Weekly Cybersecurity Update: 31 August – 7 September 2026

1. Critical JFrog Artifactory Vulnerability Exploited to Create Admin Tokens

Attackers are actively exploiting a critical authentication bypass vulnerability in JFrog Artifactory only days after the vulnerability was publicly disclosed. The flaw can allow unauthenticated attackers with network access to obtain administrative privileges in affected Artifactory installations.

JFrog released a security update on 28 August, but researchers observed exploitation beginning on 1 September, highlighting the risk to organisations that have not yet patched their Artifactory environments.

CVE ID: CVE-2026-82329 (CVSS 9.8)

Why It Matters: JFrog Artifactory is commonly used to store and distribute software packages and build artefacts. Successful exploitation could provide attackers with administrative access to repositories, credentials and software supply-chain infrastructure.

Actions: Upgrade affected JFrog Artifactory installations to version 7.161.20 or later, or the appropriate fixed version for your release branch. Review audit logs for unexpected administrator tokens, account changes and repository activity, and rotate credentials that may have been exposed.

Source: The Hacker News – Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure thehackernews.com/2026/09/attackers-exploit-critical-jfrog.html

2. SonicWall SMA1000 Zero-Days Actively Exploited in the Wild

Attackers are actively exploiting two vulnerabilities affecting SonicWall SMA1000 secure remote-access appliances. SonicWall disclosed the vulnerabilities on 1 September and confirmed that they were being exploited in the wild.

The vulnerabilities can be chained to achieve unauthenticated remote code execution, potentially giving attackers control of affected remote-access infrastructure.

CVE ID: CVE-2026-83548 and CVE-2026-83549

Why It Matters: SMA1000 appliances provide remote access to enterprise environments and are positioned at the network perimeter. Successful exploitation could allow attackers to compromise the appliance and use it as an entry point into internal systems.

Actions: Upgrade affected SMA1000 appliances to 12.4.3-03526 or 12.5.0-02952 or later, as applicable. Review affected appliances for indicators of compromise and, if compromise is suspected, re-image or redeploy the appliance, change user and administrator passwords, and reset TOTP tokens.

Source: NHS England Digital – Exploitation of Zero-Day Vulnerabilities in SonicWall SMA1000 Series Appliances digital.nhs.uk/cyber-alerts/2026/cc-4840

3. Over 440,000 Exploit Attempts Target WordPress Plugins

Security researchers have observed more than 440,000 exploitation attempts targeting critical vulnerabilities in the Super Forms and Elementor Pro WordPress plugins.

The vulnerabilities allow unauthenticated attackers to upload arbitrary files, including executable PHP files, which can ultimately provide remote code execution and full control of affected WordPress websites.

CVE ID: CVE-2026-14894 and CVE-2026-32475

Why It Matters: WordPress is widely used by organisations across multiple industries. Compromised websites can be used to steal data, create administrator accounts, distribute malware, deface websites or establish persistent access.

Actions: Update Super Forms to version 6.3.314 or later and Elementor Pro to version 4.2.2 or later. Review WordPress administrator accounts, uploaded files and web-server logs for signs of compromise.

Source: The Hacker News – Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws thehackernews.com/2026/09/over-440000-exploit-attempts-target.html

4. Chrome Zero-Day Actively Exploited in the Wild

Google has released security updates for Chrome after confirming active exploitation of a high-severity vulnerability affecting the browser's V8 JavaScript and WebAssembly engine.

The vulnerability is a type-confusion flaw that can allow a remote attacker to execute arbitrary code inside the Chrome sandbox through a specially crafted HTML page.

CVE ID: CVE-2026-85046 (CVSS 8.8)

Why It Matters: Web browsers are widely deployed across enterprise environments and are frequently targeted because successful exploitation can compromise users through malicious or compromised websites.

Actions: Update Chrome to version 152.0.7977.82 or later immediately. Ensure other Chromium-based browsers are also updated when their respective security patches become available, and monitor endpoints for suspicious browser-child processes.

Source: The Hacker News – Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html

Key Recommendations

• Prioritise actively exploited vulnerabilities: Review exposure to CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-14894, CVE-2026-32475 and CVE-2026-85046 and apply available security updates as a priority.

• Secure internet-facing infrastructure: Prioritise SonicWall SMA1000, JFrog Artifactory and externally accessible WordPress installations.

• Patch perimeter devices: Give urgent attention to VPN, remote-access appliances, network infrastructure and other internet-facing systems.

• Monitor for exploitation: Review logs for unexpected administrator accounts, authentication tokens, configuration changes, malicious files, web shells and unusual outbound connections.

• Protect credentials: Rotate administrative credentials, API keys and authentication tokens where vulnerable systems may have been compromised.

• Maintain incident-response readiness: Investigate any vulnerable internet-facing systems that remained exposed during active exploitation for persistence, privilege escalation, credential theft and data exfiltration.