Cybersecurity and Infrastructure Security Agency

PaperCut's new maintenance builds give administrators clearer version records, but site and secondary servers still need to be checked.

ConnectWise says the flaw affects ScreenConnect clients, not servers, leaving providers to verify updates across the endpoints they support.

CISA added CVE-2026-8037 to its Known Exploited Vulnerabilities catalogue on 7 August and set 10 August as the federal remediation deadline. That compressed interval means covered agencies needed more than a patch command: inventory, exposure testing, forensic triage and verified closure had to move together.

Log4Shell was not only an emergency vulnerability. It was a public test of whether governments, vendors, cloud providers, software suppliers, and customers could prove that a deeply embedded component had been found, fixed, mitigated, monitored, and kept from returning through dependency drift.