## Executive Summary The threat landscape remains dominated by active exploitation of critical vulnerabilities across widely deployed enterprise software. **PaperCut NG/MF** and **Citrix NetScaler** are under immediate attack via newly disclosed zero-days, requiring urgent patching. State-sponsored activity is high, with the **FBI disrupting the China-linked QTFY espionage network** and Russian actors exploiting a **Zimbra zero-day**. Additionally, a novel social engineering campaign (**ClickFix**) is leveraging Windows Terminal to deploy malware, while a surge in **Microsoft Device Code Phishing** threatens MFA-protected accounts.

## ⚠️ Immediate Action Required

* **PaperCut NG/MF Zero-Day Authentication Bypass** A critical zero-day vulnerability in PaperCut NG/MF print management software is being actively exploited, allowing attackers to bypass authentication and execute remote code via crafted HTTP POST requests. * **CVE:** CVE-2023-27350 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** All NG and MF versions prior to emergency patch * **Fixed:** Apply emergency patch released 2026-08-28 * **Workaround:** None mentioned in source * **Reference:** [Rapid7 Research: PaperCut NG/MF Critical Zero-Day Exploited in the Wild](https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild)

* **Citrix NetScaler ADC/Gateway Memory Leak Exploitation** A critical out-of-bounds read vulnerability in Citrix NetScaler ADC and Gateway is being actively exploited to leak sensitive memory data when configured as a SAML Identity Provider. * **CVE:** CVE-2026-3055 (CVSS: 9.3) * **Status:** Active exploitation detected * **Vulnerable:** Multiple versions prior to 14.1-66.59 and 13.1-62.23 * **Fixed:** Update to 14.1-66.59, 13.1-62.23, or later * **Workaround:** None mentioned in source * **Reference:** [SecurityWeek: Recent Citrix NetScaler Vulnerability Exploited in the Wild](https://www.securityweek.com/?p=48907)

* **ServiceNow AI Platform Remote Code Execution** A critical RCE vulnerability in the ServiceNow AI Platform is being exploited in the wild via HTTP POST requests, allowing unauthenticated attackers to execute arbitrary code. * **CVE:** CVE-2026-6875 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Pre-Brazil EA and other prior releases * **Fixed:** Apply patches from ServiceNow advisory * **Workaround:** None mentioned in source * **Reference:** [The Hacker News: Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Cod](https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html)

* **Ubiquiti UniFi OS Critical Vulnerability Chain** Multiple critical vulnerabilities in Ubiquiti UniFi products (Network Application, OS Server, Cloud Gateway Industrial) allow remote code execution and privilege escalation, with CVSS scores up to 10.0. * **CVE:** CVE-2026-34910, CVE-2026-34909, CVE-2026-34908 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Not specified in source — check vendor advisory * **Fixed:** Update to latest UniFi OS versions * **Workaround:** None mentioned in source * **Reference:** [BSI Germany: [NEU] [hoch] Ubiquiti UnifiOS: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3028)

## 🔍 Threat Activity

* **ClickFix Campaign Deploys Lumma Stealer via Windows Terminal.** A sophisticated social engineering campaign tricks users into pasting malicious commands into Windows Terminal, evading detection to deploy the Lumma Stealer credential thief. The attack uses encoded PowerShell commands and fake CAPTCHAs. * **Russian APT Exploits Zimbra Zero-Day for Espionage.** The state-sponsored group "Laundry Bear" (TA488) is exploiting a zero-day XSS vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite via phishing emails, enabling data exfiltration from US and Ukrainian targets upon email preview. * **Microsoft Device Code Phishing Surge.** Threat actors are increasingly exploiting the Microsoft OAuth device code flow to bypass MFA and steal access tokens, enabling persistent account access. Groups like ShinyHunters and EvilTokens are linked to these campaigns. * **FBI Disrupts China-Linked QTFY Cyber Espionage Network.** The FBI has taken down infrastructure used by the QTFY group, which targeted U.S. federal agencies (including NASA, DOE, and the U.S. Senate) using custom tools (QScan, QTRouter) to exploit vulnerabilities like CVE-2019-11510.

## 📋 Patches & Updates

* **Microsoft Edge Multiple Critical Vulnerabilities.** Multiple critical RCE, information disclosure, and policy bypass flaws affect Edge versions prior to 146.0.7680.75. One (CVE-2026-3909) is noted as actively exploited. **Action:** Update to the latest version immediately. * **Multiple Critical Redis Vulnerabilities.** Several critical RCE vulnerabilities (e.g., CVE-2026-23479, CVE-2026-25243) affect Redis versions up to 8.6.2, involving use-after-free and memory handling issues. **Action:** Upgrade to Redis 8.6.3 or later. * **Veeam Backup & Replication Critical RCE Flaws.** Multiple critical vulnerabilities (including CVE-2026-44963) allow remote code execution and privilege escalation in Veeam Backup & Replication versions 12.x prior to 12.3.2.4465 and 13.x prior to 13.0.1.2067. **Action:** Apply patches immediately.

## Today's Priorities 1. **Patch PaperCut and Citrix NetScaler immediately.** These are the most urgent, actively exploited zero-days. 2. **Review and apply patches for ServiceNow, Ubiquiti UniFi, Microsoft Edge, Redis, and Veeam.** These are all under active exploitation or have critical public vulnerabilities. 3. **Alert users to the ClickFix Windows Terminal phishing campaign.** Reinforce training against pasting commands from untrusted sources. 4. **Audit Microsoft OAuth device code authorizations.** Monitor for suspicious device authorizations that could indicate token theft attempts.

## 🔗 References

• [Rapid7 Research: PaperCut NG/MF Critical Zero-Day Exploited in the Wild](https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild)
• [SecurityWeek: Recent Citrix NetScaler Vulnerability Exploited in the Wild](https://www.securityweek.com/?p=48907)
• [The Hacker News: Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Cod](https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html)
• [The Hacker News: FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organ](https://thehackernews.com/2026/08/fbi-disrupts-china-linked-qtfy.html)
• [Microsoft Security Blog: TerminalFix campaign deploys a reverse tunnel through multistage intrusion](https://www.microsoft.com/en-us/security/blog/?p=149220)