Three vendors, one week, the same patch gap

An IT lead checks three patch logs before lunch

An IT lead at a mid-sized logistics firm opens three tabs before lunch on September 2: the SonicWall admin console, the Switchvox dashboard, and the Artifactory instance that holds the company's build artifacts. None of the three vendors are related to each other. One sells VPN gateways, one sells phone systems, one sells software repositories. And yet all three tabs are open for the same reason: each vendor has confirmed active exploitation of a flaw in the last seventy-two hours.

This is not a single bad week for one company. It is three separate, simultaneous incidents against three unrelated products, discovered and disclosed within days of each other in early September 2026. Read individually, each is a routine vendor advisory. Read together, they describe a pattern that matters more than any one CVE number.

SonicWall SMA1000 faces a maximum-severity zero-day

SonicWall confirmed on September 1 and 2, 2026 that attackers are actively exploiting two previously undisclosed vulnerabilities in its SMA1000 remote-access appliances, covering the 6210, 7210, and 8200v models. CVE-2026-83548 is a pre-authentication server-side request forgery in the Appliance Work Place interface, and it carries a CVSS score of 10.0, the maximum possible rating. CVE-2026-83549 is an OS command injection flaw in the Appliance Management Console that lets an authenticated administrator achieve remote code execution.

Firmware versions below 12.4.3-03526 and 12.5.0-02952 are vulnerable. No patch existed at the time attacks were confirmed, which makes this a true zero-day: there was no window in which a defender could have closed the gap by applying an update, because no update was available. This is also the third SMA1000 security incident this year, following an MFA-seed theft incident in July 2026 that we covered separately at the time.

Switchvox and Artifactory show two different patch-gap stories

Sangoma Switchvox SMB Edition 8.3 carries an unauthenticated SQL injection flaw, CVE-2026-9586, with a CVSS score of 9.3. It lets an attacker deploy a reverse shell without any credentials at all, through the product's "/pa" endpoint. Sangoma patched it on July 14, 2026 with version 8.4.0.2. Exploitation attempts began on August 30, 2026, according to honeypot telemetry, a six-week gap between the fix being available and attackers actually using the hole. Roughly 4,000 Switchvox instances remain exposed to the public internet today.

JFrog Artifactory tells a faster story. A CVSS 9.8 authentication-bypass flaw, CVE-2026-82329, affects self-hosted Artifactory in its default configuration and lets an unauthenticated attacker mint admin tokens. JFrog patched it on August 28, 2026 across versions 7.111.21, 7.117.28, 7.125.20, and 7.133.29. Attackers began exploiting it within days. Watchtowr's honeypot network observed automated enumeration of users, credentials, and federated access topologies almost immediately after the patch shipped. This is a different, newer vulnerability than the Artifactory misconfiguration issue we covered in July 2026 under the title "check one setting before you patch Artifactory" - that was a separate flaw, and the two should not be confused.

Beyond the headlines: patched is not the same word as protected

Three unrelated vendors, three unrelated product categories: a VPN gateway, a VoIP phone system, and a software-artifact repository. The same pattern shows up in all three. Look at the gap between when a fix exists and when attackers actually use the hole it closes. For Artifactory, that gap was days. For Switchvox, it was six weeks, even though the patch had been sitting there the whole time. For SonicWall, there was no gap at all, because there was no patch yet to have a gap around.

We think the real exposure story here for EU and UK businesses is not any single CVE. It is that a patch existing and a system being protected are two different facts, and the difference between them is whichever business did not get around to applying the update in the six weeks it had. The SMB-scale, internet-exposed edge device - the VPN box, the phone system, the artifact server sitting in a corner of the network - is the reliable entry point precisely because it is the thing nobody re-checks after the initial rollout.

This is not hypothetical. Roughly 4,000 Switchvox boxes and an unknown but real number of SonicWall and Artifactory instances sit exposed on the public internet right now, as this is written. The Register has raised a separate and genuinely open question: whether the speed of the Artifactory exploitation, automated enumeration within days of patch release, reflects AI-agent-driven attack tooling rather than manual human operators working the honeypots by hand. We do not have an answer to that yet, and neither does anyone else publicly.

What the NCSC advisory adds to the picture

On August 27, 2026, the UK National Cyber Security Centre published an advisory warning of rising targeting of operational technology and internet-exposed edge devices across sectors. Its core message is simple: do not assume a system is inaccessible from the internet without verifying it. That advisory landed five days before all three of these incidents became public, and it reads less like a coincidence and more like the NCSC seeing the same category of exposure building before any single vendor confirmed an active attack.

For a business running any of these three products, or products like them, the practical question is not whether this week's specific CVEs apply. It is whether there is a standing process that checks, on a schedule, whether every internet-facing edge device is actually running the patch level it is supposed to be running - not just whether a patch was applied once.

Servola Journal

We do this for everyone trying to keep up with what technology is doing to our lives. The people who build it, and the people it happens to. The Servola Journal exists so that what we learn belongs to all of them.

Nobody pays us for this. No ads, no paywall, free to everyone. We just believe that understanding what's happening to all of us shouldn't depend on who can afford to pay for it.

If it gave you something today, tell us to keep going. Follow us, leave a like, or write a positive comment. We read every one, and they are what keeps us going.

Read next: Gunra Ransomware Runs on Fortinet Bugs Patched in 2025  |  Your Older Macs Needed Seven Tries to Get Patched