Three CVSS 10.0 vulnerabilities in one platform. Factory-installed backdoors in routers shipping worldwide. A print management zero-day already being exploited. Today’s brief covers three stories that will drive customer conversations this week — each one hits a different part of the attack surface and demands a different response.

In the News

ServiceNow Ships Emergency Patches for Three CVSS 10.0 AI Platform Flaws

ServiceNow published emergency patches for three maximum-severity vulnerabilities in its AI Platform. The flaws — unauthenticated remote code execution, SQL injection, and privilege escalation — each carry a CVSS score of 10.0. SQL injection exploitation has already been observed in the wild.

The distinction that matters operationally: ServiceNow has already patched hosted (SaaS) instances. Self-hosted deployments — common in regulated industries that require data residency control — are exposed until administrators apply the patches manually. Three CVSS 10.0 flaws in a single platform that handles IT service management, HR workflows, and increasingly AI-driven automation makes this the highest-priority patching event of the week.

The attack surface is significant. ServiceNow instances typically have broad network access and elevated privileges across integrated systems. An unauthenticated RCE on a ServiceNow server is not just a single-system compromise — it is initial access to everything ServiceNow touches, which in most enterprises includes Active Directory, cloud identity providers, and configuration management databases.

What defenders should do: Self-hosted ServiceNow customers must apply emergency patches immediately. Validate that ServiceNow instances are not directly exposed to the internet without a web application firewall. Review ServiceNow service account privileges — the blast radius of a compromised instance is defined by what those accounts can reach.

Chinese ZBT Routers Ship with Two Factory-Installed Backdoors

VulnCheck disclosed SPEAKINGSTONE and DARKLANTERN — two implants embedded in firmware on ZBT routers manufactured in China and sold worldwide as white-label products under dozens of brand names. CVE-2026-74232 and CVE-2026-74233 both grant unauthenticated remote root access.

This is not a vulnerability in the traditional sense. A misconfigured default credential or a buffer overflow is a bug. Persistent implants baked into firmware at the factory are a supply-chain decision. The distinction matters because patching does not resolve this — the firmware itself is the problem, and there is no trusted firmware version to roll back to.

The scale is the concern. ZBT is an OEM manufacturer. Its routers ship under brand names that end-users and even IT teams may not associate with ZBT. Organizations that purchased budget or white-label routers for branch offices, retail locations, or IoT deployments may have affected devices in production without knowing it. Asset inventory that tracks only the brand label on the box will miss this entirely — you need firmware-level visibility.

What defenders should do: Inventory edge networking equipment by chipset and firmware, not just brand name. Isolate or replace any ZBT-manufactured routers. Implement network segmentation to limit the blast radius of compromised edge devices. Monitor for anomalous outbound connections from router management interfaces.

PaperCut Zero-Day Exploited in the Wild — All NG/MF Versions Affected

PaperCut confirmed active exploitation of a zero-day vulnerability affecting every version of its NG and MF print management software. Emergency patches are available only for versions 25 and 26. Organizations running anything older have no patch — only workarounds or service shutdown.

PaperCut has a history of being targeted. The 2023 PaperCut exploitation campaign (CVE-2023-27350) demonstrated that print management servers are high-value targets because they often run with elevated privileges, are overlooked in patching cycles, and sit on internal networks with broad access. This new zero-day follows the same pattern: print infrastructure treated as low-risk becomes the initial access vector.

What defenders should do: Identify all PaperCut NG and MF instances. Patch v25 and v26 immediately. For older versions, isolate PaperCut servers from the broader network and restrict inbound access to only the hosts that require it. Monitor PaperCut server processes for unexpected child processes — post-exploitation typically involves command execution from the PaperCut service account.

CISA Adds Citrix NetScaler RCE to KEV — Federal Deadline Saturday

CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities catalog after confirming active exploitation of a remote code execution flaw in Citrix NetScaler ADC and NetScaler Gateway. Federal agencies must patch by Saturday, August 30.

NetScaler appliances are authentication and load-balancing gateways sitting at the network edge. A compromised NetScaler ADC gives an attacker a position upstream of every application and user session it fronts. Previous NetScaler exploitation campaigns — including CitrixBleed (CVE-2023-4966) — demonstrated that threat actors target these appliances specifically because they provide both initial access and credential harvesting in a single step.

What defenders should do: Patch CVE-2026-8452 immediately. Audit NetScaler configurations for indicators of prior compromise — check for unauthorized configuration changes, unexpected certificates, and anomalous session volumes. If patching requires a maintenance window, implement network-level access restrictions to limit who can reach the NetScaler management and gateway interfaces.

Today’s Deep Dive — Factory-Installed Backdoors and the Supply-Chain Trust Problem

The ZBT router disclosure is worth examining beyond the immediate CVEs because it represents a category of threat that traditional vulnerability management does not address. Vulnerability management assumes a trusted baseline: software starts clean, bugs are introduced, patches restore the clean state. Factory-installed implants break that assumption entirely. There is no clean state to restore to.

SPEAKINGSTONE and DARKLANTERN are implants — not vulnerabilities. They were placed in firmware before the device shipped. This maps to MITRE ATT&CK T1195.003 (Supply Chain Compromise: Compromise Hardware Supply Chain). The technique is well-documented but rarely observed at this scale in commodity networking equipment.

The operational challenge for defenders is identification. ZBT manufactures routers that are rebranded and sold under dozens of names. A standard asset inventory that records “Acme Router Model X” will not flag the device as ZBT-manufactured. Firmware hash verification against known-good baselines is the reliable detection method, but most organizations do not have firmware integrity monitoring in place for network equipment.

The policy response is already underway. Executive Order 14420, signed this week, bans foreign-made power generation equipment over backdoor concerns. While that order targets OT/ICS infrastructure specifically, the same supply-chain integrity logic applies to IT networking equipment. Organizations should expect procurement scrutiny of networking hardware origin to increase significantly in the next 12 months.

Detection Spotlight

PaperCut post-exploitation typically involves the PaperCut service spawning unexpected child processes. The following Splunk SPL query detects command execution originating from the PaperCut application server process on Windows:

index=sysmon EventCode=1
| where match(ParentImage, "(?i)pc-app-server\.exe")
| where NOT match(Image, "(?i)(java\.exe|javaw\.exe)")
| stats count by host, Image, CommandLine, ParentImage
| where count < 5
| sort - count

This query looks for processes spawned by pc-app-server.exe (the PaperCut application server) that are not standard Java processes. Legitimate PaperCut operation spawns Java — anything else (cmd.exe, powershell.exe, certutil.exe, whoami.exe) is a high-fidelity indicator of post-exploitation activity. False positive rate is low in environments where PaperCut is the only application using that binary name. Tune the exclusion list for any custom integrations that legitimately spawn from the PaperCut process.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) — Daily cybersecurity news, SE angles, and detection queries.