Daily brief · 2026-09-30

Citrix NetScaler ADC Under Active Attack + 2 More Fixes

▶

Citrix NetScaler ADC and NetScaler Gateway

Mandiant and the Google Threat Intelligence Group have detected active, in-the-wild exploitation of two zero-day vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Discovered in late September 2026, the first flaw allows attackers to bypass authentication entirely to gain initial root-level access. Meanwhile, threat actors are also actively exploiting a second related zero-day vulnerability in these systems.

Why it matters: This allows attackers to establish initial root-level access to the compromised appliance.

What to do: Apply targeted compensating controls to reduce the attack surface if immediate patching is not possible.

CVEs: CVE-2026-88772, CVE-2026-88771

Apple iOS, macOS, and iPadOS

The Cybersecurity and Infrastructure Security Agency has added a critical out-of-bounds write vulnerability affecting Apple iOS, macOS, and iPadOS to its Known Exploited Vulnerabilities catalog. This flaw exists within the CoreGraphics component across these operating systems. If exploited, this out-of-bounds write vulnerability could allow a malicious actor to execute arbitrary code on the affected device.

Why it matters: A successful exploit enables attackers to achieve arbitrary code execution.

What to do: Apply the relevant patches provided by Apple.

CVEs: CVE-2026-86950

Dockhand

Dockhand versions prior to 1.0.40 are vulnerable to an authentication bypass flaw located in their git webhook endpoints. This vulnerability permits unauthenticated remote attackers to bypass a null webhook secret guard condition and send unsigned webhook requests. By doing so, they can force unauthorized git clone and docker compose operations, ultimately triggering arbitrary stack redeployments.

Why it matters: Unauthenticated remote attackers can trigger arbitrary stack redeployments, which can lead to a denial of service or potentially full host compromise.

What to do: Update to a patched version of Dockhand, specifically version 1.0.40 or later.

CVEs: CVE-2026-53988

Tags: citrix-netscaler-adc-and-netscaler-gateway, apple-ios-macos-and-ipados, dockhand