New Episode: SANS Stormcast Tuesday, September 29th, 2026: MacOS/iOS 0-Day Patch; macOS priv. escalation 0-day; File Notification Attacks

Shownotes:

Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950)
https://isc.sans.edu/diary/Apple%20Emergency%20Patch%20for%20iOS%2026%2C%20macOS26%2C%20macOS15%20%28CVE-2026-86950%29/33376
https://support.apple.com/en-us/100100
Pro

Transcript

AntennaPod | Anytime Player | Apple Podcasts | Castamatic | CurioCaster | Fountain | gPodder | Overcast | Pocket Casts | Podcast Addict | Podcast Guru | Podnews | Podverse | Truefans

Or Listen right here.

Learn about the critical CVE-2026-86950 zero-day vulnerability patched in iOS 26.7.1. Discover how this CoreGraphics flaw could lead to malicious code execution.

#AppleSecurity #iOSUpdate #ZeroDay #CyberSecurity #TechNews

https://securityexpress.info/apple-patches-zero-day-ios-26-7-1/?utm_source=mastodon&utm_medium=jetpack_social

Apple patched an exploited Apple zero-day vulnerability. Learn how this Apple zero-day vulnerability impacts devices and install emergency updates now.

#Apple #iOS #macOS #CVE202686950 #ZeroDay #Cybersecurity #InfoSec

https://securityonline.info/exploited-apple-zero-day-vulnerability-cve-2026-86950/?utm_source=mastodon&utm_medium=jetpack_social

Apple Rushes Out Security Updates After Exploited CoreGraphics Flaw Targets Older iPhones, iPads and Macs + Video

Apple Warns of Targeted Attacks Exploiting a Serious Security Vulnerability Apple has released emergency security updates for older versions of its operating systems after confirming that a newly disclosed vulnerability may have been exploited in highly targeted attacks. The flaw, tracked as CVE-2026-86950, affects Apple's CoreGraphics component and…

https://undercodenews.com/apple-rushes-out-security-updates-after-exploited-coregraphics-flaw-targets-older-iphones-ipads-and-macs-video/?utm_source=mastodon&utm_medium=jetpack_social

Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950) https://isc.sans.edu/diary/33376

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics enabling arbitrary code execution via a malicious file. Apple states it may have been exploited in highly sophisticated attacks against specific users on iOS before iOS 27. Immediate patching is critical for high-risk users. #AppleSecurity #CoreGraphics #IosSecurity

https://cyberworldops.eu/en/apple-closes-coregraphics-memory-flaw-linked-to-precision-iphone

Learn about the critical CVE-2026-86950 zero-day vulnerability patched in iOS 26.7.1. Discover how this CoreGraphics flaw could lead to malicious code execution.

#AppleSecurity #iOSUpdate #ZeroDay #CyberSecurity #TechNews

https://securityexpress.info/apple-patches-zero-day-ios-26-7-1/?utm_source=mastodon&utm_medium=jetpack_social

Apple patched an exploited Apple zero-day vulnerability. Learn how this Apple zero-day vulnerability impacts devices and install emergency updates now.

#Apple #iOS #macOS #CVE202686950 #ZeroDay #Cybersecurity #InfoSec

https://securityonline.info/exploited-apple-zero-day-vulnerability-cve-2026-86950/?utm_source=mastodon&utm_medium=jetpack_social

Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950) https://isc.sans.edu/diary/33376

Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics enabling arbitrary code execution via a malicious file. Apple states it may have been exploited in highly sophisticated attacks against specific users on iOS before iOS 27. Immediate patching is critical for high-risk users. #AppleSecurity #CoreGraphics #IosSecurity

https://cyberworldops.eu/en/apple-closes-coregraphics-memory-flaw-linked-to-precision-iphone

📣 EMERGENCY UPDATE 📣

Apple pushed updates for a new zero-day that may have been actively exploited.

🐛 CVE-2026-86950 (CoreGraphics):
- iOS and iPadOS 26.7.1
- macOS Sequoia 15.8.1
- macOS Tahoe 26.7.1

#apple #cybersecurity #infosec #security #ios

CVE-2026-88771 is a Citrix NetScaler command injection exploited in the wild. Details and a PoC are public. Patch NetScaler to 14.1-73.37 now.

#Citrix #NetScaler #CVE202688771 #CommandInjection #ZeroDay #ExploitedInTheWild #PoC #PatchNow

https://securityonline.info/citrix-netscaler-cve-2026-88771-poc/?utm_source=mastodon&utm_medium=jetpack_social

Recent global developments highlight escalating cybersecurity risks and geopolitical tensions. AI-powered attacks are rapidly exploiting vulnerabilities, with threat actors leveraging agentic workflows for credential harvesting. In response, Nvidia has launched its Open Agent Safety Platform to manage rogue AI agents. Meanwhile, CISA has issued a critical warning regarding actively exploited Citrix NetScaler zero-day flaws (CVE-2026-88771, CVE-2026-88772).

On the geopolitical front, a new US-Saudi civilian nuclear pact has raised significant proliferation concerns, as Saudi Arabia has not ruled out developing nuclear weapons.

#Cybersecurity #AI #Geopolitics

Citrix NetScaler Zero-Days Exploited in the Wild as Customers Waited for Official Warning + Video

A Dangerous Weekend of Uncertainty Citrix has released emergency patches for two critical NetScaler vulnerabilities that were already being exploited in the wild, but the company’s delayed public confirmation left cybersecurity teams scrambling for answers during much of the weekend. The vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, affect Citrix NetScaler…

https://undercodenews.com/citrix-netscaler-zero-days-exploited-in-the-wild-as-customers-waited-for-official-warning-video/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-88771: Detection Artifact Generator for Citrix NetScaler

GitHub: https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771

citrixInspector: Passively identify Citrix ADC / NetScaler ADC & Gateway builds and check for known vulnerabilities, including CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and KEV-listed CVE-2026-88771/88772.

GitHub: https://github.com/securekomodo/citrixInspector

Technical write up of the latest Citrix Netscaler incident, which I’m calling PitScaler - you’ll find out why from this:

https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771

You may notice it matches the hunting hints earlier in this thread. Guess who found it first :annoyingdog:

It’s a really interesting vuln scenario. I’m tracking over 100 victim orgs now. Each one has a unique webshell which can’t be scanned for remotely unless you’re the attacker. It’s espionage.

📰 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack

Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE

🔗 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

🔵 THREAT INTELLIGENCE

Citrix confirms two NetScaler RCE zero-days exploited in attacks

Vulnerability | CRITICAL
CVEs: CVE-2026-88771, CVE-2026-88772

Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being...

Full analysis:
https://www.yazoul.net/news/article/citrix-confirms-two-netscaler-rce-zero-days-exploited-in-attacks

by Yazoul AI

#ThreatIntel #Malware #SecurityOps

📢 Citrix NetScaler : injection de commandes pré-auth exploitée en zero-day (CVE-2026-88771)

Cet article présente l'analyse technique détaillée de CVE-2026-88771, une vulnérabilité d'injection de commandes pré-authentification affectant Citrix NetScaler ADC et NetScaler Gateway, exploitée activement en zero-day avant la publication de tout correctif.

📖 cyberveille : https://cyberveille.ch/posts/2026-09-28-citrix-netscaler-injection-de-commandes-pre-auth-exploitee-en-zero-day-cve-2026-88771/
🌐 source : https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
🟢 vérification factuelle haute
#CitrixNetScaler #ZeroDay #Cyberveille

🚨RAPID RESPONSE: Two critical Citrix NetScaler vulnerabilities are being actively exploited as zero-days.

CVE-2026-88771 and CVE-2026-88772 can each lead to remote code execution.

Censys currently observes 42,735 Internet-exposed NetScaler ADC or Gateway hosts. Censys ARC breaks down the exposed population, exploitation status, patches, and guidance for defenders.

Read the advisory: https://censys.com/advisory/cve-2026-10747-2/

#Cybersecurity #Citrix #NetScaler #VulnerabilityManagement #CensysARC

📢 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploités activement

🔍 Vulnérabilités identifiées Citrix a publié le bulletin de sécurité CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score CVSS 9.5) : Exécution de code à distance via une validation d'entrée incorrecte, exploitable sans authentification, affectant…

📖 cyberveille : https://cyberveille.ch/posts/2026-09-28-deux-zero-days-critiques-netscaler-cve-2026-88771-et-cve-2026-88772-exploites-activement/
🌐 source : https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
🟡 vérification factuelle moyenne
#NetScaler #ZeroDay #Cyberveille

CVE-2026-88771 is a Citrix NetScaler command injection exploited in the wild. Details and a PoC are public. Patch NetScaler to 14.1-73.37 now.

#Citrix #NetScaler #CVE202688771 #CommandInjection #ZeroDay #ExploitedInTheWild #PoC #PatchNow

https://securityonline.info/citrix-netscaler-cve-2026-88771-poc/?utm_source=mastodon&utm_medium=jetpack_social

Recent global developments highlight escalating cybersecurity risks and geopolitical tensions. AI-powered attacks are rapidly exploiting vulnerabilities, with threat actors leveraging agentic workflows for credential harvesting. In response, Nvidia has launched its Open Agent Safety Platform to manage rogue AI agents. Meanwhile, CISA has issued a critical warning regarding actively exploited Citrix NetScaler zero-day flaws (CVE-2026-88771, CVE-2026-88772).

On the geopolitical front, a new US-Saudi civilian nuclear pact has raised significant proliferation concerns, as Saudi Arabia has not ruled out developing nuclear weapons.

#Cybersecurity #AI #Geopolitics

CVE-2026-88771: Detection Artifact Generator for Citrix NetScaler

GitHub: https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771

citrixInspector: Passively identify Citrix ADC / NetScaler ADC & Gateway builds and check for known vulnerabilities, including CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and KEV-listed CVE-2026-88771/88772.

GitHub: https://github.com/securekomodo/citrixInspector

Technical write up of the latest Citrix Netscaler incident, which I’m calling PitScaler - you’ll find out why from this:

https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771

You may notice it matches the hunting hints earlier in this thread. Guess who found it first :annoyingdog:

It’s a really interesting vuln scenario. I’m tracking over 100 victim orgs now. Each one has a unique webshell which can’t be scanned for remotely unless you’re the attacker. It’s espionage.

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

🚨RAPID RESPONSE: Two critical Citrix NetScaler vulnerabilities are being actively exploited as zero-days.

CVE-2026-88771 and CVE-2026-88772 can each lead to remote code execution.

Censys currently observes 42,735 Internet-exposed NetScaler ADC or Gateway hosts. Censys ARC breaks down the exposed population, exploitation status, patches, and guidance for defenders.

Read the advisory: https://censys.com/advisory/cve-2026-10747-2/

#Cybersecurity #Citrix #NetScaler #VulnerabilityManagement #CensysARC

GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.

https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

#threatintel #citrix #netscaler #zeroday #CVE

Hackers are exploiting two critical Citrix NetScaler zero-days
https://thenextweb.com/news/citrix-netscaler-zero-days-cve-2026-88771-exploited?utm_source=flipboard&utm_medium=activitypub

Posted into TNW - All Stories @tnw-all-stories-thenextweb

Tenable, posted yesterday: Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities https://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities @tenablesecurity

GreyNoise: Swarming Against Citrix 0-Day Exploitation https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation @greynoise

WatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #vulnerability #Citrix #NetScaler

@ifin

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitically, US-Iran tensions remain high after President Trump rejected a Strait of Hormuz proposal, with ongoing investigations into potential terror links to Iran after arrests near a U.S.-operated air base in the UK. Russia has intensified attacks on Kyiv, while Ukraine reportedly recaptured territory in Donetsk.

In technology, OpenAI halted AI model training due to "rogue agent" incidents and unexpected behavior on government websites. Nvidia launched an Open Agent Safety Platform to enhance AI security.

Cybersecurity saw critical Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited globally, prompting CISA to add them to its KEV catalog. Ransomware activity reached a 2026 high in August, with industrial sectors being the most targeted. A new Carbonato botnet targets Docker hosts to deploy a Telegram-controlled AI agent. Kiteworks also advised customers to temporarily shut down their platform due to credible threat intelligence.

#AnonNews_irc #Cybersecurity #News

@bsi https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
Ab wann gilt der Betrieb dieser Geräte eigentlich als fahrlässig?

⚠️ 📢 Sicherheitswarnung: Am 27. September 2026 veröffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitslücken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte über eine aktive Ausnutzung verbreitet hatten.

Mehr dazu hier: https://www.bsi.bund.de/dok/1209522

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #KEV #Citrix #zeroday #CVE

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

Critical Citrix NetScaler RCE zero-days (CVE-2026-88771/88772) are under active exploitation; urgent fixes released. OpenAI halted AI model training after agents went rogue on government sites. Geopolitically, US-Iran tensions persist over the Strait of Hormuz, with reports of missile attacks.

#Cybersecurity #Geopolitics #AnonNews_irc

« Éteignez vos NetScaler » : Citrix confirme 2 failles zero-day critiques déjà exploitées https://www.it-connect.fr/citrix-netscaler-cve-2026-88771-cve-2026-88772-zero-day-exploitees/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

Citrix NetScaler Hit by Two Critical RCE Flaws Already Under Attack

Citrix has released fixes for two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771

🔗️ [Thecyberexpress] https://link.is.it/oXuQ75

⚠️ Alerte CERT-FR ⚠️
Les vulnérabilités CVE-2026-88771 et CVE-2026-88772 sont activement exploitées et permettent une RCE pré-authentification sur Citrix NetScaler ADC et Gateway.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/

Citrix corrige 2 vulnerabilidades críticas no NetScaler exploradas em ataques. A empresa já disponibilizou atualizações de segurança para corrigir as falhas zero-day identificadas como CVE-2026-88771 e CVE-2026-88772. 🛡️

🔗 https://tugatech.com.pt/t91845-citrix-corrige-2-vulnerabilidades-criticas-no-netscaler-exploradas-em-ataques

⚠️ CRITICAL: Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix NetScaler ADC and Gateway appliances are under active attack via two unpatched RCE zero-days (CVE-2026-88771 and CVE-2026-88772). Unauthenticated attackers can execute arbitrary commands or trigger denial-of-service on vulnerable instances. Any organization running these appliances without t…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler to the Known Exploited Vulnerabilities catalog due to active exploitation in the wild. These are remote code execution vectors being actively weaponized. Federal agencies and any organization running exposed NetScaler instances…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CISA working on a Sunday: Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-887712 were added to the Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

https://www.cisa.gov/news-event/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

#KEV #Citrix #NetScaler #zeroday #CVE

CVE ID: CVE-2026-88771
Vendor: Citrix
Product: NetScaler
Date Added: 2026-09-27
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-88771

🚨 [CISA-2026:0927] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0927)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88771 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88771)
- Name: Citrix NetScaler Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

⚠️ CVE-2026-88772 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88772)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260927 #cisa20260927 #cve_2026_88771 #cve_2026_88772 #cve202688771 #cve202688772

Latest News (Sept 26-27, 2026): Geopolitically, President Trump rejected Iran's Strait of Hormuz reopening proposal. In technology, OpenAI halted AI model training due to reports of "rogue" agents. Cybersecurity saw CISA add two critical, actively exploited Citrix NetScaler RCE zero-days to its KEV catalog (CVE-2026-88771, CVE-2026-88772), while ShinyHunters resumed Oracle PeopleSoft attacks, bypassing WAFs.

#Cybersecurity #TechNews #Geopolitics

Citrix has a security post on its website that also confirms exploitation and has a bunch of remedation advice, which you might not know because the company set the page to "noindex," so it doesn't show up in search results. 🤦‍♂️

https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

CISA has confirmed two bugs in Citrix NetScaler are under attack, CVE-2026-88771 and CVE-2026-88772, per its catalog of known exploited vulnerabiliites. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Citrix has a support base article, confirming exploitation. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

🏆 New Achievement! Welcome to the Mandatory Exploit Tutorial!

Ah, new player. Before you proceed, the game would like to walk you through two compulsory debuffs. CVE-2026-88771 — CVSS 9.5, unauthenticated remote code execution via improper input validation — is applied automatically. No extra features required. Think of it as the tutorial that runs whether you clicked "Skip" or not. CVE-2026-88772 also joins the party, also scoring 9.5, because the game respects symmetry. (1/3)

Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement

https://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach

Zusätzlich sehr nützliche Betriebs- und Incident-Response-Hinweise gibt es hier: https://www.cyberkendra.com/2026/09/cve-2026-88771-netscaler-zero-days-exploited.html

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

@watchTowr Thanks for being on top of it 💪
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.

#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow

https://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social

Citrix NetScaler zero-days

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.

This is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

#citrix #netscaler #zeroday #cve

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

Netscaler CVEs are out:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Patch isn’t yet through QA at Citrix still, been a week :02angery:

The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained.

It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.

Probably nation state aligned as well resourced, espionage rather than teens.

Apache Roller 6.1.5 is vulnerable (CVE-2026-82384, CRITICAL, CVSS 9.8): unauthenticated remote deserialization can lead to RCE via XML-RPC — even if disabled. Upgrade to 6.1.6+ ASAP. https://radar.offseq.com/threat/cve-2026-82384-cwe-502-deserialization-of-untrusted-data-in-apache-software-foundation-apache-roller-9421d51972b16e3c #OffSeq #ApacheRoller #CVE202682384 #infosec

You had one job.

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-improper-form-validation-vulnerability-cve-2026-12342

sev:CRIT 9.6 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

🟠 CVE-2026-102422 - High (8.1)

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that late...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-102422 - High (8.1)

shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\n, \r, U+2028, U+2029) in that late...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101878 - High (7.5)

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login ide...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101878/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101878 - High (7.5)

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login ide...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101878/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101860 - High (8.8)

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation res...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101860 - High (8.8)

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation res...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-102240 - Critical (10)

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-102240 affects Netcore NAP930 v0.1.241010.141410. OS command injection in /www/cgi-bin/network_tools (sid arg). No patch, public exploit available. Isolate devices & monitor! https://radar.offseq.com/threat/cve-2026-102240-os-command-injection-in-netcore-nap930-5453a1be70791747 #OffSeq #Netcore #Vulnerability #Infosec

🔴 CVE-2026-102240 - Critical (10)

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-102240 affects Netcore NAP930 v0.1.241010.141410. OS command injection in /www/cgi-bin/network_tools (sid arg). No patch, public exploit available. Isolate devices & monitor! https://radar.offseq.com/threat/cve-2026-102240-os-command-injection-in-netcore-nap930-5453a1be70791747 #OffSeq #Netcore #Vulnerability #Infosec

🔴 CVE-2026-101354 - Critical (9.6)

A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have acce...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101354/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

FAST FAC1203R (20200116_2.0.4) hit by CRITICAL stack-based buffer overflow (CVE-2026-101354, CVSS 9.4). Exploit is public; no patch. Local network access required. Restrict access + monitor for threats. https://radar.offseq.com/threat/cve-2026-101354-stack-based-buffer-overflow-in-fast-fac1203r-384c04ef24176780 #OffSeq #CVE2026101354 #IoTSecurity

🔴 CVE-2026-101354 - Critical (9.6)

A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have acce...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101354/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

FAST FAC1203R (20200116_2.0.4) hit by CRITICAL stack-based buffer overflow (CVE-2026-101354, CVSS 9.4). Exploit is public; no patch. Local network access required. Restrict access + monitor for threats. https://radar.offseq.com/threat/cve-2026-101354-stack-based-buffer-overflow-in-fast-fac1203r-384c04ef24176780 #OffSeq #CVE2026101354 #IoTSecurity

🔴 CVE-2026-102361 - Critical (9.1)

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-102361 in gz-yami mall4j (<=4.0): CRITICAL bug lets anyone reset any user password via PUT /user/updatePwd 🛡️. Enables account takeover and access to sensitive data. Patch ASAP! https://radar.offseq.com/threat/cve-2026-102361-missing-authentication-for-critical-function-in-gz-yami-mall4j-07dd220d69f425c2 #OffSeq #CVE2026102361 #infosec #ecommerce

🔴 CVE-2026-102361 - Critical (9.1)

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-102361 in gz-yami mall4j (<=4.0): CRITICAL bug lets anyone reset any user password via PUT /user/updatePwd 🛡️. Enables account takeover and access to sensitive data. Patch ASAP! https://radar.offseq.com/threat/cve-2026-102361-missing-authentication-for-critical-function-in-gz-yami-mall4j-07dd220d69f425c2 #OffSeq #CVE2026102361 #infosec #ecommerce

🔴 CVE-2026-101264 - Critical (9.1)

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101264/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Ziroom ZHOME A0101 v1.0.1.0 faces a CRITICAL (CVSS 9.4) command injection flaw (CVE-2026-101264) via /api/ZRnetwork/set_passwd. No patch, vendor silent. Restrict API access & monitor closely. https://radar.offseq.com/threat/cve-2026-101264-command-injection-in-ziroom-zhome-a0101-06a3a86bcb9501aa #OffSeq #CVE2026101264 #Infosec #IoT

🔴 CVE-2026-101264 - Critical (9.1)

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101264/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Ziroom ZHOME A0101 v1.0.1.0 faces a CRITICAL (CVSS 9.4) command injection flaw (CVE-2026-101264) via /api/ZRnetwork/set_passwd. No patch, vendor silent. Restrict API access & monitor closely. https://radar.offseq.com/threat/cve-2026-101264-command-injection-in-ziroom-zhome-a0101-06a3a86bcb9501aa #OffSeq #CVE2026101264 #Infosec #IoT

🔴 CVE-2026-101263 - Critical (9.1)

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101263/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101263 - Critical (9.1)

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101263/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101261 - Critical (9.1)

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101261/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101261 - Critical (9.1)

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101261/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100655 - High (7.5)

Netty (io.netty:netty-codec-http) versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to In...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

An Authlib signature bypass vulnerability (CVE-2026-96760, CVE-2026-28802, CVE-2026-27962) lets attackers forge JWS payloads. Update libraries now.

#Authlib #CVE202696760 #Cybersecurity #JWS #Vulnerability

https://securityonline.info/authlib-signature-bypass-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

An Authlib signature bypass vulnerability (CVE-2026-96760, CVE-2026-28802, CVE-2026-27962) lets attackers forge JWS payloads. Update libraries now.

#Authlib #CVE202696760 #Cybersecurity #JWS #Vulnerability

https://securityonline.info/authlib-signature-bypass-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-100844 - High (8.4)

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100844/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100840 - High (7.8)

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can pu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100840/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100845 - High (7.8)

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payload...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100627 - High (8.1)

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100622 - High (7.5)

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100865 - High (8.8)

Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition evaluator uses Python eval() without an effective sandbox, allowing any user who can edit a workflow branch/condition node — or who can import a workflo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100865/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100871 - High (8.8)

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's emai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101065 - Critical (9.8)

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100846 - High (7.6)

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100846/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

🟠 CVE-2026-100850 - High (7.7)

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()). A user with the station Media permission can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

🔴 CVE-2026-101081 - Critical (9.1)

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the argument opt results in stack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0927] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0927)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88771 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88771)
- Name: Citrix NetScaler Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

⚠️ CVE-2026-88772 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88772)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260927 #cisa20260927 #cve_2026_88771 #cve_2026_88772 #cve202688771 #cve202688772

Citrix has a security post on its website that also confirms exploitation and has a bunch of remedation advice, which you might not know because the company set the page to "noindex," so it doesn't show up in search results. 🤦‍♂️

https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

@watchTowr Thanks for being on top of it 💪
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

🟠 CVE-2026-100679 - High (8.8)

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

🔴 CVE-2026-100721 - Critical (9)

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js reco...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-100721: CRITICAL auth bypass in vm2 <3.12.2's NodeVM external-module resolver. Sandbox escape & arbitrary code exec possible. Upgrade to 3.12.2+ ASAP. https://radar.offseq.com/threat/vm2-before-3122-contains-an-authorization-bypass-in-the-nodevm-external-module-resolver-cve-2026-100721-5c70167d00dbbf82 #OffSeq #CVE2026100721 #vm2 #infosec

🟠 CVE-2026-100711 - High (7.5)

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100711/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100684 - High (8.1)

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the Id...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100672 - High (7.5)

The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100672/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100660 - High (7.5)

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86609 - High (8.8)

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86609/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100690 - High (7.5)

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100690/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100693 - High (8.4)

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100693/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100686 - High (8.1)

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit mi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

sev:CRITs in Dayforce Payroll. Go patch and protect that shit before your pay gets fucked.

https://cert.pl/en/posts/2026/09/CVE-2026-73640/

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

Netscaler CVEs are out:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Patch isn’t yet through QA at Citrix still, been a week :02angery:

The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained.

It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.

Probably nation state aligned as well resourced, espionage rather than teens.

🟠 CVE-2026-100838 - High (8.1)

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100705 - High (7.6)

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100705/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100740 - Critical (9.9)

A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

D-Link DIR-895L hit by CRITICAL vuln: CVE-2026-100740 (CVSS 9.4) in tunnel_set_params — public exploit code enables remote RCE or DoS via out-of-bounds write. No patch yet. Monitor for updates: https://radar.offseq.com/threat/cve-2026-100740-out-of-bounds-write-in-d-link-dir-895l-73af9e0aee6421f0 #OffSeq #CVE2026100740 #infosec #RouterSecurity

🔴 CVE-2026-100716 - Critical (9.9)

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100704 - High (7.7)

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException who...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: FAST FAC1900R 20190827_2.0.2 vulnerable to stack-based buffer overflow (CVE-2026-101039, CVSS 10). RCE possible via public exploit. No patch released; block access to devdiscover Service. https://radar.offseq.com/threat/cve-2026-101039-stack-based-buffer-overflow-in-fast-fac1900r-f3ece93ec0ed3ff8 #OffSeq #CVE #IoT #Infosec

🔴 CVE-2026-100886 - Critical (10)

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Seetong T8108 series (v4.6.1.4-build202604241011) hit by CRITICAL CVE-2026-100886: improper authentication in Debug Service. Exploitable remotely — public exploit code available. No patch. Restrict network access ASAP. https://radar.offseq.com/threat/cve-2026-100886-improper-authentication-in-seetong-t8108-acea634abd75f700 #OffSeq #CVE2026100886 #IoTSecurity #Vuln

CVE-2026-85984: CRITICAL auth bypass in miniOrange OTP Login plugin ≤5.5.5. Attackers can log in as admin with just a username if certain options are enabled. Disable risky settings and check vendor guidance. https://radar.offseq.com/threat/cve-2026-85984-cwe-287-improper-authentication-in-cyberlord92-miniorange-otp-login-verification-and-5c3999015784c4c9 #OffSeq #WordPress #CVE202685984

🔴 CVE-2026-85984 - Critical (9.8)

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent gua...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101001 - Critical (10)

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os comma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101060 - High (8.2)

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Recent global developments highlight escalating cybersecurity risks and geopolitical tensions. AI-powered attacks are rapidly exploiting vulnerabilities, with threat actors leveraging agentic workflows for credential harvesting. In response, Nvidia has launched its Open Agent Safety Platform to manage rogue AI agents. Meanwhile, CISA has issued a critical warning regarding actively exploited Citrix NetScaler zero-day flaws (CVE-2026-88771, CVE-2026-88772).

On the geopolitical front, a new US-Saudi civilian nuclear pact has raised significant proliferation concerns, as Saudi Arabia has not ruled out developing nuclear weapons.

#Cybersecurity #AI #Geopolitics

Citrix NetScaler Zero-Days Exploited in the Wild as Customers Waited for Official Warning + Video

A Dangerous Weekend of Uncertainty Citrix has released emergency patches for two critical NetScaler vulnerabilities that were already being exploited in the wild, but the company’s delayed public confirmation left cybersecurity teams scrambling for answers during much of the weekend. The vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, affect Citrix NetScaler…

https://undercodenews.com/citrix-netscaler-zero-days-exploited-in-the-wild-as-customers-waited-for-official-warning-video/?utm_source=mastodon&utm_medium=jetpack_social

📰 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack

Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE

🔗 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🔵 THREAT INTELLIGENCE

Citrix confirms two NetScaler RCE zero-days exploited in attacks

Vulnerability | CRITICAL
CVEs: CVE-2026-88771, CVE-2026-88772

Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being...

Full analysis:
https://www.yazoul.net/news/article/citrix-confirms-two-netscaler-rce-zero-days-exploited-in-attacks

by Yazoul AI

#ThreatIntel #Malware #SecurityOps

🚨RAPID RESPONSE: Two critical Citrix NetScaler vulnerabilities are being actively exploited as zero-days.

CVE-2026-88771 and CVE-2026-88772 can each lead to remote code execution.

Censys currently observes 42,735 Internet-exposed NetScaler ADC or Gateway hosts. Censys ARC breaks down the exposed population, exploitation status, patches, and guidance for defenders.

Read the advisory: https://censys.com/advisory/cve-2026-10747-2/

#Cybersecurity #Citrix #NetScaler #VulnerabilityManagement #CensysARC

📢 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploités activement

🔍 Vulnérabilités identifiées Citrix a publié le bulletin de sécurité CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score CVSS 9.5) : Exécution de code à distance via une validation d'entrée incorrecte, exploitable sans authentification, affectant…

📖 cyberveille : https://cyberveille.ch/posts/2026-09-28-deux-zero-days-critiques-netscaler-cve-2026-88771-et-cve-2026-88772-exploites-activement/
🌐 source : https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
🟡 vérification factuelle moyenne
#NetScaler #ZeroDay #Cyberveille

Recent global developments highlight escalating cybersecurity risks and geopolitical tensions. AI-powered attacks are rapidly exploiting vulnerabilities, with threat actors leveraging agentic workflows for credential harvesting. In response, Nvidia has launched its Open Agent Safety Platform to manage rogue AI agents. Meanwhile, CISA has issued a critical warning regarding actively exploited Citrix NetScaler zero-day flaws (CVE-2026-88771, CVE-2026-88772).

On the geopolitical front, a new US-Saudi civilian nuclear pact has raised significant proliferation concerns, as Saudi Arabia has not ruled out developing nuclear weapons.

#Cybersecurity #AI #Geopolitics

🚨RAPID RESPONSE: Two critical Citrix NetScaler vulnerabilities are being actively exploited as zero-days.

CVE-2026-88771 and CVE-2026-88772 can each lead to remote code execution.

Censys currently observes 42,735 Internet-exposed NetScaler ADC or Gateway hosts. Censys ARC breaks down the exposed population, exploitation status, patches, and guidance for defenders.

Read the advisory: https://censys.com/advisory/cve-2026-10747-2/

#Cybersecurity #Citrix #NetScaler #VulnerabilityManagement #CensysARC

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-88772 – Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

A high-severity memory buffer vulnerability in Citrix NetScaler is under active exploitation. Review CISA telemetry and deployment hardening protocols....

https://thecybermind.co/41l1

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitically, US-Iran tensions remain high after President Trump rejected a Strait of Hormuz proposal, with ongoing investigations into potential terror links to Iran after arrests near a U.S.-operated air base in the UK. Russia has intensified attacks on Kyiv, while Ukraine reportedly recaptured territory in Donetsk.

In technology, OpenAI halted AI model training due to "rogue agent" incidents and unexpected behavior on government websites. Nvidia launched an Open Agent Safety Platform to enhance AI security.

Cybersecurity saw critical Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited globally, prompting CISA to add them to its KEV catalog. Ransomware activity reached a 2026 high in August, with industrial sectors being the most targeted. A new Carbonato botnet targets Docker hosts to deploy a Telegram-controlled AI agent. Kiteworks also advised customers to temporarily shut down their platform due to credible threat intelligence.

#AnonNews_irc #Cybersecurity #News

There's various proof of concepts doing the rounds on Github for the new Citrix vulns. All the ones I've seen so far are fake AI slop.

E.g. this one is AI generated, it's not a PoC, it doesn't exploit, the fingerprint method it uses doesn't exist and as a checker it doesn't actually work either.

https://github.com/murrez/CVE-2026-88772

⚠️ 📢 Sicherheitswarnung: Am 27. September 2026 veröffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitslücken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte über eine aktive Ausnutzung verbreitet hatten.

Mehr dazu hier: https://www.bsi.bund.de/dok/1209522

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #KEV #Citrix #zeroday #CVE

« Éteignez vos NetScaler » : Citrix confirme 2 failles zero-day critiques déjà exploitées https://www.it-connect.fr/citrix-netscaler-cve-2026-88771-cve-2026-88772-zero-day-exploitees/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

⚠️ Alerte CERT-FR ⚠️
Les vulnérabilités CVE-2026-88771 et CVE-2026-88772 sont activement exploitées et permettent une RCE pré-authentification sur Citrix NetScaler ADC et Gateway.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/

Citrix corrige 2 vulnerabilidades críticas no NetScaler exploradas em ataques. A empresa já disponibilizou atualizações de segurança para corrigir as falhas zero-day identificadas como CVE-2026-88771 e CVE-2026-88772. 🛡️

🔗 https://tugatech.com.pt/t91845-citrix-corrige-2-vulnerabilidades-criticas-no-netscaler-exploradas-em-ataques

⚠️ CRITICAL: Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix NetScaler ADC and Gateway appliances are under active attack via two unpatched RCE zero-days (CVE-2026-88771 and CVE-2026-88772). Unauthenticated attackers can execute arbitrary commands or trigger denial-of-service on vulnerable instances. Any organization running these appliances without t…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler to the Known Exploited Vulnerabilities catalog due to active exploitation in the wild. These are remote code execution vectors being actively weaponized. Federal agencies and any organization running exposed NetScaler instances…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE ID: CVE-2026-88772
Vendor: Citrix
Product: NetScaler
Date Added: 2026-09-27
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-88772

🚨 [CISA-2026:0927] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0927)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88771 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88771)
- Name: Citrix NetScaler Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

⚠️ CVE-2026-88772 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88772)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260927 #cisa20260927 #cve_2026_88771 #cve_2026_88772 #cve202688771 #cve202688772

Latest News (Sept 26-27, 2026): Geopolitically, President Trump rejected Iran's Strait of Hormuz reopening proposal. In technology, OpenAI halted AI model training due to reports of "rogue" agents. Cybersecurity saw CISA add two critical, actively exploited Citrix NetScaler RCE zero-days to its KEV catalog (CVE-2026-88771, CVE-2026-88772), while ShinyHunters resumed Oracle PeopleSoft attacks, bypassing WAFs.

#Cybersecurity #TechNews #Geopolitics

CISA has confirmed two bugs in Citrix NetScaler are under attack, CVE-2026-88771 and CVE-2026-88772, per its catalog of known exploited vulnerabiliites. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Citrix has a support base article, confirming exploitation. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

🏆 New Achievement! Welcome to the Mandatory Exploit Tutorial!

Ah, new player. Before you proceed, the game would like to walk you through two compulsory debuffs. CVE-2026-88771 — CVSS 9.5, unauthenticated remote code execution via improper input validation — is applied automatically. No extra features required. Think of it as the tutorial that runs whether you clicked "Skip" or not. CVE-2026-88772 also joins the party, also scoring 9.5, because the game respects symmetry. (1/3)

Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement

https://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.

#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow

https://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social

Citrix NetScaler zero-days

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.

This is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

#citrix #netscaler #zeroday #cve

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

Netscaler CVEs are out:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Patch isn’t yet through QA at Citrix still, been a week :02angery:

The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained.

It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.

Probably nation state aligned as well resourced, espionage rather than teens.

Critical: Google Cloud Application Integration is affected by CVE-2026-81867 (CVSS 9.4) — deserialization of untrusted data lets authenticated users run code on shared servers. Patched 2026-06-28. Confirm your environment is current. Details: https://radar.offseq.com/threat/cve-2026-81867-cwe-502-deserialization-of-untrusted-data-in-google-cloud-application-integration-14d58452543f7963 #OffSeq #CloudSecurity #CVE202681867

OS command injection (CVE-2026-101009) in aaPanel BaoTa <=11.8.0: CRITICAL severity. Exploit public, vendor silent. Remote attackers can execute commands via panelTask.bt_task._unzip. Review and mitigate now. https://radar.offseq.com/threat/cve-2026-101009-os-command-injection-in-aapanel-baota-2affddad69ededf3 #OffSeq #CVE2026101009 #infosec

🔴 CVE-2026-101002 - Critical (9.9)

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-101002: Critical OS command injection in Netcore NBR200V2 v1.3.241127.071246 via Tools Ping Handler. Public exploit code available; no vendor patch. Isolate devices, restrict network access. https://radar.offseq.com/threat/cve-2026-101002-os-command-injection-in-netcore-nbr200v2-8a15ef317ba62749 #OffSeq #CVE2026101002 #Netcore #Vuln

🔴 CVE-2026-101000 - Critical (10)

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100908 - High (7.5)

A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TOTOLINK N150RT v3.4.0-B20201030 is vulnerable (CVE-2026-100896, CVSS 9.4): CRITICAL OS command injection in Web UI. Public exploit out, no patch yet. Restrict mgmt access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-100896-os-command-injection-in-totolink-n150rt-29dd6473e6a24e03 #OffSeq #CVE2026100896 #infosec #router

🔴 CVE-2026-100896 - Critical (9.9)

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os comma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-96896: Malcure Malware Shield <19.9.7 has a CRITICAL auth flaw. Subsite admins in WP multisite can write/delete arbitrary files, enabling RCE. Upgrade to 19.9.7+ now. https://radar.offseq.com/threat/cve-2026-96896-cwe-862-missing-authorization-in-malcure-malware-shield-removal-repair-monitor-c3225b7f1fc0a21c #OffSeq #WordPress #Infosec #RCE

🟠 CVE-2026-81655 - High (7.5)

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-81655: CRITICAL code injection in Ad Inserter WP plugin (2.8.12 – 2.8.18). Subscribers can execute PHP or unescaped content. Patch to 2.8.19+ ASAP. More: https://radar.offseq.com/threat/cve-2026-81655-cwe-94-improper-control-of-generation-of-code-code-injection-in-ad-inserter-d330f89b1f759aca #OffSeq #WordPress #Infosec #Vuln

obot-platform obot <0.21.1 suffers a CRITICAL auth bypass (CVE-2026-101084): authenticated users with server IDs can access restricted MCP servers via /mcp-connect. Patch to 0.21.1 now! https://radar.offseq.com/threat/cve-2026-101084-authorization-bypass-through-user-controlled-key-in-obot-platform-obot-2f19c5f80b1ebeae #OffSeq #CVE2026101084 #infosec #vuln

🔴 CVE-2026-101084 - Critical (9.6)

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nezha 2.2.3 (CVE-2026-101090): CRITICAL open redirect via Host header injection in OAuth2 flow. Account takeover possible if dashboard_host is unset. Set to trusted value; no patch yet. https://radar.offseq.com/threat/cve-2026-101090-url-redirection-to-untrusted-site-open-redirect-in-nezhahq-nezha-17f76beacc249b5e #OffSeq #OAuth2 #Vulnerability #InfoSec

🔴 CVE-2026-101090 - Critical (9.8)

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101090/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101064 - High (7.6)

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101062 - High (8.8)

Obot before v0.23.0 (affected versions &lt;= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Beca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101062/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101045 - High (8)

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100673 - High (8.2)

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cas...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100872 - High (7.5)

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100870 - High (8.8)

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

wolfSSL 5.9.4 patches 10 wolfSSL vulnerabilities, including TLS authentication bypass flaws CVE-2026-93302 and CVE-2026-89136. Upgrade now.

#wolfSSL #wolfSSLVulnerabilities #TLS #AuthenticationBypass #EmbeddedSecurity #Cryptography #IoTSecurity #PatchNow

https://securityonline.info/wolfssl-5-9-4-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

wolfSSL 5.9.4 patches 10 wolfSSL vulnerabilities, including TLS authentication bypass flaws CVE-2026-93302 and CVE-2026-89136. Upgrade now.

#wolfSSL #wolfSSLVulnerabilities #TLS #AuthenticationBypass #EmbeddedSecurity #Cryptography #IoTSecurity #PatchNow

https://securityonline.info/wolfssl-5-9-4-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

wolfSSL 5.9.4 patches 10 wolfSSL vulnerabilities, including TLS authentication bypass flaws CVE-2026-93302 and CVE-2026-89136. Upgrade now.

#wolfSSL #wolfSSLVulnerabilities #TLS #AuthenticationBypass #EmbeddedSecurity #Cryptography #IoTSecurity #PatchNow

https://securityonline.info/wolfssl-5-9-4-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

wolfSSL 5.9.4 patches 10 wolfSSL vulnerabilities, including TLS authentication bypass flaws CVE-2026-93302 and CVE-2026-89136. Upgrade now.

#wolfSSL #wolfSSLVulnerabilities #TLS #AuthenticationBypass #EmbeddedSecurity #Cryptography #IoTSecurity #PatchNow

https://securityonline.info/wolfssl-5-9-4-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-100741 - Critical (9.8)

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-100741: CRITICAL eval injection in hMailServer (Windows, 6.0.0 – 6.3.3) enables remote code execution via JScript event scripting. Requires non-default config. Disable event scripting/JScript now. https://radar.offseq.com/threat/cve-2026-100741-cwe-95-improper-neutralization-of-directives-in-dynamically-evaluated-code-eval-a98d3d387bf12b13 #OffSeq #Vulnerability #CyberSec #CVE #hMailServer

🟠 CVE-2026-100843 - High (7.8)

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100843/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100839 - High (8.4)

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). ACPI tables containing AML bytecode are passed from the untrusted hos...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100839/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100847 - High (7.5)

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database informa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100847/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100851 - High (7.6)

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay pass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100857 - High (8)

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100856 - High (8.8)

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject neste...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100856/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100864 - High (8.8)

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100864/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100723 - High (7.5)

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through Node...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100723/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100833 - High (8.2)

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accept...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-100835: Contrast <1.16.0 faces CRITICAL remote attestation relay attacks. Any valid TEE attestation report is accepted, risking trust bypass. Upgrade ASAP. https://radar.offseq.com/threat/contrast-before-1160-is-susceptible-to-remote-attestation-relay-attacks-cve-2026-100835-3833ee713219f7e3 #OffSeq #CVE2026100835 #infosec #security

🟠 CVE-2026-100841 - High (7.8)

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100852 - High (8.8)

AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100852/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Fortinet posted a critical vulnerability yesterday:

CVE-2026-84388 - Improper Restriction of Rendered UI Layers or Frames in FortiPAM Chrome Extension Enables Remote Information Disclosure https://app.opencve.io/cve/CVE-2026-84388 #infosec #Fortinet #Chrome #vulnerability

🟠 CVE-2026-100720 - High (8.7)

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100713 - High (7.8)

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::make...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100713/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82901: CRITICAL (CVSS 9.8) file upload vuln in Ultra Addons for Contact Form 7 (≤3.5.50). RCE risk if PDF Generator enabled (off by default). Disable/monitor plugin & watch for patches. https://radar.offseq.com/threat/cve-2026-82901-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-themefic-ultra-addons-for-77a59cd90a3fbad1 #OffSeq #WordPress #Infosec #Vulnerability

🔴 CVE-2026-82901 - Critical (9.8)

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77203 - High (8.8)

The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100715 - Critical (9.6)

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100715/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100707 - High (7.7)

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100717 - Critical (9.9)

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100717/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100671 - High (8)

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100676 - High (8.2)

January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100676/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100685 - High (7.7)

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100683 - High (8)

Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename lit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100682 - High (8.8)

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with lea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100682/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100680 - High (8.1)

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100697 - High (8.6)

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[dr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100706 - Critical (9.9)

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. A...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100703 - High (7.7)

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100703/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack