Topic

#CISA KEV

2 articles

critical3 sourcesCVE-2026-76504

In-the-Wild Exploitation Targets Cisco Catalyst SD-WAN via Critical URL-Encoding Auth Bypass

Cisco has released emergency updates to patch a critical authentication bypass flaw affecting Catalyst SD-WAN Manager, tracked as CVE-2026-76504 with a maximum CVSS v3.1 score of 9.8. The vulnerability is classified under CWE-177 and stems from improper handling of URI-encoded characters during session-based API authentication processing. By issuing a crafted HTTP request with encoded paths—such as swapping a standard character for `%6a` targeting the `j_security_check` endpoint—an unauthenticated remote attacker can bypass authentication controls. Successful exploitation grants the attacker full administrative access to the underlying management API without requiring valid credentials or user interaction. Cisco discovered the issue in September 2026 after active exploitation was identified during a Technical Assistance Center support engagement. All Catalyst SD-WAN Manager deployments are affected regardless of their system configuration, and no functional workarounds exist to mitigate the flaw. While Cisco-managed cloud instances received automatic mitigations, on-premises administrators must upgrade to fixed releases, including versions 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1. CISA responded by adding CVE-2026-76504 to its Known Exploited Vulnerabilities catalog, ordering US federal civilian agencies to remediate and assess their environments within a three-day window. Defenders are urged to examine `/var/log/nms/containers/service-proxy/serviceproxy-access.log` for anomalous requests directed at `j_security_check` and inspect `/var/log/nms/vmanage-server.log` for unexpected sessions originating from accounts prefixed with `viptela-reserved-`. Pending patches, network teams should sever direct internet exposure of the management console and restrict inbound access exclusively to verified, trusted IP addresses.

critical4 sourcesCVE-2025-6543 CVE-2026-88771 +2

Citrix NetScaler Under Active Attack via SAML Zero-Day CVE-2026-88779

Citrix has rolled out emergency security updates to address an actively exploited zero-day flaw affecting NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-88779 with a CVSS v4 score of 8.7. The vulnerability is classified as a memory buffer overflow (CWE-119) that impacts appliances configured either as a SAML Service Provider via `add authentication samlAction` or as a SAML Identity Provider using `add authentication samlIdPProfile`. Administrators first raised alarms over the weekend after observing appliances running recently patched firmware versions—such as NetScaler 14.1-73.37—continuously rebooting due to the `nsaaad` authentication daemon crashing until the internal `Pitboss` process hit its watchdog restart threshold. While Citrix officially characterizes the vulnerability strictly as a denial-of-service issue with no observed data integrity impact, incident handlers and external researchers observed weaponized exploitation attempts passing crafted usernames containing shell commands designed to stage second-stage payloads such as `/v` from remote infrastructure. Independent testing yielded mixed assessments: security firm watchTowr reproduced the flaw as a DoS mechanism that can trigger rapid reboots—possibly chained to accelerate exploitation of previously disclosed vulnerabilities like CVE-2026-88771—while other security researchers observed compromised honeypots executing staged binaries. To remediate the vulnerability, Citrix published patched firmware builds across supported lines, including versions 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 NDcPP. The vendor has also supplied Global Deny Lists intended to temporarily block known attacking IP addresses, though standard patch application remains mandatory. Due to confirmed active exploitation in the wild, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88779 to its Known Exploited Vulnerabilities catalog, ordering US civilian federal agencies to apply patches by October 7.

← all articles