critical6 sourcesCVE-2025-7775 CVE-2026-19490 +12
Citrix has released emergency security updates addressing eight vulnerabilities across customer-managed NetScaler ADC and NetScaler Gateway deployments, including two critical zero-day flaws tracked as CVE-2026-88771 and CVE-2026-88772. The patches arrived shortly after national cyber authorities, including the Dutch NCSC-NL and Australia's ACSC, began privately notifying administrators and advising them to shut down internet-facing NetScaler appliances immediately.
Both zero-day vulnerabilities enable unauthenticated threat actors to achieve remote code execution on target devices, sporting CVSS 4.0 scores of 9.5. Specifically, CVE-2026-88771 stems from improper input validation and affects all default configurations across NetScaler ADC and Gateway appliances without requiring special feature flags. The companion flaw, CVE-2026-88772, is a memory overflow vulnerability affecting systems where Datagram Transport Layer Security (DTLS) is enabled, which is configured on by default across VPN virtual servers.
The broader advisory also mitigates six additional flaws, ranging from HTTP request smuggling in CVE-2026-88773 (CVSS 9.3) to memory overflows and TCP initial sequence number prediction issues. In response to confirmed active exploitation, CISA updated its Known Exploited Vulnerabilities catalog and mandated that US federal agencies patch all vulnerable appliances under Binding Operational Directive 26-04 by September 30.
Remediation builds include NetScaler 14.1-73.37, 13.1-64.23, and corresponding updated FIPS and NDcPP packages, while unsupported releases such as versions 12.1 and 13.0 require immediate platform migration. Threat monitoring from Shadowserver currently detects over 23,000 reachable NetScaler IP addresses across the internet, underlining a massive attack surface for edge infrastructure. Citrix has published basic indicators of compromise through NetScaler Console, while simultaneously cautioning operators that these telemetry artifacts might be insufficient to identify sophisticated breaches.
Read more → about Citrix Patches Dual NetScaler Zero-Days Under Active Exploitation Following Emergency Shutdown Advisoriesinfo1 source
The U.S. Cybersecurity and Infrastructure Security Agency released a four-page whitepaper targeting the future of the Common Vulnerabilities and Exposures framework. As vulnerability discoveries surge under AI-assisted research workflows, annual projections estimate that roughly 96,000 CVE identifiers will be cataloged within a single year.
This influx represents nearly a quarter of all historical identifiers recorded across the ecosystem since the program debuted in September 1999. In response, CISA detailed four specific dimensions of quality to overhaul tracking reliability: program governance, ecosystem participation, data infrastructure, and CVE record content.
Industry researchers note the strategic shift comes after years of uncertainty stemming from federal contract turbulence with Mitre and subsequent agency budget reductions. The vulnerability ecosystem remains heavily stressed by an enrichment bottleneck where approximately only one in five disclosures receives baseline metadata such as standard scoring attributes.
Critics highlight that the document provides high-level aspirations rather than concrete operational mechanics to resolve unenriched CVE queues. Furthermore, the growth of decentralized numbering and enrichment authorities creates significant data friction, often yielding conflicting base scoring values across disparate regional and vendor registries.
Read more → about CISA Outlines Four-Pillar Quality Roadmap to Tackle Mounting CVE Backlog and Enrichment Deficitsmedium1 source
The U.S. Cybersecurity and Infrastructure Security Agency has submitted its final rule under the Cyber Incident Reporting for Critical Infrastructure Act to the White House Office of Management and Budget for regulatory review. This major milestone comes after missing an earlier September target and pushes the regulation closer to an expected publication before the end of the year.
First mandated by Congress in 2022, the framework obligates entities across 16 critical infrastructure sectors to report substantial cyber incidents within 72 hours and any ransom payments within 24 hours. The baseline scope is massive, originally projected to impact nearly 300,000 organizations nationwide.
The trajectory of the rule has faced significant headwinds and delays due to substantial pushback from both Congress and industry stakeholders concerning regulatory overlap. A July Government Accountability Office study highlighted that approximately 70% of 117 surveyed federal cybersecurity regulations contained overlapping reporting mandates, demonstrating the friction around harmonization.
Sector-specific burdens remain a major talking point, particularly for defense industrial base entities already beholden to 72-hour reporting under Pentagon mandates. While CISA's framework theoretically allows a single submission to satisfy requirements via inter-agency agreements, experts note substantial hurdles due to differing reporting scopes, such as DFARS focusing specifically on controlled unclassified information.
Furthermore, CIRCIA introduces distinct operational overheads, including mandatory ongoing follow-up updates as incident investigations develop and a stringent two-year data retention requirement, far exceeding standard defense baseline rules. Despite industry friction, White House cyber officials have emphasized ongoing efforts aimed at providing clarity and reducing redundant burdens across covered sectors.
Read more → about Final CIRCIA Cyber Incident Reporting Rule Heads to the White House for Reviewcritical1 sourceCVE-2026-32201 CVE-2026-45659 +3
Threat actors are actively attempting to chain two critical Microsoft SharePoint vulnerabilities to achieve remote code execution on unpatched deployments. The initial stage relies on `CVE-2026-55040`, an authentication bypass situated within the server's JWT token validation pipeline. This bypass allows unauthenticated attackers to spoof actions as regular SharePoint site users or administrative accounts. Following this access, attackers pivot to `CVE-2026-63520`, a flaw located in the Business Connectivity Services component, which facilitates full remote code execution. Proof-of-concept exploits for both vulnerabilities were published independently during August. Rapid7 disclosed exploit code for the authentication bypass on August 11, which was weaponized within 24 hours. A separate researcher later released exploit material for the BCS vulnerability on August 24. Telemetry from Defused revealed active probing of this exact two-stage chain inside honeypot environments by late August. Probing activity included initial JWT manipulation followed by heavy administrative enumeration directed at the Business Data Catalog sink. Data from Shadowserver indicates over 8,700 SharePoint servers remain directly reachable from the public internet. CISA previously mandated federal agencies to mitigate the authentication bypass, while also noting that older SharePoint bugs like `CVE-2026-45659` are already being abused by ransomware operators.
Read more → about Active In-the-Wild Chaining of SharePoint Auth Bypass and BCS Flaws Enables Remote Code Executioncritical3 sourcesCVE-2015-3246 CVE-2015-5287 +5
On August 26, 2026, CISA expanded its Known Exploited Vulnerabilities catalog with six additions across enterprise technologies. A prominent entry is CVE-2026-8452, a memory overflow issue affecting NetScaler ADC and Gateway appliances configured for AAA virtual servers or VPN gateways. While Citrix initially described the vulnerability as causing unpredictable behavior or denial-of-service, security researchers at WatchTowr published a proof-of-concept demonstrating unauthenticated remote code execution. Threat telemetry firms Previdian and Defused subsequently reported in-the-wild exploitation involving web shell deployments and discovery commands like `id` and `echo`. Fixed firmware releases include versions `14.1-72.61`, `13.1-63.18`, and `13.1-37.272`. Alongside the NetScaler flaw, CISA flagged CVE-2019-1068, a remote code execution bug in Microsoft SQL Server triggered via crafted queries. This flaw enables attackers to execute arbitrary code within the database engine's service account context. The catalog additions also encompass legacy vulnerabilities including Red Hat `libuser` race conditions (CVE-2015-3246), Red Hat ABRT privilege escalation (CVE-2015-5287), Ajax.NET Professional deserialization (CVE-2021-23758), and a Linux kernel out-of-bounds write flaw (CVE-2022-0995). CISA established an August 29 remediation deadline for the Citrix and Microsoft SQL vulnerabilities for affected federal entities, with remaining flaws slated for mitigation by September 9. Historical context notes this follows rapid exploitation of another NetScaler flaw, CVE-2026-8451, earlier in the year.
Read more → about CISA Updates KEV Catalog as Threat Actors Target Citrix NetScaler and Legacy Enterprise Softwarecritical2 sourcesCVE-2017-10271 CVE-2020-14882 +2
CISA has added a critical remote code execution vulnerability in Oracle HTTP Server and the WebLogic Server Proxy plugin, tracked as CVE-2026-21962, to its Known Exploited Vulnerabilities catalog. The max-severity flaw allows unauthenticated network access and has been actively exploited in the wild since January. Federal civilian agencies have been given a tight deadline to apply the patches released by Oracle earlier this year.
Read more → about CISA Orders Urgent Patching for Actively Exploited Oracle WebLogic Flaw