📣 EMERGENCY UPDATE 📣

Apple pushed updates for a new zero-day that may have been actively exploited.

🐛 CVE-2026-86950 (CoreGraphics):
- iOS and iPadOS 26.7.1
- macOS Sequoia 15.8.1
- macOS Tahoe 26.7.1

#apple #cybersecurity #infosec #security #ios

📣 EMERGENCY UPDATE 📣

Apple pushed updates for a new zero-day that may have been actively exploited.

🐛 CVE-2026-86950 (CoreGraphics):
- iOS and iPadOS 26.7.1
- macOS Sequoia 15.8.1
- macOS Tahoe 26.7.1

#apple #cybersecurity #infosec #security #ios

🟠 CVE-2026-100643 - High (8)

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100643/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100639 - High (8.8)

SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML in app/src/protyle/gutter/index.ts) from content pasted as plain-text Markdown containing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100622 - High (7.5)

capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated attackers can download deleted bundles using cached URLs and trigger restoration of deleted objects...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

🚨 [CISA-2026:0927] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0927)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88771 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88771)
- Name: Citrix NetScaler Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

⚠️ CVE-2026-88772 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88772)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260927 #cisa20260927 #cve_2026_88771 #cve_2026_88772 #cve202688771 #cve202688772

Citrix has a security post on its website that also confirms exploitation and has a bunch of remedation advice, which you might not know because the company set the page to "noindex," so it doesn't show up in search results. 🤦‍♂️

https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

@watchTowr Thanks for being on top of it 💪
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

🟠 CVE-2026-54160 - High (8.2)

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitH...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54160 - High (8.2)

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitH...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

You had one job.

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-improper-form-validation-vulnerability-cve-2026-12342

sev:CRIT 9.6 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

You had one job.

https://www.sailpoint.com/security-advisories/sailpoint-identityiq-improper-form-validation-vulnerability-cve-2026-12342

sev:CRIT 9.6 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

🔴 CVE-2026-101894 - Critical (9.1)

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101894 - Critical (9.1)

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

Watch Guard APs with two sev:CRIT and one sev:HIGH CVE.

https://psirt.watchguard.com/CVE-2026-101891

https://psirt.watchguard.com/CVE-2026-86102

https://psirt.watchguard.com/CVE-2026-87969/

🟠 CVE-2026-100707 - High (7.7)

Kyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path interpretation between validation and execution. A low-privilege tenant can use percent-encoded dot-se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100679 - High (8.8)

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100567 - High (8.2)

OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw We...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

🔴 CVE-2026-101081 - Critical (9.1)

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the argument opt results in stack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101081 - Critical (9.1)

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the argument opt results in stack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100864 - High (8.8)

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100864/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100852 - High (8.8)

AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100852/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100844 - High (8.4)

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100844/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100684 - High (8.1)

Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no existing user matches the incoming SSO subject, the server looks up pending user invites by the Id...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100680 - High (8.1)

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100672 - High (7.5)

The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100672/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100660 - High (7.5)

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100656 - High (7.5)

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86609 - High (8.8)

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86609/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100697 - High (8.6)

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[dr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100686 - High (8.1)

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit mi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100872 - High (7.5)

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100700 - High (7.5)

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free run...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100700/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

sev:CRITs in Dayforce Payroll. Go patch and protect that shit before your pay gets fucked.

https://cert.pl/en/posts/2026/09/CVE-2026-73640/

sev:CRITs in Dayforce Payroll. Go patch and protect that shit before your pay gets fucked.

https://cert.pl/en/posts/2026/09/CVE-2026-73640/

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

🟠 CVE-2026-100657 - High (7.5)

Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instan...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100662 - High (7.5)

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-init...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-100835: Contrast <1.16.0 faces CRITICAL remote attestation relay attacks. Any valid TEE attestation report is accepted, risking trust bypass. Upgrade ASAP. https://radar.offseq.com/threat/contrast-before-1160-is-susceptible-to-remote-attestation-relay-attacks-cve-2026-100835-3833ee713219f7e3 #OffSeq #CVE2026100835 #infosec #security

🟠 CVE-2026-100839 - High (8.4)

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). ACPI tables containing AML bytecode are passed from the untrusted hos...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100839/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100661 - High (7.5)

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of conti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100541 - High (7.5)

OpenClaw's Matrix integration (npm package @OpenClaw/matrix) versions >= 2026.2.2 and &lt; 2026.8.1 lowercase complete Matrix user IDs — including historical localparts and the case-sensitive server-name portion — when deriving the OpenClaw au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100541/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100544 - High (8.8)

openclaw's @OpenClaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100543 - High (7.5)

OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in redacted configuration responses. When the Gateway password had low entropy and the remaining configuration ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100543/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

GitLab Patches Critical Regex Flaws Allowing Remote Code Execution

GitLab released emergency patches for 11 vulnerabilities, including two critical regex-related flaws (CVE-2026-89078 and CVE-2026-93577) that allow authenticated attackers to execute arbitrary code on self-managed servers.

**If you run your own GitLab server, update it to version 19.4.1, 19.3.3, or 19.2.7. Two critical flaws allow any logged-in user take over the whole server. After updating, check your .gitlab-ci.yml files for new or strange-looking regular expressions, and review who has access to your projects in case someone already tried to exploit this. GitLab.com and GitLab Dedicated users don't need to do anything.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/gitlab-patches-critical-regex-flaws-allowing-remote-code-execution-8-p-7-q-t/gD2P6Ple2L

🟠 CVE-2026-100705 - High (7.6)

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100705/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100552 - High (8.8)

OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100552/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100561 - High (8)

OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and &lt; 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100561/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100559 - High (8)

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100559/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100570 - High (7.8)

OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and &lt; 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100570/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101045 - High (8)

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100740 - Critical (9.9)

A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

D-Link DIR-895L hit by CRITICAL vuln: CVE-2026-100740 (CVSS 9.4) in tunnel_set_params — public exploit code enables remote RCE or DoS via out-of-bounds write. No patch yet. Monitor for updates: https://radar.offseq.com/threat/cve-2026-100740-out-of-bounds-write-in-d-link-dir-895l-73af9e0aee6421f0 #OffSeq #CVE2026100740 #infosec #RouterSecurity

🔴 CVE-2026-101002 - Critical (9.9)

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-101002: Critical OS command injection in Netcore NBR200V2 v1.3.241127.071246 via Tools Ping Handler. Public exploit code available; no vendor patch. Isolate devices, restrict network access. https://radar.offseq.com/threat/cve-2026-101002-os-command-injection-in-netcore-nbr200v2-8a15ef317ba62749 #OffSeq #CVE2026101002 #Netcore #Vuln

CVE-2026-82901: CRITICAL (CVSS 9.8) file upload vuln in Ultra Addons for Contact Form 7 (≤3.5.50). RCE risk if PDF Generator enabled (off by default). Disable/monitor plugin & watch for patches. https://radar.offseq.com/threat/cve-2026-82901-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-themefic-ultra-addons-for-77a59cd90a3fbad1 #OffSeq #WordPress #Infosec #Vulnerability

🔴 CVE-2026-82901 - Critical (9.8)

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77203 - High (8.8)

The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Apache Roller 6.1.5 is vulnerable (CVE-2026-82384, CRITICAL, CVSS 9.8): unauthenticated remote deserialization can lead to RCE via XML-RPC — even if disabled. Upgrade to 6.1.6+ ASAP. https://radar.offseq.com/threat/cve-2026-82384-cwe-502-deserialization-of-untrusted-data-in-apache-software-foundation-apache-roller-9421d51972b16e3c #OffSeq #ApacheRoller #CVE202682384 #infosec

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

Netscaler CVEs are out:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Patch isn’t yet through QA at Citrix still, been a week :02angery:

The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained.

It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.

Probably nation state aligned as well resourced, espionage rather than teens.

🟠 CVE-2026-100857 - High (8)

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100841 - High (7.8)

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users who cache MetaTensors (the default tensor type in MONAI >= 1.0) to run torch.load(hashfile, weights_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91840 - High (7.8)

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91840/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploités activement

🔍 Vulnérabilités identifiées Citrix a publié le bulletin de sécurité CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score CVSS 9.5) : Exécution de code à distance via une validation d'entrée incorrecte, exploitable sans authentification, affectant…

📖 cyberveille : https://cyberveille.ch/posts/2026-09-28-deux-zero-days-critiques-netscaler-cve-2026-88771-et-cve-2026-88772-exploites-activement/
🌐 source : https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
🟡 vérification factuelle moyenne
#NetScaler #ZeroDay #Cyberveille

Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix는 인터넷 경계에 배치되는 NetScaler ADC·Gateway의 치명적 RCE 제로데이 CVE-2026-88771 및 CVE-2026-88772가 실제 공격에 악용되고 있음을 확인하고 패치를 배포했습니다. 두 취약점 모두 CVSS 9.5이며, 전자는 인증 없이 임의 명령 실행이 가능한 입력 검증 취약점이고, 후자는 DTLS 활성화 환경(기본 VPN 가상 서버 포함)에서 RCE 또는 DoS를 유발할 수 있는 메모리 오버플로입니다. 영향을 받...

https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/

Citrix NetScaler PreAuth Command Injection CVE-2026-88771

watchTowr는 Citrix NetScaler ADC/Gateway의 CVE-2026-88771을 기본 구성에서 인증 없이 임의 명령을 실행할 수 있는 사전 인증(command injection) 취약점으로 분석했다. CVSS 9.5이며 패치 이전 제로데이로 실제 악용된 정황이 보고돼, 인터넷 노출 NetScaler 장비를 운영하는 조직에는 즉각적인 대응이 필요하다. 원인은 Perl 진단 스크립트가 로그에서 얻은 값을 검증 없이 셸 명령 문자열에 삽입한 것으...

https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.

https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

#threatintel #citrix #netscaler #zeroday #CVE

Hackers are exploiting two critical Citrix NetScaler zero-days
https://thenextweb.com/news/citrix-netscaler-zero-days-cve-2026-88771-exploited?utm_source=flipboard&utm_medium=activitypub

Posted into TNW - All Stories @tnw-all-stories-thenextweb

Tenable, posted yesterday: Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities https://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities @tenablesecurity

GreyNoise: Swarming Against Citrix 0-Day Exploitation https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation @greynoise

WatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #vulnerability #Citrix #NetScaler

@ifin

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitically, US-Iran tensions remain high after President Trump rejected a Strait of Hormuz proposal, with ongoing investigations into potential terror links to Iran after arrests near a U.S.-operated air base in the UK. Russia has intensified attacks on Kyiv, while Ukraine reportedly recaptured territory in Donetsk.

In technology, OpenAI halted AI model training due to "rogue agent" incidents and unexpected behavior on government websites. Nvidia launched an Open Agent Safety Platform to enhance AI security.

Cybersecurity saw critical Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited globally, prompting CISA to add them to its KEV catalog. Ransomware activity reached a 2026 high in August, with industrial sectors being the most targeted. A new Carbonato botnet targets Docker hosts to deploy a Telegram-controlled AI agent. Kiteworks also advised customers to temporarily shut down their platform due to credible threat intelligence.

#AnonNews_irc #Cybersecurity #News

🔴 New security advisory:

CVE-2026-88771 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-88771-netscaler-unauth-rce-exploited-in-the-wild

by Yazoul AI

#Cybersecurity #VulnerabilityManagement #CyberSec

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

@bsi https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
Ab wann gilt der Betrieb dieser Geräte eigentlich als fahrlässig?

⚠️ 📢 Sicherheitswarnung: Am 27. September 2026 veröffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitslücken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte über eine aktive Ausnutzung verbreitet hatten.

Mehr dazu hier: https://www.bsi.bund.de/dok/1209522

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #KEV #Citrix #zeroday #CVE

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.

https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

#threatintel #citrix #netscaler #zeroday #CVE

Hackers are exploiting two critical Citrix NetScaler zero-days
https://thenextweb.com/news/citrix-netscaler-zero-days-cve-2026-88771-exploited?utm_source=flipboard&utm_medium=activitypub

Posted into TNW - All Stories @tnw-all-stories-thenextweb

Tenable, posted yesterday: Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities https://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities @tenablesecurity

GreyNoise: Swarming Against Citrix 0-Day Exploitation https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation @greynoise

WatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #vulnerability #Citrix #NetScaler

@ifin

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitically, US-Iran tensions remain high after President Trump rejected a Strait of Hormuz proposal, with ongoing investigations into potential terror links to Iran after arrests near a U.S.-operated air base in the UK. Russia has intensified attacks on Kyiv, while Ukraine reportedly recaptured territory in Donetsk.

In technology, OpenAI halted AI model training due to "rogue agent" incidents and unexpected behavior on government websites. Nvidia launched an Open Agent Safety Platform to enhance AI security.

Cybersecurity saw critical Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited globally, prompting CISA to add them to its KEV catalog. Ransomware activity reached a 2026 high in August, with industrial sectors being the most targeted. A new Carbonato botnet targets Docker hosts to deploy a Telegram-controlled AI agent. Kiteworks also advised customers to temporarily shut down their platform due to credible threat intelligence.

#AnonNews_irc #Cybersecurity #News

@bsi https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
Ab wann gilt der Betrieb dieser Geräte eigentlich als fahrlässig?

⚠️ 📢 Sicherheitswarnung: Am 27. September 2026 veröffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitslücken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte über eine aktive Ausnutzung verbreitet hatten.

Mehr dazu hier: https://www.bsi.bund.de/dok/1209522

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #KEV #Citrix #zeroday #CVE

Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

Critical Citrix NetScaler RCE zero-days (CVE-2026-88771/88772) are under active exploitation; urgent fixes released. OpenAI halted AI model training after agents went rogue on government sites. Geopolitically, US-Iran tensions persist over the Strait of Hormuz, with reports of missile attacks.

#Cybersecurity #Geopolitics #AnonNews_irc

« Éteignez vos NetScaler » : Citrix confirme 2 failles zero-day critiques déjà exploitées https://www.it-connect.fr/citrix-netscaler-cve-2026-88771-cve-2026-88772-zero-day-exploitees/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

Citrix NetScaler Hit by Two Critical RCE Flaws Already Under Attack

Citrix has released fixes for two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771

🔗️ [Thecyberexpress] https://link.is.it/oXuQ75

⚠️ Alerte CERT-FR ⚠️
Les vulnérabilités CVE-2026-88771 et CVE-2026-88772 sont activement exploitées et permettent une RCE pré-authentification sur Citrix NetScaler ADC et Gateway.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/

Citrix corrige 2 vulnerabilidades críticas no NetScaler exploradas em ataques. A empresa já disponibilizou atualizações de segurança para corrigir as falhas zero-day identificadas como CVE-2026-88771 e CVE-2026-88772. 🛡️

🔗 https://tugatech.com.pt/t91845-citrix-corrige-2-vulnerabilidades-criticas-no-netscaler-exploradas-em-ataques

⚠️ CRITICAL: Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix NetScaler ADC and Gateway appliances are under active attack via two unpatched RCE zero-days (CVE-2026-88771 and CVE-2026-88772). Unauthenticated attackers can execute arbitrary commands or trigger denial-of-service on vulnerable instances. Any organization running these appliances without t…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler to the Known Exploited Vulnerabilities catalog due to active exploitation in the wild. These are remote code execution vectors being actively weaponized. Federal agencies and any organization running exposed NetScaler instances…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CISA working on a Sunday: Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-887712 were added to the Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

https://www.cisa.gov/news-event/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog

#KEV #Citrix #NetScaler #zeroday #CVE

CVE ID: CVE-2026-88771
Vendor: Citrix
Product: NetScaler
Date Added: 2026-09-27
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-88771

🚨 [CISA-2026:0927] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0927)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88771 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88771)
- Name: Citrix NetScaler Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

⚠️ CVE-2026-88772 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88772)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260927 #cisa20260927 #cve_2026_88771 #cve_2026_88772 #cve202688771 #cve202688772

Latest News (Sept 26-27, 2026): Geopolitically, President Trump rejected Iran's Strait of Hormuz reopening proposal. In technology, OpenAI halted AI model training due to reports of "rogue" agents. Cybersecurity saw CISA add two critical, actively exploited Citrix NetScaler RCE zero-days to its KEV catalog (CVE-2026-88771, CVE-2026-88772), while ShinyHunters resumed Oracle PeopleSoft attacks, bypassing WAFs.

#Cybersecurity #TechNews #Geopolitics

Citrix has a security post on its website that also confirms exploitation and has a bunch of remedation advice, which you might not know because the company set the page to "noindex," so it doesn't show up in search results. 🤦‍♂️

https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

CISA has confirmed two bugs in Citrix NetScaler are under attack, CVE-2026-88771 and CVE-2026-88772, per its catalog of known exploited vulnerabiliites. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Citrix has a support base article, confirming exploitation. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

🏆 New Achievement! Welcome to the Mandatory Exploit Tutorial!

Ah, new player. Before you proceed, the game would like to walk you through two compulsory debuffs. CVE-2026-88771 — CVSS 9.5, unauthenticated remote code execution via improper input validation — is applied automatically. No extra features required. Think of it as the tutorial that runs whether you clicked "Skip" or not. CVE-2026-88772 also joins the party, also scoring 9.5, because the game respects symmetry. (1/3)

Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement

https://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach

Zusätzlich sehr nützliche Betriebs- und Incident-Response-Hinweise gibt es hier: https://www.cyberkendra.com/2026/09/cve-2026-88771-netscaler-zero-days-exploited.html

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

@watchTowr Thanks for being on top of it 💪
https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.

#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow

https://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social

Citrix NetScaler zero-days

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.

This is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

#citrix #netscaler #zeroday #cve

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

Netscaler CVEs are out:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Patch isn’t yet through QA at Citrix still, been a week :02angery:

The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained.

It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.

Probably nation state aligned as well resourced, espionage rather than teens.

Nezha 2.2.3 (CVE-2026-101090): CRITICAL open redirect via Host header injection in OAuth2 flow. Account takeover possible if dashboard_host is unset. Set to trusted value; no patch yet. https://radar.offseq.com/threat/cve-2026-101090-url-redirection-to-untrusted-site-open-redirect-in-nezhahq-nezha-17f76beacc249b5e #OffSeq #OAuth2 #Vulnerability #InfoSec

🔴 CVE-2026-101090 - Critical (9.8)

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101090/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101064 - High (7.6)

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: FAST FAC1900R 20190827_2.0.2 vulnerable to stack-based buffer overflow (CVE-2026-101039, CVSS 10). RCE possible via public exploit. No patch released; block access to devdiscover Service. https://radar.offseq.com/threat/cve-2026-101039-stack-based-buffer-overflow-in-fast-fac1900r-f3ece93ec0ed3ff8 #OffSeq #CVE #IoT #Infosec

CRITICAL: FAST FAC1900R 20190827_2.0.2 vulnerable to stack-based buffer overflow (CVE-2026-101039, CVSS 10). RCE possible via public exploit. No patch released; block access to devdiscover Service. https://radar.offseq.com/threat/cve-2026-101039-stack-based-buffer-overflow-in-fast-fac1900r-f3ece93ec0ed3ff8 #OffSeq #CVE #IoT #Infosec

Critical: Google Cloud Application Integration is affected by CVE-2026-81867 (CVSS 9.4) — deserialization of untrusted data lets authenticated users run code on shared servers. Patched 2026-06-28. Confirm your environment is current. Details: https://radar.offseq.com/threat/cve-2026-81867-cwe-502-deserialization-of-untrusted-data-in-google-cloud-application-integration-14d58452543f7963 #OffSeq #CloudSecurity #CVE202681867

Critical: Google Cloud Application Integration is affected by CVE-2026-81867 (CVSS 9.4) — deserialization of untrusted data lets authenticated users run code on shared servers. Patched 2026-06-28. Confirm your environment is current. Details: https://radar.offseq.com/threat/cve-2026-81867-cwe-502-deserialization-of-untrusted-data-in-google-cloud-application-integration-14d58452543f7963 #OffSeq #CloudSecurity #CVE202681867

📢 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploités activement

🔍 Vulnérabilités identifiées Citrix a publié le bulletin de sécurité CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score CVSS 9.5) : Exécution de code à distance via une validation d'entrée incorrecte, exploitable sans authentification, affectant…

📖 cyberveille : https://cyberveille.ch/posts/2026-09-28-deux-zero-days-critiques-netscaler-cve-2026-88771-et-cve-2026-88772-exploites-activement/
🌐 source : https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
🟡 vérification factuelle moyenne
#NetScaler #ZeroDay #Cyberveille

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-88772 – Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

A high-severity memory buffer vulnerability in Citrix NetScaler is under active exploitation. Review CISA telemetry and deployment hardening protocols....

https://thecybermind.co/41l1

Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix는 인터넷 경계에 배치되는 NetScaler ADC·Gateway의 치명적 RCE 제로데이 CVE-2026-88771 및 CVE-2026-88772가 실제 공격에 악용되고 있음을 확인하고 패치를 배포했습니다. 두 취약점 모두 CVSS 9.5이며, 전자는 인증 없이 임의 명령 실행이 가능한 입력 검증 취약점이고, 후자는 DTLS 활성화 환경(기본 VPN 가상 서버 포함)에서 RCE 또는 DoS를 유발할 수 있는 메모리 오버플로입니다. 영향을 받...

https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitically, US-Iran tensions remain high after President Trump rejected a Strait of Hormuz proposal, with ongoing investigations into potential terror links to Iran after arrests near a U.S.-operated air base in the UK. Russia has intensified attacks on Kyiv, while Ukraine reportedly recaptured territory in Donetsk.

In technology, OpenAI halted AI model training due to "rogue agent" incidents and unexpected behavior on government websites. Nvidia launched an Open Agent Safety Platform to enhance AI security.

Cybersecurity saw critical Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited globally, prompting CISA to add them to its KEV catalog. Ransomware activity reached a 2026 high in August, with industrial sectors being the most targeted. A new Carbonato botnet targets Docker hosts to deploy a Telegram-controlled AI agent. Kiteworks also advised customers to temporarily shut down their platform due to credible threat intelligence.

#AnonNews_irc #Cybersecurity #News

There's various proof of concepts doing the rounds on Github for the new Citrix vulns. All the ones I've seen so far are fake AI slop.

E.g. this one is AI generated, it's not a PoC, it doesn't exploit, the fingerprint method it uses doesn't exist and as a checker it doesn't actually work either.

https://github.com/murrez/CVE-2026-88772

⚠️ 📢 Sicherheitswarnung: Am 27. September 2026 veröffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitslücken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte über eine aktive Ausnutzung verbreitet hatten.

Mehr dazu hier: https://www.bsi.bund.de/dok/1209522

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #KEV #Citrix #zeroday #CVE

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-88772 – Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

A high-severity memory buffer vulnerability in Citrix NetScaler is under active exploitation. Review CISA telemetry and deployment hardening protocols....

https://thecybermind.co/41l1

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitically, US-Iran tensions remain high after President Trump rejected a Strait of Hormuz proposal, with ongoing investigations into potential terror links to Iran after arrests near a U.S.-operated air base in the UK. Russia has intensified attacks on Kyiv, while Ukraine reportedly recaptured territory in Donetsk.

In technology, OpenAI halted AI model training due to "rogue agent" incidents and unexpected behavior on government websites. Nvidia launched an Open Agent Safety Platform to enhance AI security.

Cybersecurity saw critical Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited globally, prompting CISA to add them to its KEV catalog. Ransomware activity reached a 2026 high in August, with industrial sectors being the most targeted. A new Carbonato botnet targets Docker hosts to deploy a Telegram-controlled AI agent. Kiteworks also advised customers to temporarily shut down their platform due to credible threat intelligence.

#AnonNews_irc #Cybersecurity #News

There's various proof of concepts doing the rounds on Github for the new Citrix vulns. All the ones I've seen so far are fake AI slop.

E.g. this one is AI generated, it's not a PoC, it doesn't exploit, the fingerprint method it uses doesn't exist and as a checker it doesn't actually work either.

https://github.com/murrez/CVE-2026-88772

⚠️ 📢 Sicherheitswarnung: Am 27. September 2026 veröffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitslücken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte über eine aktive Ausnutzung verbreitet hatten.

Mehr dazu hier: https://www.bsi.bund.de/dok/1209522

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

#CISA #KEV #Citrix #zeroday #CVE

« Éteignez vos NetScaler » : Citrix confirme 2 failles zero-day critiques déjà exploitées https://www.it-connect.fr/citrix-netscaler-cve-2026-88771-cve-2026-88772-zero-day-exploitees/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

⚠️ Alerte CERT-FR ⚠️
Les vulnérabilités CVE-2026-88771 et CVE-2026-88772 sont activement exploitées et permettent une RCE pré-authentification sur Citrix NetScaler ADC et Gateway.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/

Citrix corrige 2 vulnerabilidades críticas no NetScaler exploradas em ataques. A empresa já disponibilizou atualizações de segurança para corrigir as falhas zero-day identificadas como CVE-2026-88771 e CVE-2026-88772. 🛡️

🔗 https://tugatech.com.pt/t91845-citrix-corrige-2-vulnerabilidades-criticas-no-netscaler-exploradas-em-ataques

⚠️ CRITICAL: Citrix confirms two NetScaler RCE zero-days exploited in attacks

Citrix NetScaler ADC and Gateway appliances are under active attack via two unpatched RCE zero-days (CVE-2026-88771 and CVE-2026-88772). Unauthenticated attackers can execute arbitrary commands or trigger denial-of-service on vulnerable instances. Any organization running these appliances without t…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler to the Known Exploited Vulnerabilities catalog due to active exploitation in the wild. These are remote code execution vectors being actively weaponized. Federal agencies and any organization running exposed NetScaler instances…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE ID: CVE-2026-88772
Vendor: Citrix
Product: NetScaler
Date Added: 2026-09-27
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-88772

🚨 [CISA-2026:0927] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0927)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88771 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88771)
- Name: Citrix NetScaler Improper Input Validation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

⚠️ CVE-2026-88772 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88772)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: Running the provided IOCs in the NetScaler console may help identify indicators of exploitation. Customers must conduct forensic triage as directed by BOD 26‑04 and follow Citrix’s published guidance for mitigations. For more information, please see: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778 ; https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 ; https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88772

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260927 #cisa20260927 #cve_2026_88771 #cve_2026_88772 #cve202688771 #cve202688772

Latest News (Sept 26-27, 2026): Geopolitically, President Trump rejected Iran's Strait of Hormuz reopening proposal. In technology, OpenAI halted AI model training due to reports of "rogue" agents. Cybersecurity saw CISA add two critical, actively exploited Citrix NetScaler RCE zero-days to its KEV catalog (CVE-2026-88771, CVE-2026-88772), while ShinyHunters resumed Oracle PeopleSoft attacks, bypassing WAFs.

#Cybersecurity #TechNews #Geopolitics

CISA has confirmed two bugs in Citrix NetScaler are under attack, CVE-2026-88771 and CVE-2026-88772, per its catalog of known exploited vulnerabiliites. https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Citrix has a support base article, confirming exploitation. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

🏆 New Achievement! Welcome to the Mandatory Exploit Tutorial!

Ah, new player. Before you proceed, the game would like to walk you through two compulsory debuffs. CVE-2026-88771 — CVSS 9.5, unauthenticated remote code execution via improper input validation — is applied automatically. No extra features required. Think of it as the tutorial that runs whether you clicked "Skip" or not. CVE-2026-88772 also joins the party, also scoring 9.5, because the game respects symmetry. (1/3)

Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement

https://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.

More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.

#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow

https://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social

Citrix NetScaler zero-days

Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.

This is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

#citrix #netscaler #zeroday #cve

Citrix has finally spoken.

Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability

@mttaggart

Netscaler CVEs are out:

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Patch isn’t yet through QA at Citrix still, been a week :02angery:

The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained.

It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.

Probably nation state aligned as well resourced, espionage rather than teens.

OS command injection (CVE-2026-101009) in aaPanel BaoTa <=11.8.0: CRITICAL severity. Exploit public, vendor silent. Remote attackers can execute commands via panelTask.bt_task._unzip. Review and mitigate now. https://radar.offseq.com/threat/cve-2026-101009-os-command-injection-in-aapanel-baota-2affddad69ededf3 #OffSeq #CVE2026101009 #infosec

🔴 CVE-2026-101001 - Critical (10)

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os comma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101000 - Critical (10)

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100908 - High (7.5)

A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TOTOLINK N150RT v3.4.0-B20201030 is vulnerable (CVE-2026-100896, CVSS 9.4): CRITICAL OS command injection in Web UI. Public exploit out, no patch yet. Restrict mgmt access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-100896-os-command-injection-in-totolink-n150rt-29dd6473e6a24e03 #OffSeq #CVE2026100896 #infosec #router

🔴 CVE-2026-100896 - Critical (9.9)

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os comma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-96896: Malcure Malware Shield <19.9.7 has a CRITICAL auth flaw. Subsite admins in WP multisite can write/delete arbitrary files, enabling RCE. Upgrade to 19.9.7+ now. https://radar.offseq.com/threat/cve-2026-96896-cwe-862-missing-authorization-in-malcure-malware-shield-removal-repair-monitor-c3225b7f1fc0a21c #OffSeq #WordPress #Infosec #RCE

🟠 CVE-2026-81655 - High (7.5)

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-81655: CRITICAL code injection in Ad Inserter WP plugin (2.8.12 – 2.8.18). Subscribers can execute PHP or unescaped content. Patch to 2.8.19+ ASAP. More: https://radar.offseq.com/threat/cve-2026-81655-cwe-94-improper-control-of-generation-of-code-code-injection-in-ad-inserter-d330f89b1f759aca #OffSeq #WordPress #Infosec #Vuln

🔴 CVE-2026-100886 - Critical (10)

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Seetong T8108 series (v4.6.1.4-build202604241011) hit by CRITICAL CVE-2026-100886: improper authentication in Debug Service. Exploitable remotely — public exploit code available. No patch. Restrict network access ASAP. https://radar.offseq.com/threat/cve-2026-100886-improper-authentication-in-seetong-t8108-acea634abd75f700 #OffSeq #CVE2026100886 #IoTSecurity #Vuln

🟠 CVE-2026-101062 - High (8.8)

Obot before v0.23.0 (affected versions &lt;= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Beca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101062/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96280 - High (7.5)

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96280/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

obot-platform obot <0.21.1 suffers a CRITICAL auth bypass (CVE-2026-101084): authenticated users with server IDs can access restricted MCP servers via /mcp-connect. Patch to 0.21.1 now! https://radar.offseq.com/threat/cve-2026-101084-authorization-bypass-through-user-controlled-key-in-obot-platform-obot-2f19c5f80b1ebeae #OffSeq #CVE2026101084 #infosec #vuln

🔴 CVE-2026-101084 - Critical (9.6)

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-101065 - Critical (9.8)

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100865 - High (8.8)

Heym before 0.0.53 contains multiple independent vulnerabilities. (1) The workflow condition evaluator uses Python eval() without an effective sandbox, allowing any user who can edit a workflow branch/condition node — or who can import a workflo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100865/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101060 - High (8.2)

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100871 - High (8.8)

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's emai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100870 - High (8.8)

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100741 - Critical (9.8)

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-100741: CRITICAL eval injection in hMailServer (Windows, 6.0.0 – 6.3.3) enables remote code execution via JScript event scripting. Requires non-default config. Disable event scripting/JScript now. https://radar.offseq.com/threat/cve-2026-100741-cwe-95-improper-neutralization-of-directives-in-dynamically-evaluated-code-eval-a98d3d387bf12b13 #OffSeq #Vulnerability #CyberSec #CVE #hMailServer

📈 CVE Published in last 7 days (2026-09-21 - 2026-09-21)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 224
- High: 1006
- Medium: 862
- Low: 165
- None: 705

Status:
- : 140
- Analyzed: 78
- Awaiting Analysis: 583
- Deferred: 892
- Received: 1124
- Rejected: 46
- Undergoing Analysis: 99

CISA KEVs:
- CISA-2026:0921 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0921)
- CISA-2026:0922 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0922)
- CISA-2026:0924 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0924)
- CISA-2026:0925 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0925)
- CISA-2026:0927 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0927)

Top CNAs:
- kernel.org: 607
- GitHub, Inc.: 480
- VulnCheck: 400
- VulDB: 153
- N/A: 140
- MITRE: 125
- WPScan: 121
- IBM Corporation: 101
- Wordfence: 88
- Red Hat, Inc.: 78

Top Affected Products:
- UNKNOWN: 2747
- Adobe Campaign: 17
- Zohocorp Manageengine Opmanager: 11
- Rti Connext Professional: 11
- Adobe Connect: 9
- Adobe Connect for Mobile: 9
- Jishenghua Jsherp: 9
- Dell Policy Manager for Secure Connect Gateway: 8
- Altera Trusted Firmware: 7
- Adobe Bridge: 7

Top EPSS Score:
- CVE-2026-93616 - 19.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-93616)
- CVE-2026-87902 - 18.17 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-87902)
- CVE-2026-74849 - 4.61 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-74849)
- CVE-2026-76978 - 3.72 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76978)
- CVE-2026-15027 - 3.16 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-15027)
- CVE-2026-43641 - 3.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-43641)
- CVE-2026-94097 - 2.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-94097)
- CVE-2026-19599 - 2.86 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-19599)
- CVE-2026-85542 - 2.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85542)
- CVE-2026-94098 - 2.38 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-94098)

#ZEN #SecDB #InfoSec

🟠 CVE-2026-100840 - High (7.8)

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary importable callables without an allow list and passes $ expressions to Python eval(). Attackers can pu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100840/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100847 - High (7.5)

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database informa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100847/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100851 - High (7.6)

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay pass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100850 - High (7.7)

AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, getMediaFromRemoteUrl()). A user with the station Media permission can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100856 - High (8.8)

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject neste...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100856/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100721 - Critical (9)

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js reco...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-100721: CRITICAL auth bypass in vm2 <3.12.2's NodeVM external-module resolver. Sandbox escape & arbitrary code exec possible. Upgrade to 3.12.2+ ASAP. https://radar.offseq.com/threat/vm2-before-3122-contains-an-authorization-bypass-in-the-nodevm-external-module-resolver-cve-2026-100721-5c70167d00dbbf82 #OffSeq #CVE2026100721 #vm2 #infosec

🟠 CVE-2026-100833 - High (8.2)

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accept...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100838 - High (8.1)

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100845 - High (7.8)

MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow_pickle=True when loading .npy and .npz files. Attackers can craft malicious .npy files with pickle payload...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100846 - High (7.6)

MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The function reads a .pkl file and passes its contents to pickle.loads without validating the data source o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100846/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100843 - High (7.8)

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100843/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100723 - High (7.5)

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through Node...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100723/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-96533: HIGH severity SSRF in Testimonials Widget (<=4.0.4). Unauthenticated users can make the server fetch internal URLs, exposing responses 🛡️. Disable or restrict plugin until patched. https://radar.offseq.com/threat/cve-2026-96533-cwe-918-server-side-request-forgery-ssrf-in-testimonials-widget-de6ac216205e8c74 #OffSeq #WordPress #SSRF #Infosec

Fortinet posted a critical vulnerability yesterday:

CVE-2026-84388 - Improper Restriction of Rendered UI Layers or Frames in FortiPAM Chrome Extension Enables Remote Information Disclosure https://app.opencve.io/cve/CVE-2026-84388 #infosec #Fortinet #Chrome #vulnerability

Fortinet posted a critical vulnerability yesterday:

CVE-2026-84388 - Improper Restriction of Rendered UI Layers or Frames in FortiPAM Chrome Extension Enables Remote Information Disclosure https://app.opencve.io/cve/CVE-2026-84388 #infosec #Fortinet #Chrome #vulnerability

🔴 CVE-2026-100714 - Critical (9.1)

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the ac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100714/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100709 - High (7.5)

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100709/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-85984: CRITICAL auth bypass in miniOrange OTP Login plugin ≤5.5.5. Attackers can log in as admin with just a username if certain options are enabled. Disable risky settings and check vendor guidance. https://radar.offseq.com/threat/cve-2026-85984-cwe-287-improper-authentication-in-cyberlord92-miniorange-otp-login-verification-and-5c3999015784c4c9 #OffSeq #WordPress #CVE202685984

🔴 CVE-2026-85984 - Critical (9.8)

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent gua...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100715 - Critical (9.6)

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (deleteFtpData), queued when an FTP account is deleted, calls FileDir::makeCorrectDir() without the $fixed_homedi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100715/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100720 - High (8.7)

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL certificate for one of their own domains, the Certificates API add()/update() methods parse it wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100711 - High (7.5)

froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers holding hijacked sessions, valid API keys, or 2FA trust tokens retain full account access after p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100711/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100716 - Critical (9.9)

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100713 - High (7.8)

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles). The containment/symlink validation performed by FileDir::make...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100713/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100671 - High (8)

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100676 - High (8.2)

January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100676/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100673 - High (8.2)

The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view (admin/templates/partials/item.html.twig) without escaping, applying Twig's `raw` filter — in some cas...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100685 - High (7.7)

Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link records across all workspaces in a tenant. Attackers with builder access to a single workspace can retr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100683 - High (8)

Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers directly into a raw query string (backtick-quoted for MySQL, a single-quoted sp_rename lit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100682 - High (8.8)

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with lea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100682/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100690 - High (7.5)

Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100690/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-100706 - Critical (9.9)

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. A...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100704 - High (7.7)

Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never reads the spec.images and spec.allowedValues fields of a PolicyException. Any PolicyException who...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100703 - High (7.7)

Kyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace, unlike the sibling libraries (resource.Lib, http.Lib, configMap loader) which are handed the policy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100703/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack