Daily brief · 2026-10-11
Citrix NetScaler ADC Attacks Continue + 4 More Fixes
Citrix NetScaler ADC and NetScaler Gateway
CISA added two critical Citrix NetScaler ADC and Gateway vulnerabilities to the Known Exploited Vulnerabilities Catalog following evidence of active exploitation. Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. CVE-2026-88771 is an improper input validation flaw in Citrix NetScaler ADC and Gateway allowing unauthenticated arbitrary command execution and is listed on CISA KEV. In addition, CVE-2026-88772 is a memory buffer boundary restriction flaw in Citrix NetScaler ADC and Gateway allowing remote code execution or denial of service that is also listed on CISA KEV.
Why it matters: Unauthenticated remote attackers can execute arbitrary code, issue commands, or crash appliances.
What to do: Apply the vendor security updates immediately in accordance with CISA KEV binding remediation guidance.
CVEs: CVE-2026-88771, CVE-2026-88772
SonicWall SMA1000
The Cyber Security Agency of Singapore issued an alert for a maximum-severity SSRF vulnerability affecting SonicWall SMA1000 series appliances. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to direct the appliance to issue requests on their behalf, access internal functionality, and perform unauthorized operations. Under CVE-2026-102255, remote unauthenticated attackers can force the appliance to perform unauthorized requests and access internal functions. This flaw affects SonicWall SMA 1000 series running version 12.4.3-03526 platform-hotfix and older.
Why it matters: Unauthenticated remote attackers can compel appliances to issue requests, reach internal networks, and execute unauthorized actions.
What to do: Apply the official SonicWall platform hotfix to affected SMA1000 series appliances immediately.
CVEs: CVE-2026-102255
Citrix NetScaler ADC and NetScaler Gateway
Cloud Software Group published security bulletin CTX697191 detailing a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway. This memory overflow vulnerability leads to remote code execution or denial of service. Designated as CVE-2026-107406, this memory overflow flaw can result in remote code execution or denial of service. Customers running NetScaler ADC and NetScaler Gateway 14.1 are advised to upgrade to version 14.1-73.46 or later, while the affected product is Citrix NetScaler ADC and NetScaler Gateway.
Why it matters: Remote attackers can trigger memory corruption leading to arbitrary code execution or denial of service.
What to do: Upgrade affected NetScaler ADC and NetScaler Gateway deployments to patched releases including 14.1-73.46 or 13.1-64.29 and later.
CVEs: CVE-2026-107406
Ricardo (SMG Swiss Marketplace Group)
SMG Swiss Marketplace Group disclosed that personal data from approximately 890,000 Ricardo (SMG Swiss Marketplace Group) user accounts was exposed due to a security incident. The ensuing investigation established that personal data relating to approximately 890,000 user accounts was exposed. The exposed information included names, postal addresses, phone numbers, and company names, while email addresses and passwords remained unaffected.
Why it matters: Personal profile contact details of approximately 890,000 users were accessed by an unauthorized party.
What to do: Notify affected users, monitor for targeted phishing or smishing attempts using exposed contact info, and coordinate with data protection regulators.
Also today
Federal Bureau of Investigation (FBI) / ShinyHunters
The FBI arrested a suspected co-conspirator of the ShinyHunters group in connection with an intrusion impacting an FBI third-party platform, involving the Federal Bureau of Investigation (FBI) / ShinyHunters.
What to do: Audit third-party contractor access controls, enforce MFA, and review supplier compliance standards.
Sources
Tags: citrix-netscaler-adc-and-netscaler-gateway, sonicwall-sma1000, ricardo, federal-bureau-of-investigation