Daily brief · 2026-09-28 · updated 2026-10-12
Citrix NetScaler ADC Under Active Attack + 4 More Fixes
Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability, now listed in the CISA KEV catalog. It could allow an unauthenticated attacker to execute arbitrary commands on affected systems.
Why it matters: For NetScaler, this matters because an attacker needs no login at all to run commands on the appliance.
What to do: Apply vendor patches for NetScaler ADC and Gateway per CISA KEV guidance.
CVEs: CVE-2026-88771
Mikrotik RouterOS
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability, now listed in the CISA KEV catalog. It could allow an unauthenticated client to open a session channel and send an exec request, and it can be chained to exploit a second flaw, CVE-2026-86060, without authentication.
Why it matters: For RouterOS, this matters because an unauthenticated client can open session channels and send requests, and the flaw can be chained to CVE-2026-86060 for further exploitation.
What to do: Apply Mikrotik RouterOS patches, and check whether your routers are also exposed to CVE-2026-86060, per CISA KEV guidance.
CVEs: CVE-2026-67279
WordPress Core
WordPress Core contains a remote file inclusion vulnerability, now listed in the CISA KEV catalog. It could allow an unauthenticated attacker to make page-template resolution include a chosen readable local PHP file outside the active theme directories, leading to remote code execution.
Why it matters: For WordPress, this matters because an unauthenticated attacker can achieve remote code execution on your site by including a PHP file from outside the theme directories.
What to do: Apply WordPress Core patches per CISA KEV guidance.
CVEs: CVE-2026-87902
Citrix NetScaler ADC and NetScaler Gateway
A second Citrix NetScaler ADC and NetScaler Gateway flaw is also in the CISA KEV catalog: a memory buffer vulnerability that could allow for remote code execution or denial of service.
Why it matters: For this second NetScaler flaw, the risk is an attacker running code on the appliance or knocking it offline. CISA lists it as exploited in the wild, so treat this patch as urgent.
What to do: Apply vendor patches for NetScaler ADC and Gateway per CISA KEV guidance.
CVEs: CVE-2026-88772
Microsoft SharePoint
Microsoft SharePoint contains a code injection vulnerability, now listed in the CISA KEV catalog. It could allow an authorized attacker to execute code over a network.
Why it matters: For SharePoint, this matters because anyone who already has access could use it to run code on the server. It is also exploited in the wild, so patch it urgently.
What to do: Apply Microsoft SharePoint patches per CISA KEV guidance.
CVEs: CVE-2026-65660
Sources
Tags: citrix-netscaler-adc-and-netscaler-gateway, mikrotik-routeros, wordpress-core, microsoft-sharepoint