U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS.

“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” reads the advisory.

The flaw occurs when the system does not properly enforce SAML authentication controls. An attacker who already has valid credentials for an alternative authentication method may exploit this weakness to bypass SAML-based authentication.

The impact is particularly serious when organisations rely on SAML to enforce multi-factor authentication (MFA). Successful exploitation may allow an attacker to access the SSL VPN without completing the expected SAML authentication process, potentially bypassing the additional MFA protection.

In practical terms, the vulnerability could weaken an organisation’s remote access security by allowing users with alternative valid credentials to circumvent its intended authentication controls.

It’s important to highlight that this is not an unauthenticated remote access vulnerability. The attacker needs valid credentials for an alternative authentication method, but may then bypass SAML-enforced security controls.

SonicWall’s PSIRT team is investigating a report of possible exploitation of this flaw. The company strongly recommends that customers install the latest available update as soon as possible to reduce the risk of attacks.

“SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” reads the advisory.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by November 20, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple flaw, tracked as CVE-2024-27834 (CVSS score of 5.5), to its Known Exploited Vulnerabilities (KEV) catalog.

“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.” reads the advisory by CISA.

CVE-2024-27834 is a security vulnerability affecting Apple’s operating systems and Safari. It could allow an attacker who already has arbitrary read and write capabilities on a device to bypass Pointer Authentication (PAC), a hardware-based security mechanism designed to protect memory addresses and prevent certain types of memory-corruption attacks.

Pointer Authentication is a security feature implemented in Apple processors. It adds cryptographic signatures to pointers, helping ensure that memory addresses have not been maliciously modified.

An attacker who gains the ability to read and write arbitrary memory could potentially exploit CVE-2024-27834 to circumvent these protections. This could weaken an important security barrier and make further exploitation of the device easier.

What is the impact?

• Bypassing Pointer Authentication protections.
• Weakening defenses against memory-corruption attacks.
• Potentially facilitating further exploitation when combined with other vulnerabilities.

Apple addressed the vulnerability through improved security checks in:

• Safari 17.5
• iOS 16.7.8 and iOS 17.5
• iPadOS 16.7.8 and iPadOS 17.5
• macOS Sonoma 14.5
• tvOS 17.5
• watchOS 10.5

Cybersecurity firm Sekoia reports on attacks attributed with moderate to high confidence to Russia-linked cyberespionage group APT29. Attackers used compromised websites, fake websites and a supply-chain compromise of Plerdy SEO Tracker to deliver malicious JavaScript. The zero-click exploit chain targeted Safari and Chrome vulnerabilities to bypass security protections and deploy information-stealing malware capable of collecting browser cookies and device data.

“Achieving arbitrary read/write access within the renderer is no longer sufficient for full exploitation on modern Apple silicon. This architecture relies on Pointer Authentication Codes (PAC) to cryptographically sign control-flow pointers. Because of this, even if an attacker can manipulate memory, they cannot simply overwrite a function pointer to hijack the execution flow, triggering an improperly signed pointer will crash the process rather than execute the payload.” Sekoia writes. “To overcome this mitigation and forge the valid pointers required for arbitrary code execution, the exploit chain incorporates a PAC bypass utilizing CVE-2024-27834.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by November 18, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-111357 (CVSS score of 8.8) – A missing authentication check for a critical function that could allow an authenticated local attacker to gain higher privileges.
• CVE-2026-118527 (CVSS score of 4.3) – A predictable identifier vulnerability that could allow an authenticated remote attacker to upload files containing malicious content to a known location on the system.

The vulnerabilities are part of an exploit chain that cybersecurity firm Volexity first documented in mid-October.

“Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers.” states Volexity. “Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred.“

The attacks combined these vulnerabilities with an authentication bypass vulnerability, tracked as CVE-2026-104935 (CVSS score of 8.6).

In early October 2026, Volexity discovered that a threat actor tracked as UTA0576 was exploiting a zero-day vulnerability chain to compromise fully patched Ivanti Connect Secure VPN appliances. The attack combined authentication bypass, remote code execution, and privilege escalation flaws, allowing attackers to gain root access without logging in. The authentication bypass and RCE flaws are tracked as CVE-2026-104935.

After gaining access, the attackers targeted Active Directory credentials and sensitive information, including LAPS passwords and BitLocker recovery keys. Volexity worked with Ivanti as soon as it suspected the vulnerabilities were being exploited.

CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.

Ivanti released security updates to address both CVE-2026-111357 and CVE-2026-118527:

• Version 25.1.1.2 and earlier: upgrade to 25.1.1.3.
• Version 22.8R2.5 and earlier: upgrade to 22.8R2.6.

Ivanti said it disclosed CVE-2026-104935 first because a fix was already available and ready for testing. When researchers discovered the additional privilege escalation flaws, the company decided not to delay the release of the first patch, which addressed the main attack method. Ivanti also worked with Volexity to share information about the attackers’ techniques, including how they chained the vulnerabilities.

Ivanti had already fixed part of the issue in its July 25.1.3.0 release and was preparing updates for other supported versions. Patches are now available for all the vulnerabilities used in the attacks.

“At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible.” states Ivanti. “Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

• CVE-2026-97229 (CVSS score of 10.0) GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability
• CVE-2026-76418 (CVSS score of 8.6) Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

CVE-2026-97229 is a critical security flaw that could let attackers run code on its servers without logging in.

The flaw affects Community Edition (CE) and Enterprise Edition (EE), it is an integer overflow bug caused by weak validation of regular expressions in CI/CD configurations. The issue affects GitLab versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. Users should upgrade to a patched version to protect their systems. GitLab advisory

“GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.” reads the advisory.

The researchers joaxcar reported this vulnerability through the company’s HackerOne bug bounty program.

Alpine Linux recently reported that an unknown attacker tried to exploit the vulnerability against Alpine Linux on October 20 and 21, 2026, but the attempts failed.

CVE-2026-76418 is a NULL pointer dereference vulnerability affecting Cisco Secure Firewall ASA and FTD Software. It could allow an unauthenticated remote attacker to force a device to reload, causing a denial-of-service (DoS) condition.

Cisco said it became aware of active exploitation earlier this month. The company has not disclosed who is behind the attacks, how many organizations have been targeted, or what attackers may have done after gaining access.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the two vulnerabilities by November 1st, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux Kernel and Broadcom VMWare ESX vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

• CVE-2026-41709 (CVSS score of 7.6) Broadcom VMWare ESX Insufficient Logging Vulnerability
• CVE-2026-46300 (CVSS score of 2.7) Linux Kernel Missing Initialization of a Variable Vulnerability

In July, Broadcom released patches to address five vulnerabilities affecting VMware ESXi, vCenter, Workstation, and Fusion, including CVE-2026-41709. The vulnerability in VMware ESX is caused by insufficient logging. A malicious user with administrator privileges could perform certain operations on the affected system without those actions being recorded in the logs.

This could allow an attacker to hide specific activities and make it harder for security teams to detect suspicious behavior, investigate incidents, and determine what happened. The flaw does not itself grant administrator privileges; the attacker must already have them.

According to CrowdStrike’s 2026 Legal Threat Landscape Report, which said the China-linked threat actor Warp Panda (aka Armory Castle, UNC5221, Clay Typhoon and VerdantBamboo) exploited CVE-2026-41709 as a zero-day in early 2026 to reduce the visibility of its activities in audit logs.

Warp Panda targets internet-facing edge devices by exploiting zero-day vulnerabilities and deploying custom malware to maintain persistent, covert access. The group also attempts to evade detection by bypassing audit logging, stealing cloud session tokens and registering unauthorized multi-factor authentication (MFA) devices.

The second flaw added to the catalog is CVE-2026-46300, also known as Fragnesia, could let local attackers gain root access through page cache corruption.

The flaw affects the XFRM ESP-in-TCP subsystem and could allow local attackers to gain full root access by corrupting the kernel page cache.

Security experts warn that the issue is dangerous because attackers with low privileges can modify read-only files in memory and take complete control of vulnerable systems. The vulnerability was discovered by William Bowling of the V12 security team, while Wiz published a detailed technical analysis.

“The vulnerability allows unprivileged local attackers to modify read-only file contents in the kernel page cache.” reads the report published by Wiz. “Attackers can then achieve root privileges through deterministic page-cache corruption.”

Fragnesia shares similarities with earlier Linux privilege escalation flaws, such as Dirty Frag and Copy Fail. According to researchers, the bug can reliably provide root access on major Linux distributions without requiring race conditions or complicated timing attacks.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix CVE-2026-41709 by November 11, 2026, while CVE-2026-46300, must be fixed by October 31, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

CVE-2026-41709

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Brotli and Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

Below are the flaws added to the catalog:

• CVE-2026-111497 (CVSS score: 9.2) – An unchecked return value vulnerability in Google Brotli that could allow a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial-of-service, or potentially execute arbitrary code by sending a specially crafted Brotli-compressed stream.
• CVE-2026-48356 (CVSS score: 9.3) – An unrestricted file upload vulnerability in Adobe Commerce and Magento that could allow an attacker to execute arbitrary code with the privileges of the current user, potentially gaining elevated access or taking control of the victim’s account or session.

Brotli is a data-compression algorithm developed by Google.It reduces the size of web content, such as HTML, CSS, JavaScript, and other text-based resources. Security researchers have observed exploitation attempts targeting CVE-2026-111497 (aka Node2Shell), a critical flaw in Google’s Brotli library. Previdian recorded one attempt by October 27, while ELLIO researchers recently detected traffic carrying a public exploit that could execute code on vulnerable systems. The activity may indicate attempts to exploit the flaw on a larger scale, but its scope remains unclear. An attacker can trigger the vulnerability to cause crashes, expose sensitive memory or remote code execution when applications decompress attacker-controlled Brotli data. Because Brotli is widely used, multiple projects and vendors have released security updates, including Node.js, PHP, Bun, and Microsoft .NET. Cybersecurity firm Wiz warned that 91% of cloud environments contain resources vulnerable to the flaw, while 82% have publicly exposed Node.js instances.

The second flaw added to the catalog is an unrestricted file upload vulnerability tracked as CVE-2026-48356, dubbed PolyShell. Recently WordPress security firm Sansec warned of attacks exploiting CVE-2026-48356 to infect at least 953 of online stores. The attackers reportedly used a Magento CMS block to insert a malicious loader capable of retrieving and executing a payload hosted under their control.

So far, researchers have not recovered the subsequent payload, leaving the campaign’s ultimate objectives unclear. The activity is believed to have been underway since at least July 2025 and remains ongoing.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by October 29, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-109618 – PHP Memory Corruption Vulnerability 
• CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability 

On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2). The flaws affect all PHP versions that handle web requests.

The vulnerable code dates back to PHP 5.4, released in 2012, and resides in the PHP engine itself rather than in individual applications. Attackers can exploit the flaws to execute code remotely by sending specially crafted HTTP requests, without authentication.

Exploitation attempts increased rapidly after the vulnerabilities became public. Cloudflare researchers reported tens of thousands of attempts within the first 45 minutes, hundreds of thousands in just two hours, and millions by October 22.

Cyfirma reported that a group of North Korea-linked group has identified 216 hosts that may still be vulnerable to PHP2Shell. The operators communicate through a private I2P channel that Cyfirma has monitored since October 22. On October 24, they reported that 216 hosts appeared to be unpatched or only partly protected, earlier than Cyfirma expected.

They are checking the systems from 21 compromised machines. At the time Cyfirma captured the conversation, the operators had already checked about one-third of the targets.

“Two handles active since March 2026, coordinating in a closed I2P channel; staging infrastructure shared in-channel.” states the cybersecurity firm. “Target set and scan nodes. “On 24 October the operators reported 216 unpatched or partially mitigated hosts and named 21 scan nodes; the same addresses were seen performing web-shell tooling and upload-progress session-poisoning attempts.”

The scanning is slow on purpose. Volume stays low, the machines rotate, and any node that shows filtering or rate limiting gets pulled and never reused. That’s why a rate-based alert will probably stay quiet.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by October 29, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog.

VeloCloud Orchestrator (VCO) is the central management system for VMware SD-WAN, a technology that helps companies securely connect offices, data centers, cloud services, and remote sites over wide-area networks.

It is now associated with Arista Networks, which acquired VMware’s SD-WAN business. The orchestrator gives network administrators a central place to configure, monitor, and manage the network.

The flaw is a SQL Injection issue that affects on-premises VeloCloud Orchestrator (VCO). It allows an authenticated user to gain operator privileges and impersonate a local superuser operator account. This could give a remote attacker access to internal functions that should not be remotely available, potentially compromising the system and the data it manages. Hosted VCO versions, including Dedicated, were also affected but have already been patched.

“VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.” reads the advisory. “On an affected system, any authenticated user can gain operator privileges and masquerade as a local “superuser operator” user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.”

VeloCloud Orchestrator (VCO) is vulnerable by default. An attacker needs access to its web interface and a valid account. Even an account with the lowest permission level, Enterprise Read Only, is enough. No configuration change can prevent this exposure.

Administrators should check web access logs for unusual requests, encoded text, attempts to access internal services, or an unusually high number of requests. They should also block these IP addresses linked to attacks:

• 74.82.197.86
• 38.54.50.151

If an attack is suspected, administrators should save web, application, system and database logs, along with relevant file timestamps, before starting recovery, if possible.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 26, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog.

In early October, threat actors started exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye.

“This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.” reads the advisory. “In some configurations, there may be some sensitive files that make this highly severe.”

Previdian telemetry has detected 15 exploitation attempts from three IP addresses in Japan and the U.S..

“Exploitation has now started to hit our honeypot network” Previdian Founder Ryan Dewhurst wrote on LinkedIn.

On October 6, watchTowr Labs published a technical analysis of CVE-2026-21589 after comparing vulnerable and patched Atlassian packages.

Researchers found a path traversal flaw where double-colon (::) sequences can be treated as path separators, allowing attackers to read files from the application web root.

“While semicolons (;) are very common in path traversal within Java applications, along with the everyday dots (.) and slashes (/), one item stood out: the matching of double colons (::).” reads the analysis. “This is uncommon syntax for this type of vulnerability, but grepping through the codebase we came across an all too familiar sight.”

In one Crowd deployment with Jira, researchers were able to read crowd.properties, which exposed application credentials. They then used those credentials to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this attack path.

Exploitation attempts against its honeypot network reportedly began two hours after watchTowr published additional technical details about the vulnerability.

According to watchTowr, the problem is in Atlassian’s web-resource handling. It can turn a string such as ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml, allowing attackers to move through directories and access files they should not be able to read.

Atlassian says all versions before the listed fixed versions are affected:

Product	Fixed versions
Bitbucket Data Center	9.4.26, 10.2.8, 10.5.1
Confluence Data Center	9.2.26, 10.2.19
Jira Service Management Data Center	5.12.40, 10.3.26, 11.3.12
Jira Software Data Center	9.12.40, 10.3.26, 11.3.12
Bamboo Data Center	10.2.24, 12.1.12
Crowd Data Center	6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible	4.9.15
Fisheye	4.9.15

watchTowr has released a free tool on GitHub to help check if a server is vulnerable.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 18, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability 
• CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability
• CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability 
• CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability 

Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 (CVSS score of 9.8). An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system.

The flaw CVE-2026-0322 (CVSS score: 8.6) is a high-severity code injection vulnerability in the management interface of Palo Alto Networks PAN-OS. It could allow an authenticated attacker with network access and high-level privileges to execute arbitrary code with root privileges on an affected firewall. The vulnerability affects PA-Series and VM-Series firewalls and Panorama appliances. Palo Alto Networks confirmed that limited exploitation has been observed targeting the management interface. The company recommends restricting access to trusted internal IP addresses and installing the relevant security updates.

The flaw CVE-2026-105133 (CVSS score: 5.5) is an improper authentication vulnerability in AhsayCBS, a backup management platform. The flaw affects the checkSysPwd function in the product’s API and could allow a remote attacker to bypass authentication by manipulating the random parameter. Starting on October 7, 2026, attackers used it to bypass authentication before exploiting a second vulnerability, CVE-2026-105134, to execute commands on affected servers. Huntress reported that at least five organizations had been targeted by October 8.

The flaw CVE-2026-105134 (CVSS score: 9.3) is a critical operating system command injection vulnerability in the Replication Receiver component of AhsayCBS. The flaw affects the /rps/api/json/UpdateReceivers.do endpoint and could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying system. The vulnerability is being actively exploited in the wild. Attackers have chained it with CVE-2026-105133 to gain remote code execution with NT AUTHORITY\SYSTEM privileges, deploy JSP web shells and install XMRig cryptocurrency miners disguised as Microsoft Edge processes. Huntress observed attacks against at least five organizations by October 8, 2026.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by October 17, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog.

Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities, including a zero-day under active attack. The flaw, tracked as CVE-2026-96951, is a Windows Shell command injection vulnerability that allows an unauthorized attacker to bypass security protections over a network. Exploitation can evade Mark of the Web (MOTW) defenses, which help protect users from potentially dangerous files downloaded from the internet. Microsoft confirmed that the flaw is being actively exploited.

“An attacker who successfully exploited the vulnerability could evade Mark of the Web (MOTW) defenses.” reads the advisory. “In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability. In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker’s site or send a malicious attachment.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 16, 2026.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Kev Catalog.

The vulnerability is an authentication bypass issue caused by spoofing in ICS versions before 25.1.3.0 that could allow a remote, unauthenticated attacker to execute arbitrary commands. ICS versions 22.7R2.14 and earlier are not affected.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure FortiMail flaw, tracked as CVE-2026-104935 (CVSS score of 8.6), to its Known Exploited Vulnerabilities (KEV) catalog.

The vulnerability is an authentication bypass issue caused by spoofing in ICS versions before 25.1.3.0 that could allow a remote, unauthenticated attacker to execute arbitrary commands. ICS versions 22.7R2.14 and earlier are not affected.

“Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.” reads the advisory. “Ivanti has released updates for Ivanti Connect Secure (ICS) which addresses one high severity vulnerability. Successful exploitation could allow a remote unauthenticated attacker to execute arbitrary commands.”

The company confirmed that the vulnerability was exploited in attacks in the wild.

“We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure.” continues the report.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 16, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Citrix NetScaler flaw tracked as CVE-2026-88779 (CVSS score of 8.7), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that can cause denial-of-service under specific conditions. It affects certain customer-managed deployments running vulnerable versions.

“CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to denial-of-service under specific deployment conditions,” reads the advisory. “The issue affects customer-managed NetScaler deployments running affected supported versions when the required preconditions are met.”

Successful exploitation requires NetScaler ADC or Gateway to be configured as a SAML service provider (SP) or identity provider (IdP). Customers can check their configuration for the relevant SAML settings.

Below are the impacted versions:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41 
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28 
• NetScaler ADC FIPS before 14.1-73.41 FIPS 
• NetScaler ADC FIPS and NDcPP before 13.1-37.282 

Citrix says it has observed targeted attacks against unpatched deployments that can cause denial of service. Repeated exploitation may keep the affected service unavailable, but Citrix has not identified any impact on customer data integrity.

“Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service. If the condition is triggered repeatedly, the service may remain unavailable.” continues the advisory. “Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data. Citrix strongly urges all customers to install the latest versions as soon as possible.”

The company urges customers to install the latest versions as soon as possible. Exposure depends on the deployment configuration, particularly whether NetScaler uses SAML with Gateway or AAA functionality. Customers should check their configurations for SAML authentication settings, including add authentication samlAction for a SAML service provider or add authentication samlIdPProfile for a SAML identity provider. The bulletin applies only to customer-managed NetScaler ADC and Gateway deployments; Citrix-managed cloud services have already been updated.

The following versions fix the issue:

• NetScaler ADC and NetScaler Gateway 14.1-73.41 and later releases
• NetScaler ADC and NetScaler Gateway 13.1-64.28 and later releases of 13.1
• NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS and later releases of 14.1-FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later releases of 13.1-FIPS and 13.1-NDcPP

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 7, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-102489 (CVSS score of 9.4) Zammad GmbH Zammad Session Fixation Vulnerability
• CVE-2026-102490 (CVSS score of 9.4) Zammad GmbH Zammad Improper Privilege Management Vulnerability

The first flaw, CVE-2026-102489, is a session hijacking vulnerability in Zammad that can lead to remote code execution as the zammad user. It affects Zammad 6.3.0 through 6.5.4. The flaw is also present in versions 7.0.0 through 7.1.3.

The second flaw, CVE-2026-102490, is a local privilege escalation vulnerability that allows the zammad user to gain root privileges. It affects Zammad versions from 1.5.0 through 7.1.0-alpha.

The two flaws can be chained: an attacker can first gain code execution as the zammad user through CVE-2026-102489 and then use CVE-2026-102490 to escalate to root.

The Dutch Institute for Vulnerability Disclosure, a nonprofit organization of volunteer security researchers whose whole job is finding and responsibly disclosing vulnerabilities in other people’s software, recently disclosed that it got breached through two zero-days in its own ticketing system.

The attackers got in through Zammad, an open-source helpdesk platform that DIVD used internally. Working with Merlon Security, DIVD identified two previously unknown vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490.

Each vulnerability was serious on its own, but chaining them made the attack much more dangerous. The attackers could hijack sessions, run code remotely and move from a regular Zammad account to root access within seconds. DIVD said the speed was linked to the use of an AI agent during the attack.

“When hackers get hacked, we deal with it in hacker style. While trying to figure out how the attackers got into our own systems, 𝘄𝗲 𝗳𝗼𝘂𝗻𝗱 𝘁𝘄𝗼 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗭𝗮𝗺𝗺𝗮𝗱.” the organization wrote on LinkedIn. “Used together, they allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack. From there they were able to access other services and read and exfiltrate data. We urge everyone using any version of Zammad to update to version 7 or take it offline as soon as possible.”

The attacker went from the initial access to root privileges in just seconds. The AI agent was able to make decisions and carry out the next steps without waiting for a human operator.

After gaining root access through Zammad, the attacker reached other services, accessed data and stole some of it. Network segmentation and a quick response from DIVD’s IT and incident response teams prevented the attacker from moving further.

However, DIVD said that some damage had already occurred before the attack was stopped. The investigation is still ongoing, with the next public update expected on October 1.

Zammad has over 2,000 customers and 55,000 users. DIVD is actively notifying owners of vulnerable instances and has published a script to check logs for signs of abuse. The fix is version 7, which Zammad considers safe. If you can’t update immediately, the guidance is simple:

“We’re still in full investigation mode, and our next public statement will be on October 1st. For more information about the CVEs and a script to check your logs for abuse, check our case file. Link in comments.” the organization states. “If you run any version of Zammad, update to version 7 or take it offline as soon as possible.”

The advice from Zammad is clear: update to version 7 or take the system offline. The reason is simple: the attack can move from unauthenticated access to root privileges within seconds, with the AI agent automatically carrying out each step.

The incident also shows that AI-driven attacks are no longer just a theoretical risk. In this case, the agent was able to analyze the environment, chain the two vulnerabilities, gain higher privileges and move to other services without a human directing every action.

DIVD detected the attack partly because it was relatively noisy. The agent left visible traces of its activity, which helped investigators understand what happened. A more careful attacker using the same approach could be harder to detect.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by October 5, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Fortinet FortiMail flaw, tracked as CVE-2026-104286 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.

The flaw is a path traversal vulnerability that can be triggered through specially crafted HTTP or HTTPS requests. An unauthenticated attacker can exploit the issue to bypass restrictions on file paths and write arbitrary files to the underlying system.

The vulnerability also involves improper handling of NULL characters, which can help the attacker bypass security checks. The flaw is reportedly being exploited in the wild, so affected customers are urged to apply the recommended workaround.

“An Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.” reads the advisory. “This has been reported to be exploited in the wild”

The company did not disclose how many customers were affected, when the attacks started, who was behind them, or technical details of the attacks.

Below are the affected versions and the released updates:

Version	Affected	Solution
FortiMail 8.0	8.0.0 through 8.0.1	Upgrade to upcoming 8.0.2 or above
FortiMail 7.6	7.6.0 through 7.6.6	Upgrade to upcoming 7.6.7 or above
FortiMail 7.4	7.4.0 through 7.4.8	Upgrade to upcoming 7.4.9 or above
FortiMail 7.2	7.2.0 through 7.2.9	Upgrade to branch 7.4 or above

As a temporary workaround, customers should disable the IBE (Identity-Based Encryption) feature using the recommended CLI command. Alternatively, access to the FortiMail management interface should be blocked from the internet or limited to trusted private networks.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 3rd, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apple Multiple Products flaw, tracked as CVE-2026-86950 (CVSS score of 8.8), to its Known Exploited Vulnerabilities (KEV) catalog.

This week, Apple has released security updates for iOS, iPadOS and macOS to fix a zero-day vulnerability CVE-2026-86950 in CoreGraphics that may have been exploited in attacks against specific individuals. The flaw is an out-of-bounds write that can lead to arbitrary code execution when the system processes a specially crafted file.

The vulnerability affects iOS 26.7 and earlier versions before iOS 27, as well as iPadOS 26.7 and earlier and supported versions of macOS Tahoe and macOS Sequoia. Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1 to address the issue.

“Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” reads Apple’s advisory. “Description: “An out-of-bounds write issue was addressed with improved bounds checking.”

Apple says it knows of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” running versions of iOS before iOS 27.

Apple hasn’t disclosed who was targeted, how many people were affected, whether the attacks succeeded, or when exploitation started. It also hasn’t explained how attackers delivered the malicious files. That leaves an important part of the attack chain unknown.

CoreGraphics handles graphics and rendering functions across Apple’s operating systems, including processing content such as images and PDFs. Attackers can trigger the flaw by tricking the victim into opening a malicious file sent through a web page, an email attachment, or a messaging application, However, Apple hasn’t confirmed any of these delivery methods for CVE-2026-86950.

That distinction matters. A crafted file doesn’t need to look like an obvious executable for a vulnerability in a system component that processes content to become useful to an attacker. The security boundary can be crossed while the operating system is simply doing what it’s designed to do: interpreting a file.

Meta Product Security discovered and reported the vulnerability to Apple. The involvement of Meta is particularly interesting because the company has previously identified attacks involving Apple vulnerabilities and targeted users of its messaging platforms.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 2nd, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-88771 (CVSS score: 9.5) Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-88772 (CVSS score: 9.5) Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88771 (CVSS score: 9.5) is a remote code execution vulnerability caused by improper input validation that could allow an unauthenticated remote attacker to execute arbitrary commands. The flaw affects all NetScaler ADC and NetScaler Gateway deployments in their default configuration and does not require any additional features to be enabled.

CVE-2026-88772 (CVSS score: 9.5) is a memory buffer overflow vulnerability that could allow remote code execution or cause a denial-of-service condition. The flaw affects NetScaler ADC and NetScaler Gateway deployments with DTLS enabled, which is enabled by default on VPN vServers. The vulnerability is classified as CWE-119.

This week, Citrix confirmed that the two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances. The first warnings did not come from Citrix. On September 26, administrators said IT providers and security teams were privately advising them to take NetScaler systems offline, sometimes without explaining why.

The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.

The reports show how the attacks were already underway while defenders were still waiting for official details and fixes.

Security researchers at watchTowr then confirmed that the reports were credible. The company said it was investigating reports of multiple unpatched NetScaler remote code execution flaws being exploited in the wild and later said the vulnerabilities had been found during forensic investigations.

“We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible,” watchTowr wrote on X.

The Dutch National Cyber Security Centre also sent a pre-notification to organizations in the Netherlands. According to a notice seen by BleepingComputer, a European partner CERT had shared information about two critical NetScaler zero-days that could allow remote code execution. One of the flaws could even let an attacker inject shellcode directly into memory.

Both vulnerabilities have been fixed in the following NetScaler releases:

• Citrix NetScaler ADC and NetScaler Gateway 14.1-73.37 and later
• Citrix NetScaler ADC and NetScaler Gateway 13.1-64.23 and later
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later

CISA said it has received reports and threat intelligence confirming that attackers are actively exploiting the vulnerabilities worldwide.

“CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally. Because updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.” reads the advisory published by CISA. “Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories.”

CISA also noted that updating NetScaler appliances can be complex and may require downtime. The alert is intended to help organizations assess their exposure, prioritize mitigation and include the vulnerabilities in their risk management plans.

Citrix has also released generic indicators of compromise (IoCs) through NetScaler Console. These can help customers check whether their systems may have been compromised.

If a compromise is suspected, Citrix recommends taking the following steps:

• Preserve evidence from the NetScaler ADC VPX instance.
• Isolate the device.
• Revoke credentials and access.
• Check connected servers and systems for signs of further compromise.
• Rebuild the device and update it to the latest firmware.
• Rotate local account passwords and Key Encryption Keys (KEK), and replace restored SSL certificates when recovering from a known-good backup.
• Harden the device according to Citrix security best practices.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 30, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress Core flaw, tracked as CVE-2026-87902 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-87902 allows an unauthenticated attacker to make the get_page_template() function include a readable local PHP file outside the active theme directories. Under specific server and theme conditions, the flaw can lead to remote code execution. The vulnerability is being actively exploited, with attackers using pearcmd.php to write malicious PHP files and execute code.

This week, WordPress released version 7.1.2 to address this flaw. It stems from how the CMS resolves page templates, with a real path to remote code execution.

The bug affected every version back to 4.7.0. That’s nearly a decade of releases, and nobody needs an account to trigger it. Robert Ressl gets credit for reporting it.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by September 24, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft SharePoint and Mikrotik RouterOS flaws flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-65660 (CVSS score of 8.8) Microsoft SharePoint Code Injection Vulnerability
• CVE-2026-67279 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability

CVE-2026-65660 is a code-injection vulnerability in Microsoft SharePoint Server that allows an authenticated, low-privileged attacker to execute arbitrary code remotely. The flaw affects SharePoint Server 2016, 2019, and Subscription Edition.

The second flaw added to the catalog, tracked as CVE-2026-67279 (CVSS score of 6.9), is an SSH protocol flaw in MikroTik RouterOS that allows an unauthenticated attacker to bypass the normal authentication flow, open a session channel and execute commands, potentially creating or modifying files on the device. CERT Polska confirmed that the flaw is being actively exploited in the wild and that, when chained with CVE-2026-86060, it can lead to full administrative access without authentication.

CERT Polska reported successful attacks against internet-exposed RouterOS devices dating back to at least September 2, 2026, with attackers using the MikroTrick chain.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 28, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
• CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability

The first flaw added to the catalog, tracked as CVE-2026-5430 (CVSS score 10.0), is an authentication bypass in multiple WSO2 products caused by improper verification of JWT signatures, allowing an attacker to use an unsupported signing algorithm to gain unauthorized access and potentially take over accounts.

The second flaw added to the catalog, tracked as CVE-2026-71362 (CVSS score 9.1), is an incorrect authorization vulnerability in Adobe Commerce that can allow an unauthenticated attacker to escalate privileges and gain access to sensitive resources without user interaction. In August 2026, hackers began targeting CVE-2026-71362 shortly after its public disclosure. The vulnerability allows unauthenticated attackers to switch customer sessions, hijack accounts and access private data.

Cybersecurity firm Sansec blocked the first exploitation attempts after Adobe published its advisory. The flaw affects Commerce, Commerce B2B and Magento Open Source versions through the July 2026 patches. Adobe released an isolated fix and urged users to patch.

“Adobe has released APSB26-92 as isolated patch files. The update fixes seven vulnerabilities, including an unauthenticated customer account takeover with a CVSS score of 9.1. Sansec Shield already blocks exploitation attempts.” reads the advisory published by Sansec. “Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim’s account and private customer data.”

Sansec pointed out that an attacker can exploit the flaw without an existing account, administrator privileges, or user interaction.

Adobe fixed how Magento handles customer identity in account sessions. The remaining flaws include stored cross-site scripting and authorization issues.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 27, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)