Daily brief · 2026-10-01

Apple CoreGraphics Under Active Attack + 6 More Fixes

▶

Apple CoreGraphics

An actively exploited out-of-bounds write vulnerability in Apple CoreGraphics has been added to the CISA Known Exploited Vulnerabilities catalog. The CISA alert specifically identifies CVE-2026-86950, based on evidence of active exploitation. The vulnerability affects iOS, macOS, and iPadOS devices.

Why it matters: It may lead to arbitrary code execution.

What to do: Apply the vendor-provided security updates for Apple products by the remediation due date.

CVEs: CVE-2026-86950

Cisco Catalyst SD-WAN Manager

Cisco Catalyst SD-WAN Manager contains an authentication bypass vulnerability that is being actively exploited. In September 2026, the Cisco PSIRT became aware of this active exploitation, and the vulnerability has been added to the CISA KEV catalog. The CISA KEV alert specifically names CVE-2026-76504 for the SD-WAN product, and Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.

Why it matters: A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

What to do: Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

CVEs: CVE-2026-76504

Citrix NetScaler ADC and Gateway

Threat actors are actively exploiting zero-day vulnerabilities in Citrix NetScaler ADC and Gateway appliances. In late September 2026, Mandiant Consulting and Google Threat Intelligence Group identified active, in-the-wild exploitation of a zero-day vulnerability identified as CVE-2026-88772. The campaign has been ongoing since early September and has impacted multiple sectors in North America and Europe. A second zero-day is also being actively exploited according to vendor disclosures.

Why it matters: Attackers can achieve remote code execution, execute arbitrary commands, or cause a denial of service.

What to do: Apply the vendor patches before the CISA KEV remediation deadline.

CVEs: CVE-2026-88771, CVE-2026-88772

Zammad

DIVD suffered a breach through AI agents exploiting two zero-day vulnerabilities in Zammad. Hackers utilized the two zero-days, which were assigned CVE IDs, to compromise the organization. DIVD got hacked through these AI agents and is currently investigating the breach, with the incident investigation ongoing.

Why it matters: Attackers successfully breached the DIVD environment.

What to do: Monitor for updates from Zammad and DIVD’s ongoing investigation.

CVEs: CVE-2026-102489, CVE-2026-102490

MikroTik RouterOS

MikroTik RouterOS has an integer underflow vulnerability in its web management service. This issue occurs in the HTTP request body handling of affected RouterOS versions and can be reached before a user authenticates. The flaw allows unauthenticated attackers to execute code or trigger a denial of service. There are currently no known reports of active exploitation submitted to CISA.

Why it matters: An unauthenticated network attacker can leverage this to execute arbitrary code as root or cause a denial of service condition.

What to do: Review the CISA advisory for specific mitigations and apply relevant updates.

CVEs: CVE-2026-84411

OpenSSL

The DTLS retransmission logic in OpenSSL can incorrectly handle a suspended handshake message write. Specifically, it fails to properly process a handshake message write that gets suspended part-way through. This vulnerability impacts several major versions of OpenSSL and can lead to memory disclosure or a denial of service.

Why it matters: This logic error can cause the retransmitted message to disclose heap memory to the peer or result in a crash and denial of service.

What to do: Upgrade to the appropriate patched OpenSSL version according to the advisory.

CVEs: CVE-2026-84782

Also today

Bitget

Bitget covered the financial impact of a late September incident using its Protection Fund.

What to do: Users can verify the Protection Fund reserves onchain.

Tags: apple-coregraphics, cisco-catalyst-sd-wan-manager, citrix-netscaler-adc-and-gateway, zammad, mikrotik-routeros, openssl, bitget