CISA Adds Seven Exploited Vulnerabilities in SonicWall, JFrog and Kestra to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) has added seven known exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively targeting products from SonicWall, JFrog and Kestra.
Two of the flaws affect the remote-access appliance SonicWall SMA1000. CVE-2026-83548 is a server-side request forgery vulnerability that allows unauthenticated attackers to reach protected internal functions. CVE-2026-83549 permits an authenticated administrator to execute arbitrary operating-system commands on the underlying host.
A third critical issue, CVE-2026-82329, resides in the software-distribution platform JFrog Artifactory. The flaw stems from improper authentication handling and can be exploited remotely to obtain full administrative control without prior credentials.
Additionally, Kestra OSS, an open-source workflow-automation platform, is affected by CVE-2026-49869, an operating-system command-injection vulnerability that enables attackers to run arbitrary commands on the server.
CISA has set a remediation deadline of 5 September 2026 for five of the seven vulnerabilities for all US federal civilian agencies and has directed organizations to conduct compromise assessments.
Related articles
Cisco Issues Security Updates for IOS XR Fixing Multiple Critical Vulnerabilities
Cisco Systems has released security updates for its network operating system Cisco IOS XR to address multiple vulnerabilities discovered through internal research. The update, published on September 2, 2026, classifies the flaws into seven categories, each assigned distinct CVE identifiers. Two vulnerabilities, CVE-2026-20274 and CVE-2026-20279, received the highest CVSS v3.1 base score of 9.8 and are rated Critical. Additional issues include command injection flaws rated 8.8 and other weaknesses scoring between 8.2 and 8.6. No exploitation has been observed at the time of disclosure. Cisco is distributing Software Maintenance Updates and plans to include fixes in upcoming releases 26.3.1 and 26.2.2.
Telegram Desktop Bug Deletes Up to 800 GB of User Data on Windows Due to Spellcheck Library Error
A critical configuration flaw in Telegram Desktop for Windows caused the application to recursively delete the entire contents of the C:\custom directory, resulting in the loss of approximately 800 GB of user data including programs, projects, and personal files. The issue originated in the lib_spellcheck library introduced in version 7.1.0, where an empty working directory path was concatenated with /custom and resolved by Qt into an absolute system path. Instead of locating a dictionary file, the code invoked removeRecursively() on the discovered directory, systematically erasing all accessible files while leaving folder structures intact. The bug affected only Windows builds with the built-in spellchecker enabled and remained in distribution for roughly 66 hours across versions 7.1.0 and 7.1.1. Researchers confirmed the behavior using Process Monitor logs and reported it via ticket #31170, prompting developers to add path validation before the function call and disable dictionary operations on empty paths. The corrected code was released in Telegram Desktop 7.1.2, and users running the vulnerable versions are advised to update immediately. No impact was observed on Linux or macOS platforms.
Essential Active Directory Checks Before Launching Any Penetration Test
Internal penetration tests of Active Directory can quickly generate noise in logs or disrupt services if techniques are applied without proper context. The article stresses that testers must first map domain boundaries, identify controllers, clarify allowed segments, and establish escalation procedures with the client. Detailed inventory of user, service, and privileged accounts is required, including analysis of Kerberos pre-authentication settings that enable AS-REP Roasting. Testers should also examine DACL permissions, delegation relationships, and Active Directory Certificate Services templates before attempting any exploitation. The guidance covers NTLM relay risks, the importance of maintaining an action log, and the distinction between standard pentests and Red Team engagements. A demo version of the Red September course on Active Directory attacks is offered to practice these steps in a controlled environment.
Attackers Exploit Critical Sangoma Switchvox SQL Injection Flaw CVE-2026-9586 to Deploy Reverse Shells Without Credentials
A critical vulnerability in Sangoma Switchvox allows unauthenticated remote code execution through SQL injection in the /pa HTTP endpoint. The flaw, tracked as CVE-2026-9586 with a CVSS score of 9.3, affects internet-exposed VoIP deployments common in SMB environments. Attackers have already leveraged the issue in active campaigns since August 30, 2026, to open reverse shells and perform reconnaissance using Base64-encoded commands. The root cause is improper handling of the PhoneIP parameter in PostgreSQL queries, classified as CWE-89, which grants superuser database privileges. Sangoma released the fix in Switchvox 8.4.0.2 on July 14, 2026, following initial disclosure in April. Administrators are urged to patch immediately, restrict access, and monitor for indicators such as connections to 176.65.148.184 and suspicious entries in /var/log/switchvox/db-quirks.log.