Security Signal Weekly: August 29-September 4, 2026

Overview

This week put exposed edge systems, trusted login paths, and internet-facing business software back at the front of the queue. SonicWall and Sangoma confirmed exploitation against remote-access and phone-system products, Google patched another Chrome zero-day, and CISA added seven flaws spanning appliances, developer infrastructure, Python services, and AI tooling to its exploited-vulnerability catalog.

The incident side showed the same trust problem from a different angle. A Lenovo identity path opened Dropbox accounts without their normal passwords, a dark-web service offered an enormous collection of identity-document scans, and court backup data was accessed through a vendor cloud environment. My practical takeaway is to verify every inherited trust path, not just the product name on the contract or the asset name in the inventory.

Reality check: A patch closes the documented entry point. It does not erase sessions, shells, tokens, or data access that may have happened before the update, so remediation and investigation still have to be separate tasks.

Top 10 Security Signals

1. SonicWall SMA 1000 flaws are being exploited

What happened: SonicWall confirmed active exploitation of two vulnerabilities affecting SMA 1000 appliances: CVE-2026-83548, a pre-authentication server-side request forgery flaw in the WorkPlace interface, and CVE-2026-83549, a post-authentication remote-code-execution issue in the management environment. The vendor notice lists fixed platform hotfixes 12.4.3-03526 and 12.5.0-02952 and directs customers to contact support for compromise review; CISA added both flaws to its Known Exploited Vulnerabilities catalog.

Why it matters: An internet-facing remote-access appliance already sits on a trusted path into the network. The two weaknesses affect different interfaces and privilege states, so treating this as a routine firmware ticket misses the possibility that an attacker used one weakness to reach the conditions needed for the other.

Action:

• Upgrade every affected physical and virtual SMA 1000 appliance to the fixed hotfix for its release line, then verify the running build on each node.
• Open a SonicWall support case for the recommended indicator review and preserve appliance logs and configuration before making further cleanup changes.
• If indicators are found, re-image or redeploy the appliance, rotate user and administrator passwords, reset TOTP tokens, and review downstream sessions created before remediation.

2. Chrome patches its sixth exploited zero-day of 2026

What happened: Google released Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux to fix 12 security issues. The Chrome release bulletin says CVE-2026-85046 is a high-severity type-confusion flaw in V8 and that an exploit exists in the wild.

Why it matters: A browser exploit reaches users through ordinary web content and can move quickly across a mixed fleet. Google has not published attack details, which limits hunting, but confirmed exploitation is enough to make version verification urgent rather than waiting for a normal maintenance cycle.

Action:

• Force or accelerate the Chrome update across managed Windows, macOS, and Linux devices and verify the installed version after relaunch.
• Track Chromium-based browsers separately and confirm when each vendor ships a build containing the V8 fix.
• Review browser, endpoint, web-filtering, and identity telemetry for unusual renderer crashes, child-process behavior, or suspicious sessions on devices that were behind the fixed version.

3. Switchvox SQL injection is dropping reverse shells

What happened: Horizon3 observed active attempts against CVE-2026-9586 beginning August 30. Its technical report shows that an unauthenticated request to the Switchvox phone-notification endpoint can inject PostgreSQL commands and execute operating-system commands as the database superuser; Sangoma patched the issue in Switchvox 8.4.0.2, and CISA added it to the KEV catalog.

Why it matters: A business phone platform is easy to leave exposed because availability pressure is high and ownership is often split between telecom and IT. Successful exploitation gives an attacker a shell on an appliance that may have broad internal reach and contains call, voicemail, extension, and administrative data.

Action:

• Upgrade Switchvox to 8.4.0.2 or later and remove direct internet access to the management and phone-application interfaces wherever possible.
• Inspect /var/log/switchvox/db-quirks.log for injected COPY TO PROGRAM statements and search network telemetry for connections involving 176.65.148.184.
• Hunt for unexpected outbound shells, process-enumeration commands, new accounts, changed phone settings, and other activity originating from the appliance before it was patched.

4. CISA’s KEV update reaches developer and AI infrastructure

What happened: CISA added seven exploited flaws on September 2, including CVE-2026-82329 in JFrog Artifactory, CVE-2026-49869 in Kestra OSS, CVE-2026-59822 in LiteLLM, and CVE-2026-48710 in Starlette alongside the SonicWall and Switchvox entries above. The primary advisories describe unauthenticated administrative access in self-hosted Artifactory, unauthenticated workflow execution in Kestra, an MCP authentication bypass in LiteLLM, and path-based authorization bypass conditions in Starlette.

Why it matters: These products sit behind build pipelines, automation, APIs, and agent tooling, where one compromise can expose package repositories, cloud credentials, internal services, or callable tools. The affected versions may not appear in a normal endpoint software inventory because they often run as containers or application dependencies.

Action:

• Inventory self-hosted Artifactory, Kestra, LiteLLM, and Starlette deployments through container registries, SBOMs, infrastructure code, and runtime discovery rather than endpoint records alone.
• Apply the fixed versions from each maintainer, restrict management and MCP routes, and remove public exposure that is not required.
• Review administrative changes, workflow executions, package publishing, MCP tool calls, service-account use, and cloud-metadata access from the affected services before the patch window.

5. Cisco’s September release fixes root-level switch flaws

What happened: Cisco’s September 2 advisory release includes critical IOS XR issues and CVE-2026-20212, a Nexus 9000 Silicon One flaw that exposes TCP ports 43210 and 43211 in the default Layer 3 VRF and can allow unauthenticated root-level code execution. Cisco also disclosed two unpatched Secure Email S/MIME weaknesses that can let an attacker in a machine-in-the-middle position recover plaintext from encrypted gateway traffic; Cisco said it was not aware of malicious use of these issues.

Why it matters: Core switches and email gateways are high-trust infrastructure, and a successful attack can affect traffic far beyond the device itself. The Secure Email issue also shows why encrypted transport is not enough when message integrity checks can be manipulated.

Action:

• Match Nexus 9000, IOS XR, phone, and Secure Email assets to the exact Cisco advisories and fixed releases instead of treating the publication as one generic network update.
• Restrict access to Nexus ports 43210 and 43211 using the vendor workaround until upgrades are complete, and verify management-plane exposure from each reachable network.
• For Secure Email with S/MIME enabled, document the current lack of a workaround, obtain the fixed release through Cisco support, and review whether any network path could intercept gateway-to-gateway traffic.

6. Elementor Pro file-upload flaw is under mass attack

What happened: Attackers are exploiting CVE-2026-32475 in Elementor Pro 4.2.1 and earlier to bypass file validation, upload PHP web shells, and execute commands. Patchstack’s disclosure explains the mismatch between the validation and file-move loops, while current attack reporting says Wordfence blocked nearly 200,000 attempts and identifies 4.2.2 as the fixed version.

Why it matters: The vulnerable Form widget turns a normal public upload field into unauthenticated code execution. Updating stops new exploitation, but it does not remove a PHP file that may already be sitting in a web-accessible uploads directory.

Action:

• Update Elementor Pro to 4.2.2 or later on every site and verify that compatible Elementor core and Pro versions are active after the change.
• Inspect wp-content/uploads/elementor/forms/ and the wider uploads tree for PHP files, unexpected recent changes, and web-shell behavior.
• Review web logs for suspicious multipart form requests and follow-on access to newly created PHP paths, then rotate WordPress and hosting credentials if compromise is found.

7. A Lenovo login path opened thousands of Dropbox accounts

What happened: Dropbox notified affected users that a weakness in Lenovo’s email-verification process allowed an unauthorized party to register Lenovo IDs with other people’s email addresses and use those identities to enter linked Dropbox accounts. Dropbox’s statements reported by ITPro put the affected population at about 5,000 accounts, with files viewed or downloaded from roughly 1,500; Dropbox expired Lenovo-authenticated sessions, severed the integration, and now requires the Dropbox password for that login path.

Why it matters: The attacker did not need the victim’s normal Dropbox password because trust had been delegated to another identity provider. This is the kind of inherited authentication path that can remain invisible to users and security teams until it is abused.

Action:

• Identify users who received Dropbox’s notice, reset their credentials, require MFA, and review account activity and file-access history for the affected period.
• Audit enterprise cloud services for social-login, SSO, OAuth, and partner identity connections that can authenticate users outside the normal corporate control path.
• Revoke stale sessions and third-party grants, and make reauthentication with the primary account credential mandatory after identity-provider changes.

8. A dark-web service offered 153 million license scans

What happened: Investigative reporter Brian Krebs found a new identity-theft service offering more than 153 million US and Canadian driver’s-license scans plus other identity documents. Krebs’s investigation linked the imaging format and timestamps to IDScan.net customers and confirmed that the FBI opened an inquiry; IDScan.net said it was investigating but had not yet published a substantive finding, and the dark-web service later disappeared.

Why it matters: A license image is often treated as durable proof of identity even though it is a copyable file. At this scale, organizations should assume that document-based identity checks can be replayed against account recovery, lending, rental, healthcare, and government workflows.

Action:

• Do not treat a matching license image as sufficient proof for password resets, MFA removal, new credit, or sensitive profile changes; require an independent signal.
• Organizations that use ID scanning should map which vendor receives the images, why they are retained, how bulk access is monitored, and when deletion is enforced.
• Individuals who receive a confirmed notice should freeze credit where appropriate, monitor financial and government accounts, and use the provider’s official recovery process rather than links in unsolicited messages.

9. Thomson Reuters court backups exposed sensitive case data

What happened: Court systems disclosed unauthorized access to backup files stored in a Thomson Reuters cloud environment for the C-Track case-management platform. The Montana judiciary’s notice says access occurred from March 1 through June 29 and affected multiple states; reporting and coordinated notices indicate that exposed material can include sealed court records and personally identifiable information.

Why it matters: Court backups can contain information that is deliberately restricted in the live system, including details about minors, witnesses, sealed proceedings, and identity records. A backup held by a vendor is still production-sensitive data even when the court’s own network was not breached.

Action:

• Courts and agencies using C-Track should obtain their exact affected-file scope from Thomson Reuters and preserve local access, export, and integration logs for correlation.
• Review backup storage permissions, vendor administrator access, retention, encryption keys, and whether sealed records receive controls equivalent to the live case system.
• Use the official C-Track notification process for potentially affected people and warn staff about follow-on phishing that references real case or court details.

10. RMM phishing campaign reaches 46 countries

What happened: ANY.RUN connected 601 observed cases across 46 countries to a campaign that uses tax forms, shipping notices, invoices, Social Security themes, and fake Adobe pages to persuade victims to install legitimate remote-management tools. The company’s September research summary says 45% of the activity was associated with the United States and names GoTo Resolve, LogMeIn Rescue, ScreenConnect, and ConnectWise among the abused products.

Why it matters: Legitimate remote-management software is signed, familiar, and designed to provide durable hands-on access, so malware-only controls can miss the dangerous part of the chain. The campaign rotates domains quickly while reusing delivery patterns and product behavior.

Action:

• Allow only approved RMM products, tenants, installers, and support workflows; block or alert on first-time execution of unapproved remote-management tools.
• Tune email, web, and network detections for the stable delivery patterns and fake document themes rather than relying only on short-lived domains.
• If an unauthorized RMM tool appears, isolate the device, preserve installer and session artifacts, revoke active remote sessions, and review identity activity from the time of installation.

Closing Notes

My first calls this week are the SonicWall and Switchvox appliances because exploitation is confirmed and both products can give an attacker trusted network access. Chrome should move just as quickly across the endpoint fleet, while the CISA additions need a different inventory pass through containers, package repositories, workflow services, Python applications, and MCP gateways.

The Dropbox, ID-scan, and court-system incidents all land on the same uncomfortable point: a trusted partner can create a second path to your data or identity that your normal controls never see. Map those paths now, make recovery require more than a reusable document or inherited login, and keep the claims narrow until each investigation publishes verified scope.