CVEasy Weekly

This Week in Exposure

Week 37 · 2026-W37 · September 7 to September 13, 2026

Three of this week's exposures broke the same thing: the check that decides who you are. JFrog Artifactory hands out a platform admin token to anyone who presents an empty join key, PaperCut dispatches an admin-only action before it finishes validating the session, and Citrix NetScaler lets a request take an alternate path around authentication entirely. None of these is a memory corruption bug you trip by accident. Each is a trust decision that was supposed to be made and was not.

The other thing they share is timing. On all three, the exploit was live before the patch window closed. watchTowr logged hands-on token minting against Artifactory within three days of disclosure, PaperCut's first emergency patch was bypassed within hours, and public probes started matching the NetScaler PoC on real appliances inside two weeks of the fix. Here is the week, ranked by exposure against your inventory and by what attackers are actually doing, not by the base score.

Top Exposures This Week

1. An empty join key that mints an Artifactory admin

CVE-2026-82329 · JFrog Artifactory, JFrog Access token service · CVSS 9.8, unauthenticated · CISA KEV since September 2

Every Artifactory cluster runs JFrog Access, the identity plane that signs and validates tokens for Artifactory, Xray, Distribution, and each node. Nodes trust each other through a shared HMAC secret the docs call the join key. When that value is left empty, Access splits it into an array holding a single empty string instead of filtering it out, then PKCS7 pads that empty block to 32 bytes, which fills the whole block with the pad byte 0x20. The signing key becomes 32 known bytes that any unauthenticated attacker can reproduce, forge a valid enrollment JWT with, and exchange for a service token. One more call to the token API upgrades that service token to platform admin, because the requester now presents credentials Access itself just issued.

Risk read: Confirmed in the wild. JFrog shipped fixed builds on August 28 across six supported branches (7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, 7.161.20), watchTowr's Attacker Eye honeypot network watched hands-on token minting against internet-reachable instances by September 1, and CISA added the flaw to KEV on September 2 with a September 5 federal deadline that has already passed. Cloud tenants are patched. The whole remaining exposed population is self-hosted. A 9.8 pins this flat next to every other unauthenticated RCE, which is exactly where it gets lost, because Artifactory is not an edge box you rebuild, it is the registry that holds and signs the artifacts every build pipeline in the estate pulls. One admin token there is a supply chain foothold: swap a signed container image the deploy job pulls at 3 a.m., or push a package version that gets promoted through repos automatically. Exposure is highest on an internet-reachable tenant feeding production image pulls with an empty or unrotated join key and a federated link into a second cluster.

Read how an empty join key forges a platform admin →

2. A PaperCut chain where the first patch was bypassed in hours

CVE-2026-82078 and CVE-2026-81578 · PaperCut NG and MF, web management interface · CVSS 9.4 and 8.8 · CISA KEV since August 31

Two flaws that are unremarkable alone chain into pre-auth remote code execution. CVE-2026-81578 is a missing authentication check (CWE-306) in the web management interface: under specific request shapes the server dispatches an admin-only action, notably ConfigEditor or UserList, before the session check finishes, so an unauthenticated POST reaches code meant to be gated. CVE-2026-82078 is unsafe dynamic class loading in the database connection utilities. Wired together, one unauthenticated request through the ConfigEditor bypass writes a new JDBC driver classname pointing at a classpath gadget, a second request kicks the connection utility, the JDBC layer instantiates the driver, and the gadget runs. No login, no session cookie, no memory corruption. The result is a Java process running attacker code under the print server's service account.

Risk read: Confirmed in the wild. PaperCut disclosed both on August 27 and patched the same day, but Huntress and watchTowr reproduced the exploit and bypassed that fix within hours, so PaperCut shipped Emergency Patch Release 2 on August 28. Fixed builds are 24.1.10, 25.0.13, and 26.0.5; anything on v23 or earlier has to reach a supported major first. CISA added both CVEs to KEV on August 31 with a September 14 federal deadline, and Huntress reported hands-on-keyboard activity in customer environments, discovery-flavored so far. A host that took only the first emergency build still carries a documented bypass, so a partial patch is not a patch. Exposure lands hardest where the management port (9191 and 9192) is reachable from a student or campus network and the Application Server holds an LDAP bind against the primary domain, which turns a printer compromise into a move into identity.

Read how the auth bypass reaches a Java class loader →

3. A NetScaler auth bypass with probes now hitting real appliances

CVE-2026-19490 · NetScaler ADC and Gateway, Gateway and AAA vservers · CVSS 9.3, CWE-288 · public PoC, attempts observed

CVE-2026-19490 is a CWE-288 authentication bypass using an alternate path, patched by Cloud Software Group in bulletin CTX696939 alongside a companion DoS, CVE-2026-19489. The vector is network, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability, and there is no workaround. The precondition is not uniform across the vulnerable range, which is the trap. On builds 13.1-61.28 and later, exploitation requires a SAML action bound to the Gateway or AAA vserver. On builds older than 13.1-61.28, any Gateway configuration or AAA vserver is enough, because a partial earlier fix closed the alternate path everywhere except the SAML-bound branch. An audit that only checks for Gateway or AAA presence will mis-flag newer appliances without a SAML action and miss the SAML-bound ones that are the actual attack surface.

Risk read: PoC live, attempts observed, not yet confirmed post-exploitation. As of August 20 no PoC or in-the-wild activity was confirmed, then a credible public PoC appeared in early September. Previdian recorded the first matching requests on September 3, ten attempts from six unique IPs over the next forty-eight hours, and BleepingComputer's September 5 coverage marked the point where expected exploitation became observed exploitation. That is a roughly two-week window from vendor patch to live traffic. Fixed builds are NetScaler ADC and Gateway 14.1-73.32 and 13.1-63.21, plus matching FIPS and NDcPP builds. A CVSS-descending queue treats every 9.3 identically, so an unexposed lab appliance ranks alongside the internet-facing Gateway carrying every remote worker's SSL VPN session. Exposure is top-band on an internet-facing 14.1 Gateway with a SAML action bound, where a session issued past the alternate path sits directly next to the internal network.

Read why the precondition splits by firmware train →

Threat Actor Spotlight

No named group has been publicly attributed to any of this week's three flaws yet, and the honest label on all three is opportunistic, automated exploitation racing the patch cycle. That absence is itself the story worth naming. watchTowr's honeypot logged hands-on Artifactory token minting within three days of disclosure, and PaperCut is a proven ransomware doorway: in the 2023 CVE-2023-27350 wave, CISA and Microsoft tied active exploitation of PaperCut print servers to Cl0p-affiliated actors, and the print operations back plane still holds LDAP binds and file spools worth the same access today. Treat the 2026 chain as unattributed for now, not as low risk, because attacker attention arrived before attribution did in every case above. Hardening takeaway: the flaws this week all sit in identity and access plumbing you rarely re-read, the token service on a build registry, the auth check on a print console, the SAML branch on a VPN. Inventory which of these are reachable from an untrusted network, and after you patch the ones holding forged or shared secrets, rotate the secret, because a patch closes the door while a stolen or forged key is still a valid key.

Signed CVEasy threat-intel IOC bundle current as of 2026-09-07. The desktop app verifies the ED25519 signature before import.

The pattern that held all week is that the base score never saw any of this coming. A 9.8 and a 9.3 and a pair at 9.4 and 8.8 all describe severity in the abstract, while the real question was which of your Artifactory tenants faces the internet, which PaperCut console answers a student network, which NetScaler Gateway carries a SAML action. Scoring every finding against your own inventory, and against what attackers are doing this week rather than what the CVSS said in January, is the gap TRIS closes inside our CTEM platform, and the gap I want this letter to close for you every Monday.

Patch well,
Chris Boker
Founder, CVEasy AI