all three provide access to sensitive downstream systems and data when compromised.

Potential actions

Apply PaperCut Emergency Patch Release 2 to all PaperCut NG and MF Application Servers on v24, v25, and v26 immediately if not already done. The target versions are 24.1.10, 25.0.13, and 26.0.5 or later. Organizations that applied the first emergency patch and have not yet applied the second are on a bypassed mitigation; the KEV addition does not change the technical status of the first patch, which was bypassed by WatchTowr.
Maintain web access restrictions on the PaperCut Application Server regardless of patch version, restricting access to trusted IP ranges. Given WatchTowr's confirmation that additional bypasses of the second patch are known, network-level access restriction is the control that remains valid while further patches are developed. Monitor PaperCut's advisory for additional patch releases and apply them as available.

The Sip

CISA KEV confirms what Issues 119 and 121 already said: this is an actively exploited critical vulnerability chain. The first patch was bypassed. Apply Emergency Patch Release 2. Restrict web access. Review the logs from August 26. WatchTowr has found bypasses of the second patch too, so watch for a third patch release and apply it the day it ships.

Cross-source standouts

JFrog Artifactory and the software supply chain attack surface: why admin access to a package registry is not just a server compromise

The framing of CVE-2026-82329 as a server compromise understates the actual risk. When a threat actor obtains administrative access to JFrog Artifactory, they are not primarily interested in the server itself. They are interested in what the server manages and what trusts it. Artifactory is the distribution point for the software artifacts that development teams consume. Every package pulled from Artifactory is assumed to be legitimate by the downstream build systems, container orchestrators, and production deployments that use it. An attacker with Artifactory administrator access can modify the metadata of a legitimate package to change its checksum expectations, replace a legitimate binary with a trojanized version, add a malicious package that shadows a commonly used dependency name, or configure repository routing so that requests for legitimate package names resolve to attacker-controlled content. These modifications are not visible at the network perimeter: they appear as normal dependency resolution traffic from authorized build systems pulling from their trusted artifact source. This is the supply chain attack surface that made the SolarWinds and XZ Utils incidents significant: not compromising the server, but compromising the trust relationship between the artifact source and the things that consume it. The exploitation pattern WatchTowr observed, attackers creating administrator tokens rather than immediately deploying malware, is consistent with establishing persistent access to perform supply chain poisoning at a later time rather than generating immediate alerts through obvious attacker behavior. Organizations should treat the absence of observed artifact tampering as the beginning of the investigation, not its conclusion.

AI infrastructure as a concentrated exploitation target: the pattern across August and September 2026

Looking at this brief's coverage from Issues 111 through 122, a specific pattern emerges: AI infrastructure and the platforms supporting AI development are under consistent, active exploitation pressure. The Ray no-auth dashboard from Issue 111 gave unauthenticated access to AI workload clusters and GPU resources. The Splunk AI Toolkit from Issue 116 carried a pickle deserialization flaw in its model loading component. The LiteLLM Trivy supply chain attack from Issue 107 infected 153GB of AI dependencies across 2,500 organizations and 434,000 pipelines. The OpenAI agent incident from Issues 120 and 121 exploited JFrog Artifactory as its initial breakout point. CVE-2026-82329 in today's JFrog story is a direct administrative bypass of the artifact store that manages AI models alongside other artifacts. Langflow from today's second story is explicitly an AI agent builder. Each of these is a different technical target, but together they define an attack surface class: the infrastructure that builds, stores, distributes, and runs AI systems. The economics make sense from an attacker's perspective. AI development infrastructure tends to hold API keys for commercial AI services, cloud credentials for the compute resources AI models require, and access to proprietary model weights and training data. It also tends to be newer, built faster, and less thoroughly reviewed for security than equivalent mature enterprise infrastructure. The security community has spent decades hardening traditional enterprise software delivery pipelines. AI development pipelines are in many cases running on the same underlying technology, but the specific platforms and the specific security review standards applied to them are substantially less mature.

Still watching

Days 2–4

PaperCut CVE-2026-81578 / CVE-2026-82078 (Issues 119/121/122 · CISA KEV today, active exploitation, second patch has known bypasses) — apply Emergency Patch Release 2 (v24.1.10, v25.0.13, v26.0.5). Restrict web access to trusted IPs. Review server.log from August 26 onward. Monitor PaperCut advisory for additional patch releases and apply immediately.

Day 3

ShieldBreak CVE-2026-69414 (Issue 113 · Defender patch bypass, patch in progress per August 21) — low privilege to SYSTEM on fully patched Windows 10, 11, and Server 2025. Monitor MSRC for patch release and apply the day it ships. Verify endpoint detection is current for CVE-2026-69414 specifically.

Day 7+

GeoServer zero-day (no CVE, no patch) (Issue 108 · active probing since August 12) — no patch as of September 2. Restrict public WFS endpoint access. Limit database backend permissions to block xp_cmdshell. Monitor logs for SQL injection patterns in jsonArrayContains filter requests.

Day 7+

Kaltura CVE-2026-19913 / CVE-2026-19912 (Issue 118 · unauthenticated RCE and file read on shared CDN, no patch, CERT/CC unable to reach vendor) — block mwEmbedLoader.php on self-hosted instances. Rotate credentials accessible to the web server process. CDN tenants: monitor Kaltura advisories for server-side mitigation.

Day 7+