For August 30–September 5, Layer8’s editorial priorities weigh exploitation, exposure and business impact. Inventory determines applicability. Four entries gained CISA exploitation listings during the week; HPE published its advisory September 1.
| CVE | Applicability and impact | Remediation | Exploitation evidence |
|---|---|---|---|
| CVE-2026-83548 | SMA1000 through 12.4.3-03453 or 12.5.0-02835: unauthenticated access to sensitive functions. | Install branch hotfix 12.4.3-03526 / 12.5.0-02952; request SonicWall compromise review. | Actively exploited; KEV September 2. |
| CVE-2026-83549 | Same SMA1000 versions: remote code execution requiring administrator access. | Same branch hotfixes and vendor compromise review. | Actively exploited; KEV September 2. |
| CVE-2026-59822 | LiteLLM before 1.84.0 with MCP Streamable HTTP: unauthorized access to tools and connected services. | Upgrade to 1.84.0 or later. | KEV September 2; advisory published June 30. |
| CVE-2026-85046 | Chrome before 152.0.7977.82: code execution inside the browser sandbox. | Install 152.0.7977.82/.83 (Windows/Mac) or 152.0.7977.82 (Linux), or later; relaunch. | Google reports an in-the-wild exploit; KEV September 4. |
| CVE-2026-76658 | HPE Fabric Composer 7.3.3 and earlier: unauthenticated host compromise. | Upgrade to 7.3.4 or 7.4.0, or later supported releases. | Unconfirmed in reviewed sources; no KEV listing October 2. |
Layer8 Managed IT would, within agreed scope, reconcile asset records, assign patch owners and record exceptions. Verify each approved update’s installed version, service health and rollback plan. This could reduce time left exposed; patching alone does not establish that a previously compromised appliance is clean.