The Week in One Line
A critical GitLab GraphQL code-injection flaw moved from disclosure to in-the-wild exploitation within days, Adobe Campaign Classic’s SSRF-to-RCE hit CVSS 10.0 (no known in-the-wild exploitation), PaperCut’s chained zero-days forced emergency patches as attackers planted remote-access tools, and CERT/CC disclosed a pair of Kaltura mwEmbed RCE/file-read flaws that were unpatched at disclosure but received a vendor fix within the reporting week. CISA KEV additions reinforced ongoing pressure on identity, middleware, collaboration, and remote-access surfaces.
Key Takeaways
- Application-layer code injection is back in the spotlight. GitLab CVE-2026-19478 (CVSS 9.4) was disclosed August 17 and confirmed under active in-the-wild exploitation within days, enabling modification or deletion of public projects and repository state rewrites.
- SSRF can still mean instant RCE - but this one wasn't caught in an attack yet. Adobe Campaign Classic CVE-2026-76193 (CVSS 10.0) can enable arbitrary code execution without user interaction; Adobe states it is not aware of any exploitation in the wild.
- Zero-days are weapons before they are headlines. PaperCut CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) were exploited as a chain against NG/MF Application Servers; a second emergency patch followed after the first mitigation was bypassed.
- Unpatched internet-facing endpoints remain a priority - but "unpatched" was a snapshot, not a permanent state. Kaltura mwEmbed flaws in mwEmbedLoader.php were disclosed with no vendor patch available on August 25; Kaltura released a fix for the legacy Player V2 branch by August 28. No exploitation had been reported at the time of writing.
- Microsoft Entra ID CVE-2026-69836 (CVSS 10.0) was server-side mitigated. Microsoft's advisory briefly listed the flaw as exploited before correcting the status to "not exploited" the next day; no customer patching was required either way.
Critical CVEs Actively Exploited
Deep Dives: The Flaws That Matter
GitLab - GraphQL code injection (CVE-2026-19478, CVSS 9.4)
GitLab’s out-of-band update addressed an unauthenticated code-injection flaw affecting self-managed GitLab CE/EE. Improper handling of a GraphQL directive can allow an attacker to modify or delete public projects and associated data under specific conditions. GitLab.com and GitLab Dedicated were vendor-patched; self-managed environments require an immediate upgrade. watchTowr Labs reported reproducing the flaw within minutes of disclosure and later observed honeypot activity consistent with in-the-wild probing; CIRCL’s Vulnerability Lookup lists the CVE as actively exploited with “Confirmed” status.
Affected: 18.2–18.11.10, 19.0–19.0.7, 19.1–19.1.5, 19.2–19.2.3.
Fixed: 18.11.11, 19.0.8, 19.1.6, 19.2.4.
Adobe Campaign Classic - SSRF → RCE (CVE-2026-76193, CVSS 10.0)
Adobe APSB26-134 describes an SSRF vulnerability in Adobe Campaign Classic v7 that could lead to arbitrary code execution in the context of the current user. The maximum CVSS rating and lack of required user interaction make exposed campaign-management systems an urgent patch target, even though Adobe’s own bulletin states it is not aware of any exploitation in the wild for the issues fixed in this release.
Affected: ACC v7 through 7.4.4 build 9400. Fixed: ACC v7 7.4.5 build 9500 or later.
PaperCut NG/MF - chained zero-days (CVE-2026-81578 and CVE-2026-82078)
PaperCut disclosed active exploitation of two vulnerabilities that can be chained: an improper access-control weakness in the web-management interface (CVE-2026-81578, CVSS 8.8) and unsafe dynamic class loading in database connection utilities (CVE-2026-82078, CVSS 9.4). Huntress reported exploitation in at least two customer environments and reproduced the full attack chain against a clean install. The chain enabled pre-authentication server compromise and was followed by reports of attackers installing remote-access software. A second emergency update (Emergency Patch Release 2) was issued after researchers demonstrated bypasses of the first fix. CISA added both CVEs to its KEV catalog on August 31.
Action: Apply PaperCut’s second emergency update, remove unnecessary internet exposure, and hunt for Remote Access Service (SimpleService.exe), AnyDesk, unexpected Java child processes, and altered PaperCut configuration.
Kaltura mwEmbed - deserialization RCE/file read, unpatched at disclosure (CVE-2026-19912 / CVE-2026-19913)
CERT/CC disclosed two vulnerabilities in Kaltura’s legacy mwEmbed (Player V2 / html5lib) HTML5 player library. Unsafe deserialization in mwEmbedLoader.php can permit unauthenticated arbitrary file reads (CVE-2026-19913) and code execution via a path-traversal-assisted write (CVE-2026-19912). CERT/CC said it was unable to reach Kaltura to coordinate disclosure, and no vendor patch was available as of the August 25 publication date.
Note on severity scores: the 10.0 / 9.1 CVSS figures circulating in press coverage were assigned by the reporting researcher, not by CERT/CC or NVD – no NVD record existed for either CVE as of disclosure.
Update: CERT/CC’s vulnerability note was revised August 28 to confirm Kaltura had released patches for all affected legacy Player V2 versions; the currently supported Player V7 was never affected. No in-the-wild exploitation had been reported as of this writing.
Action: Restrict public access to mwEmbedLoader.php, enforce allow-lists for ServiceUrl, monitor for malformed serialized input, rotate exposed secrets, and apply Kaltura’s patch or migrate to Player V7.
Microsoft Entra ID - deserialization RCE (CVE-2026-69836, CVSS 10.0)
Microsoft disclosed a maximum-severity Entra ID deserialization flaw. The initial advisory listed the vulnerability as exploited in the wild; Microsoft corrected that status to “not exploited” the following day without explaining the discrepancy, and confirmed the issue was fully mitigated server-side. Customers had no patching action, but security teams should confirm identity-service telemetry and incident-response processes are ready for high-impact cloud identity advisories, and treat the exploitation-status reversal as a reminder to verify vendor-published exploitation claims rather than take them at face value.
Action: No customer software patch required; monitor Microsoft advisories and validate privileged-access, sign-in, and workload-identity logging.
High-Severity Web/API CVEs to Prioritize
What to Do This Week
- Patch immediately: Self-managed GitLab, Adobe Campaign Classic, PaperCut NG/MF (second emergency release), Apache Tomcat, Oracle WebLogic Proxy Plug-in, Zimbra, miniOrange SAML SSO for Joomla, Apache Hive, and affected WordPress components/core. Remove or isolate the Total Donations plugin - no patch exists.
- Validate exposure: Identify internet-facing GitLab, ACC, PaperCut administration consoles, Tomcat, SharePoint, identity gateways, Zimbra, WebLogic proxy deployments, and any legacy Kaltura Player V2/html5lib instances.
- Hunt for PaperCut post-exploitation: Investigate Remote Access Service (SimpleService.exe), AnyDesk, abnormal Java processes, persistence mechanisms, unusual outbound connections, and configuration changes.
- Apply virtual patching: Deploy or verify WAF/WAAP controls for suspicious GraphQL directives, SSRF egress behavior, unsafe deserialization attempts, SQL injection, file-upload abuse, and known WordPress exploit paths.
- Protect APIs: Enforce object-level authorization, schema validation, rate limits, bot controls, and anomaly detection on account, administrative, payment, loyalty, and customer-data APIs.
How Unified WAAP Protection Helps
The incidents this week converge on the same operational challenge: exposed web interfaces, APIs, identity components, and management consoles are being exploited faster than patch cycles can reliably close. A unified WAAP approach can reduce this window with virtual patching, continuous API discovery, behavioral bot detection, L7 DDoS mitigation, and centralized visibility across web and API attack paths.
- Virtual patching to block exploit attempts during emergency patch validation and rollout.
- Continuous API discovery and governance to find undocumented or overly exposed endpoints.
- Behavioral bot detection for credential stuffing, automated scanning, scraping, and business-logic abuse.
- Integrated L3/L4/L7 DDoS mitigation for blended volumetric and application-layer attacks.
Frequently Asked Questions (FAQ)
1. What is a WAAP and how is it different from a traditional WAF?
A WAAP (Web Application and API Protection) platform combines WAF, API security, bot management, and DDoS mitigation into a single unified layer, versus a traditional WAF, which only filters known web application attack signatures.
2. Why are APIs the top attack surface in 2026?
APIs often expose sensitive data with limited monitoring, and attackers now favor behavior-based abuse (scraping, credential stuffing, business-logic exploitation) that bypasses traditional signature-based defenses.
3. What is virtual patching?
Virtual patching blocks exploitation of a known vulnerability at the WAAP/WAF layer before an official software patch is applied or deployed, reducing the exposure window.
4. Which vulnerabilities from August 24–31, 2026 should I prioritize?
Prioritize actively exploited flaws on internet-facing systems first—led by GitLab CVE-2026-19478, Adobe CVE-2026-76193, PaperCut CVE-2026-81578/82078, and Kaltura’s unpatched mwEmbed flaws—then work down remaining critical CVEs by asset exposure.
5. How does a WAAP help when I can’t patch immediately?
Virtual patching blocks the exploit path at the edge as soon as a CVE is disclosed, buying time to test and deploy the vendor patch safely.
