Chained for Code Execution: The PaperCut Two-Stage Attack and the JFrog Artifactory Path Traversal

Three vulnerabilities in this batch directly target the software delivery and document infrastructure that DevOps and enterprise operations teams depend on daily, and two of them are explicitly designed to be chained together.

CVE-2026-81578 and CVE-2026-82078 (PaperCut NG/MF) were added simultaneously on August 28 with a shared deadline of September 11, and CISA's catalog explicitly acknowledges the chaining relationship. The attack sequence is straightforward and devastating: CVE-2026-81578 provides unauthenticated access to modify system configurations — no credentials required — and CVE-2026-82078 then exploits an unsafe reflection vulnerability to execute arbitrary Java bytecode already on the application classpath under the PaperCut server process security context. Together, these constitute a full unauthenticated remote code execution chain against any internet-exposed PaperCut server. PaperCut is deeply embedded in university, government, and enterprise print environments, many of which expose the management interface externally for remote administration convenience. That convenience is now a critical liability. Until patching is complete, remove the PaperCut Application Server port (typically 9191/9192) from any internet-accessible firewall rule, enforce network segmentation between print servers and core infrastructure, and review PaperCut server process permissions to limit the blast radius of the underlying service account.

CVE-2026-66384 (JFrog Artifactory Path Traversal) carries a deadline of September 10 and represents a distinct but equally consequential risk for DevOps pipelines. The vulnerability allows an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions — a path traversal that, in a CI/CD environment, could enable artifact poisoning, configuration file overwriting, or deployment of malicious container images into downstream pipelines. Unlike the PaperCut chain, this requires authentication, but insider threat and compromised CI service accounts must be considered realistic threat actors. Audit Artifactory remote repository configurations now, restrict write permissions to Docker cache paths using Artifactory's permission target controls, and review recent artifact push activity from service accounts for anomalous paths.

Legacy Debt Coming Due: Linux Kernel, Red Hat Libuser, and ABRT

The final cluster is a cautionary tale about deferred maintenance. Three vulnerabilities from 2015 and one from 2026 reflect a spectrum of local privilege escalation risks across Linux environments.

CVE-2026-53362 (Linux Kernel) is the most urgent of this group, with a September 10 deadline and cross-distribution impact confirmed across SUSE, Red Hat, and any Linux distribution using the affected kernel version. The vulnerability enables privilege escalation via the IPv6 networking subsystem — meaning any multi-tenant or container host environment where IPv6 is enabled could allow a low-privileged process or container workload to escalate to root. Disable IPv6 where not operationally required as an immediate interim measure, and prioritize kernel patching on hosts running container workloads, hypervisors, or shared compute environments.

CVE-2015-3246 (Red Hat Libuser) and CVE-2015-5287 (Red Hat ABRT) — both with deadlines of September 9 — are eleven-year-old vulnerabilities now confirmed exploited in the wild. The libuser race condition allows /etc/passwd corruption for denial of service or privilege escalation; the ABRT symlink attack enables privilege escalation for local users with specific permissions. ABRT is explicitly noted as potentially end-of-life. Organizations still running affected Red Hat versions should assess whether those systems can be upgraded or decommissioned. If neither is immediately feasible, restrict local user permissions aggressively, audit sudoers configurations, and treat any local account on these systems as a potential escalation vector.

Sources: CISA KEV Catalog · CISA BOD 26-04 · PaperCut Security Advisories · ownCloud Security Advisories · JFrog Security Center · Red Hat Security Advisories · Microsoft Security Response Center — CVE-2019-1068