CVEasy Weekly

This Week in Exposure

Week 36 · 2026-W36 · August 25 to August 31, 2026

Three of this week's exposures share a location. Each lived in code that runs before authentication or sits in front of the application it protects. NetScaler canonicalizes a SAML message before it checks the signature, the WebLogic proxy plug-in routes a URI before the backend authorizes it, and the ServiceNow AI Platform answers a GraphQL request before anyone logs in.

Each of these was audited once, shipped, and then trusted as settled. The base score graded the bug in the abstract, while the real risk sat on the internet-facing Gateway, the proxy nobody remembered enabling, or the self-hosted instance that never migrated to cloud. Here is the week, ranked by exposure against your inventory rather than by the base score.

Top Exposures This Week

1. A NetScaler DoS advisory that was really pre-auth root

CVE-2026-8452 · NetScaler ADC and Gateway, SAML PrefixList canonicalization · CVSS 8.8 · CISA KEV since August 26

When a NetScaler configured as a SAML service provider or identity provider receives a signed message, it canonicalizes the signed subtree before it verifies the signature. Inside that step sits an optional InclusiveNamespaces PrefixList, a space-separated string that is attacker-controlled on every request and feeds the canonicalizer before any cryptographic check happens. That string copies into a fixed-size heap buffer with no bounds check. Canonicalization is pre-auth by design, because the canonical bytes are the input to the check that would authenticate the message, so the overflow lands before authentication ever runs.

Risk read: Confirmed in the wild. Citrix shipped the fix on June 30 and framed CVE-2026-8452 as a memory overflow causing denial of service at CVSS 8.8. watchTowr Labs published a working exploit and a repro walkthrough on August 14 that turned that DoS language into a controlled write against the nsppe packet-processing engine, which runs as root with an executable heap on the affected builds. Help Net Security reported in-the-wild exploitation shortly after, and CISA added the flaw to KEV on August 26 with a BOD 22-01 due date of August 29. Exposure splits the fleet: an internet-facing Gateway terminating SSL VPN on 14.1 before 14.1-72.61 or 13.1 before 13.1-63.18 sits at ACT, the top TRIS band, while a lab appliance behind segmentation sits far lower at the same CVSS. The blast radius is pre-auth root on the box that terminates your VPN, with observed exploitation dropping web shells and running discovery commands.

Read how a PrefixList becomes a root shell →

2. An Oracle WebLogic bug that lives between two parsers

CVE-2026-21962 · Oracle HTTP Server and WebLogic Server Proxy Plug-in for Apache and IIS · CVSS 10.0 · CISA KEV since August 24

The WebLogic Server Proxy Plug-in lets an Apache or IIS front-end accept requests and hand the servlet-bound ones to a WebLogic backend. Every request forces a routing decision: static asset the front-end serves directly, or dynamic path that goes to WebLogic. The URI decides, and the URI passes through two parsers that do not agree on how to normalize it. A crafted path reads as a harmless static asset to the front-end that authorizes it, and as an authenticated backend route to WebLogic that trusts it. The vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, carries a scope change, and that scope change is the tell: the flaw sits inside the plug-in but the damage lands on the backend.

Risk read: Confirmed in the wild. Oracle disclosed the flaw on January 20 in the quarterly CPU, a proof of concept landed two days later, and CloudSEK's high-interaction Oracle honeypot logged automated exploitation the same day. CISA added it to KEV on August 24 with a BOD 22-01 due date of August 27, which BankInfoSecurity called one of the tightest KEV clocks CISA has issued. Exposure: any Oracle HTTP Server or WebLogic proxy plug-in reachable from an untrusted network should be treated as unauthenticated to its backend, and this is a component many owners do not know is enabled, running in front of applications the security team does not own. The blast radius is backend remote code execution reached through a front-end that believed it was serving a static file.

Read the two-parser URI mismatch →

3. Three CVSS 10 unauth bugs in one ServiceNow advisory

CVE-2026-18885, CVE-2026-18886, CVE-2026-74820 · ServiceNow AI Platform, self-hosted · three CVSS 10.0, unauthenticated

ServiceNow published KB3152242 on August 27 covering three unauthenticated CVSS 10.0 flaws in the AI Platform substrate that now sits between the GenAI features, the workflow engine, and the record store: a GraphQL Composite Data API code injection, an image upload processor access control gap, and a dynamic ORDER BY SQL injection. This is not one primitive with three consequences, it is three separate reachable primitives against the same running instance. Two run arbitrary code on the application server, the third runs arbitrary SQL against the database, and none of them needs a login.

Risk read: Cloud tenants patched themselves overnight, so the entire remaining exposed population is the self-hosted footprint and any managed instance whose owner opted out of the ServiceNow Patching Program. A box that took only the emergency GraphQL hot fix still bleeds through the image processor and the ORDER BY clause, so a partial patch is not a patch. Exposure: per KB3152242, any self-hosted instance below Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4, Zurich Patch 7b Hot Fix 3, or Australia Patch 2 Hot Fix 3 is exposed on all three CVEs at once. The blast radius spans code execution on the app server and arbitrary reads and writes against the record store behind it. Public exploitation has not been reported yet, which on a fresh triple-CVSS-10 unauth advisory is a clock, not an all clear.

Read the three primitives and the build matrix →

Threat Actor Spotlight

The most active hands this week are on the Oracle WebLogic flaw, and they moved months before CISA did. CloudSEK's honeypot logged automated exploitation within two days of the January proof of concept, and the twelve days that followed were dominated by libredtail-http and Nmap Scripting Engine probes sweeping for the plug-in. SecurityWeek and The Hacker News both flagged a suspected China-linked actor using CVE-2026-21962 against government infrastructure in July. Public sources have not named a specific group, and no byte-level payload transcript has been published, so treat the attribution as reported and unconfirmed rather than settled. The pattern underneath it is the durable lesson: edge and proxy components get swept and exploited long before their owners realize they are running. Hardening takeaway: inventory what actually terminates and forwards traffic at your perimeter, the Oracle HTTP Server and WebLogic proxy plug-ins, the SAML handlers on your NetScalers, the self-hosted platforms you assume cloud already patched, because you cannot patch a component you do not know is enabled.

Signed CVEasy threat-intel IOC bundle current as of 2026-08-31. The desktop app verifies the ED25519 signature before import.

The theme holds because the code that runs before authentication is the code nobody re-reads. A canonicalizer, a proxy parser, a GraphQL substrate, each one processes attacker input while the system still assumes the request is safe. The work is to keep scoring every finding against your own inventory, which Gateway faces the internet, which proxy plug-in is actually enabled, which self-hosted instance never migrated. That is the gap TRIS closes inside our CTEM platform, and the gap I want this letter to close for you every Monday.

Patch well,
Chris Boker
Founder, CVEasy AI