VulnHub

SonicWall has alerted its customers to two zero-day vulnerabilities that are currently being exploited by attackers. These vulnerabilities pose a significant risk as they allow unauthorized access to systems that rely on SonicWall's security products. Users of SonicWall firewalls and secure remote access solutions should prioritize applying the latest security patches to mitigate these risks. The company has emphasized the urgency of these updates, especially as the vulnerabilities are already being used in active attacks. This situation highlights the necessity for organizations to stay vigilant and maintain updated security measures to protect against such threats.

Two recently patched vulnerabilities in the PaperCut NG and MF print management software are now being exploited in data theft attacks. These flaws were initially discovered and addressed last week, but attackers have quickly adapted to use them for unauthorized access to sensitive data. Organizations that rely on PaperCut for managing printing services should be particularly vigilant, as these vulnerabilities could lead to serious data breaches if not properly mitigated. Users are urged to apply the latest security updates immediately to protect their systems from potential exploitation. This situation serves as a reminder of the importance of timely patch management in cybersecurity.

CISA has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence that they are being actively exploited. The vulnerabilities are CVE-2026-81578, which affects PaperCut NG/MF and involves missing authentication for critical functions, and CVE-2026-82078, also related to PaperCut NG/MF, which pertains to unsafe reflection. These vulnerabilities are significant risks, particularly for federal agencies, as they can allow attackers to gain complete control over affected systems. CISA's Binding Operational Directive (BOD) 26-04 mandates that federal agencies prioritize fixing these high-risk vulnerabilities swiftly. While this directive applies specifically to federal agencies, CISA urges all organizations to adopt similar practices for managing vulnerabilities effectively.

PaperCut servers, widely used for print management in schools, hospitals, and offices, are currently facing active attacks. A significant 47% of installations are still running unpatched versions that are vulnerable to a remote code execution flaw. This vulnerability allows attackers to execute code without prior authentication, raising serious security concerns. Researchers from Huntress have identified that these attacks are not just theoretical; they are being actively exploited against real customers. It's critical for organizations using PaperCut to address this issue promptly to protect sensitive data and maintain operational integrity.

PaperCut has issued a second emergency patch for its NG and MF print management software due to two vulnerabilities that are currently being exploited. Researchers found that there were ways to bypass the initial fixes provided in the first patch, which prompted the urgent release of this new update. Organizations using PaperCut's software should prioritize applying this patch to protect against potential attacks, as the vulnerabilities can lead to unauthorized access and exploitation. It’s critical for users to stay informed and ensure their systems are updated to mitigate these risks.

Attackers are taking advantage of a recently patched vulnerability in PaperCut NG and MF software, allowing them to execute arbitrary code without needing authentication. This flaw gives unauthorized users remote access to the application's trusted configuration, which can be exploited to run Java code within the system. PaperCut has responded by releasing an emergency fix to address this issue and enhance security measures. Organizations using these PaperCut products should act quickly to apply the latest updates to safeguard their systems from potential exploitation. Failure to patch could leave systems vulnerable to significant security breaches.

PaperCut has issued an emergency patch in response to a zero-day vulnerability affecting its NG and MF products. Although a CVE identifier has not yet been assigned, the company is urging users to apply the patches immediately and implement any necessary mitigations. This vulnerability is currently being exploited in the wild, which poses a significant risk to users who have not updated their systems. Organizations using PaperCut for print management should prioritize these updates to protect against potential attacks. Failure to act could leave systems open to unauthorized access and exploitation.

PaperCut has issued a warning about a serious vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. This flaw is currently being exploited in the wild, leading to confirmed incidents among its customers. To address the issue, PaperCut has released an emergency patch for versions 25 and 26. The company is prioritizing the resolution of this vulnerability as attackers are actively taking advantage of it. Organizations using these versions should apply the patch immediately to protect their systems from potential breaches.

The Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities include CVE-2023-49105, an improper authentication issue in ownCloud; CVE-2026-53362, an unspecified vulnerability in the Linux Kernel; and CVE-2026-66384, an improper limitation of a pathname in JFrog Artifactory. These vulnerabilities pose significant risks, particularly to federal agencies, which are mandated to prioritize rapid remediation of high-risk flaws under a new directive. While the directive applies to federal entities, CISA encourages all organizations to adopt similar risk-based approaches to vulnerability management. Organizations aware of other exploited vulnerabilities can submit them for consideration to be added to the KEV Catalog.

Ebyte's NA111-M device firmware version 9013-2-17 has multiple serious vulnerabilities that can allow attackers to take full control of the device. These vulnerabilities include issues with authentication, improper request handling, and lack of encryption for sensitive information. Attackers could exploit these flaws to access sensitive configurations, impersonate users, and disrupt device operations. Ebyte has acknowledged the vulnerabilities and is reportedly working on a patch, but there has been no further communication regarding its status. Users of the affected devices are advised to reach out to Ebyte for updates and take precautionary measures until a fix is available.

The Cybersecurity and Infrastructure Security Agency (CISA) has mandated that U.S. government agencies must address a serious remote code execution vulnerability affecting Citrix NetScaler appliances by this Saturday. This flaw is currently being exploited by attackers, which raises urgent concerns for the security of government networks. Citrix NetScaler is widely used for application delivery and load balancing, making it critical for agencies to implement the patch to prevent unauthorized access and potential data breaches. The deadline emphasizes the need for swift action to mitigate risks, as failure to patch could lead to significant security incidents. Agencies are strongly advised to prioritize this update to protect their systems and sensitive information.