Daily brief · 2026-09-29 · updated 2026-10-12

Citrix NetScaler ADC Under Active Attack + 3 More Fixes

▶

Citrix NetScaler ADC and Gateway

Two zero-days affecting Citrix NetScaler ADC and Gateway, tracked as CVE-2026-88771 and CVE-2026-88772, were recently added to the CISA KEV catalog. These are an improper input validation vulnerability and an improper restriction of operations within the bounds of a memory buffer vulnerability. These flaws in Citrix NetScaler ADC and NetScaler Gateway could allow an unauthenticated attacker to execute arbitrary commands.

Why it matters: The improper input validation vulnerability is significant because it could allow an unauthenticated attacker to execute arbitrary commands on the affected systems.

What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable, as stakeholders are responsible for evaluating.

CVEs: CVE-2026-88771, CVE-2026-88772

macOS Sequoia

Apple patched a zero-day vulnerability in CoreGraphics that was exploited in attacks against specific individuals on older iOS versions. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Processing a maliciously crafted file in macOS Sequoia may lead to arbitrary code execution, and the vulnerability was addressed with improved bounds checking.

Why it matters: This matters because processing a maliciously crafted file may lead to arbitrary code execution.

What to do: Update to macOS Sequoia 15.8.1.

CVEs: CVE-2026-86950

Kiteworks

Kiteworks performed a customer-wide shutdown after discovering a critical vulnerability, which they subsequently patched. During the shutdown, this activity led to the discovery of a previously unknown critical vulnerability confined to a capability that is enabled for less than 1% of the customer base. Kiteworks patched the vulnerability and applied a protective layer.

Why it matters: Kiteworks executed a precautionary shutdown of customer systems to investigate the situation.

What to do: Ensure systems are updated and the protective layer is applied.

MCP Python SDK

The official MCP Python SDK has an OAuth credential leak vulnerability. Because of this, a malicious or compromised MCP server could direct users to a token endpoint of its choosing. Users should upgrade to fixed versions to resolve this issue.

Why it matters: This flaw is dangerous because a malicious server can intercept the OAuth credentials.

What to do: Upgrade to mcp 2.2.0 or 1.30.0 or later.

Tags: citrix-netscaler-adc-and-gateway, macos-sequoia, kiteworks, mcp-python-sdk