8 minhigh
Cyber Centre Daily Advisory Digest — 2026-09-02 (6 advisories)
The Canadian Centre for Cyber Security published six security advisories on September 2, 2026, covering vulnerabilities in Schneider Electric, HPE, Google Chrome, Progress Software Telerik, SonicWall, and JFrog Artifactory. Three CVEs (CVE-2026-83548, CVE-2026-83549 on SonicWall SMA1000, and CVE-2026-82329 on JFrog Artifactory) are confirmed as actively exploited in the wild and have been added to CISA's Known Exploited Vulnerabilities Database. Two additional Telerik UI for ASP.NET AJAX vulnerabilities (CVE-2026-18672 path traversal and CVE-2026-19219 upload path tampering) were disclosed without confirmed active exploitation.
Sens:■ Immediate
Showing defanged values
- cveCVE-2026-18672Path traversal vulnerability in Telerik Web Forms RadImageEditor allows unauthorized file system access.
- cveCVE-2026-19219DialogHandler UploadPaths tampering vulnerability allows modification of upload path configurations.
- cveCVE-2026-82329Vulnerability in JFrog Artifactory that is being actively exploited in the wild.
- cveCVE-2026-83548Vulnerability in SonicWall SMA1000 that is being actively exploited in the wild.
- cveCVE-2026-83549Vulnerability in SonicWall SMA1000 that is being actively exploited in the wild.
Detection / Hunteropenrouter
What Happened
The Canadian government's cyber security agency issued six security alerts on September 2, 2026, warning about software flaws in products from Schneider Electric, HPE, Google, Progress Software, SonicWall, and JFrog. Three of these flaws — two in SonicWall network security appliances and one in JFrog's Artifactory software — are confirmed to be actively used by attackers and have been added to a US government watchlist of exploited vulnerabilities (the Known Exploited Vulnerabilities Database maintained by CISA). Organizations using any of the affected products should review the advisories and apply available updates as soon as possible, prioritizing the actively exploited SonicWall and JFrog vulnerabilities.
Key Takeaways
- Three CVEs have been confirmed as actively exploited and added to CISA's Known Exploited Vulnerabilities Database: CVE-2026-83548 and CVE-2026-83549 (SonicWall SMA1000) and CVE-2026-82329 (JFrog Artifactory)
- SonicWall SMA1000 appliances running 12.4.3-03453 and older or 12.5.0-02835 and older are affected by two actively exploited vulnerabilities
- JFrog Artifactory is affected by CVE-2026-82329 which is being exploited across multiple version branches prior to 7.161.20
- Telerik UI for ASP.NET AJAX has a path traversal vulnerability (CVE-2026-18672) and a DialogHandler UploadPaths tampering vulnerability (CVE-2026-19219)
- Six advisories were published covering Schneider Electric, HPE, Google Chrome, Progress Software, SonicWall, and JFrog products
Affected Systems
- Schneider Electric NetBotz 5 - 750/755 (versions <= 5.5.2)
- Schneider Electric PowerChute Serial Shutdown (versions <= 1.5)
- HPE Networking AOS-CX (versions <= 10.10.1180, <= 10.13.1180, <= 10.16.1051, <= 10.17.1021, <= 10.18.0001)
- HPE Networking Fabric Composer (versions <= 7.3.3)
- Google Chrome (versions < 152.0.7977.75)
- Progress Software Telerik UI for ASP.NET AJAX (versions < 2026.3.812)
- SonicWall SMA1000 - 6210, 7210, 8200v (12.4.3-03453 and older, 12.5.0-02835 and older)
- JFrog Artifactory (versions < 7.111.21, < 7.117.28, < 7.125.20, < 7.133.29, < 7.146.38, < 7.161.20)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-18672 | Progress Software Telerik UI for ASP.NET AJAX | Path traversal vulnerability in Telerik Web Forms RadImageEditor allows unauthorized file system access. | |
| CVE-2026-19219 | Progress Software Telerik UI for ASP.NET AJAX | DialogHandler UploadPaths tampering vulnerability allows modification of upload path configurations. | |
| CVE-2026-83548 | SonicWall SMA1000 (6210, 7210, 8200v) | Vulnerability in SonicWall SMA1000 that is being actively exploited in the wild. | |
| CVE-2026-83549 | SonicWall SMA1000 (6210, 7210, 8200v) | Vulnerability in SonicWall SMA1000 that is being actively exploited in the wild. | |
| CVE-2026-82329 | JFrog Artifactory | Vulnerability in JFrog Artifactory that is being actively exploited in the wild. |
Attack Chain
- Exposure: SonicWall SMA1000 appliances running 12.4.3-03453 or older and 12.5.0-02835 or older, and JFrog Artifactory instances across multiple version branches, are exposed to exploitation
- Exploitation: CVE-2026-83548, CVE-2026-83549, and CVE-2026-82329 are confirmed as actively exploited in the wild by unknown actors
- Validation: CISA adds the three exploited CVEs to its Known Exploited Vulnerabilities Database on September 2, 2026
- Remediation: Users and administrators are advised to review vendor advisories and apply available updates, prioritizing actively exploited vulnerabilities
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the advisories. The article references vendor security bulletins and CISA KEV entries for additional information.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The affected products are network appliances (SonicWall SMA1000), development platforms (JFrog Artifactory), and IoT/infrastructure devices that would not typically have EDR coverage. Endpoint detection would not apply to most of these vulnerabilities. |
| Network Visibility | Medium | Network-level monitoring could detect exploitation attempts against SonicWall SMA and JFrog Artifactory if those services are exposed. IDS or network flow monitoring would require signatures for the specific CVE exploitation patterns. |
| Detection Difficulty | Moderate | Detecting exploitation of these CVEs requires visibility into network appliance and application logs that may not be centralized. Vendor-specific exploitation indicators are not provided in the advisories, requiring defenders to consult vendor security bulletins for detection guidance. |
Required Log Sources
- SonicWall SMA1000 appliance logs
- JFrog Artifactory access and audit logs
- Web Application Firewall (WAF) logs for Telerik deployments
- Network firewall and IDS logs
- IIS or reverse proxy logs for Telerik UI for ASP.NET AJAX
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unusual HTTP requests targeting SonicWall SMA1000 web management interfaces that may indicate exploitation of CVE-2026-83548 or CVE-2026-83549. | SonicWall appliance access logs, reverse proxy logs, network IDS alerts, firewall logs | Initial Access | Medium — legitimate administrative access to SMA1000 appliances may generate similar traffic patterns. |
| Consider hunting for unusual API calls or access patterns to JFrog Artifactory instances that deviate from baseline usage, potentially indicating exploitation of CVE-2026-82329. | Artifactory access logs, Artifactory audit logs, reverse proxy or load balancer logs | Initial Access | Medium — CI/CD pipeline automation may generate high-volume API calls that resemble anomalous activity. |
| Consider hunting for path traversal patterns in web server requests targeting Telerik UI for ASP.NET AJAX endpoints, which may indicate exploitation of CVE-2026-18672. | WAF logs, IIS logs, reverse proxy logs, application-level request logging | Initial Access | Low — path traversal sequences in requests to Telerik handlers are typically anomalous. |
| Consider hunting for authentication brute-force attempts against Schneider Electric PowerChute Serial Shutdown, which has an improper restriction of excessive authentication attempts vulnerability. | PowerChute Serial Shutdown authentication logs, system event logs, network logs to the PowerChute service | Initial Access | Low — repeated failed authentication attempts are typically anomalous. |
Control Gaps
- EDR solutions would not provide visibility into network appliance exploitation (SonicWall SMA1000)
- Network-based IDS may lack signatures for these specific CVE exploitation patterns without vendor-provided detection rules
- Artifactory exploitation may occur over legitimate API channels, potentially bypassing network behavioral detection
Key Behavioral Indicators
- Unusual HTTP requests to SonicWall SMA1000 management interfaces from non-administrative source IPs
- Anomalous API call patterns to JFrog Artifactory REST endpoints from previously unseen source addresses
- Path traversal sequences in HTTP requests targeting Telerik RadImageEditor or DialogHandler endpoints
- Repeated failed authentication attempts to Schneider Electric PowerChute Serial Shutdown service
- Connections to SonicWall SMA1000 or JFrog Artifactory from unexpected geographic regions or IP ranges
False Positive Assessment
Low — the advisories reference specific CVEs with confirmed active exploitation validated by CISA. Detection based on these specific vulnerability patterns would have minimal false positive risk, though network appliance log noise may require tuning.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Prioritize patching SonicWall SMA1000 appliances (CVE-2026-83548, CVE-2026-83549) and JFrog Artifactory (CVE-2026-82329) as these are confirmed exploited in the wild and listed in CISA KEV.
- If SonicWall SMA1000 appliances cannot be patched immediately, consider restricting network access to management interfaces to trusted IP ranges only.
- If JFrog Artifactory is exposed externally, consider temporarily restricting access to the Artifactory service until patches can be applied.
- Review all six vendor advisories and apply available updates to Schneider Electric, HPE, Google Chrome, and Progress Software Telerik products.
Infrastructure Hardening
- Consider implementing network access controls to limit exposure of SonicWall SMA1000 and JFrog Artifactory management interfaces to the internet.
- Evaluate whether WAF rules can be configured to detect and block path traversal attempts against Telerik UI for ASP.NET AJAX deployments (CVE-2026-18672).
- Consider enabling enhanced logging on all affected network appliances and development platforms to support detection of exploitation attempts.
- If your organization uses HPE Networking AOS-CX or Fabric Composer, review the referenced HPE security bulletins and plan patching for those products as updates become available.
User Protection
- Consider deploying Google Chrome version 152.0.7977.75 or later to all endpoints via your patch management process.
- If Telerik UI for ASP.NET AJAX is deployed in your environment, consider updating to version 2026.3.812 or later.
- If Schneider Electric NetBotz or PowerChute Serial Shutdown are deployed, review the vendor advisories for mitigation steps.
Security Awareness
- Consider communicating the CISA KEV additions for SonicWall and JFrog vulnerabilities to relevant infrastructure and development teams to ensure patching priority.
- If your organization maintains a vulnerability prioritization process, consider elevating KEV-listed CVEs to the top of the remediation queue.
- Consider reviewing whether any affected products in this advisory are present in your asset inventory, particularly SonicWall SMA1000 and JFrog Artifactory which are actively exploited.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping1 technique
Tactic
