Vulnerabilities & CVEs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Citrix NetScaler ADC and Gateway vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing reports of active exploitation in the wild. The update came on Sunday, signaling that attackers are already targeting these flaws globally. The two vulnerabilities are: CVE-2026-88771 (CVSS score: 9.5) – an improper input validation issue that could allow an unauthenticated attacker to compromise affected systems. CISA's KEV catalog is used to flag vulnerabilities that are being actively exploited, and federal agencies are typically required to remediate listed flaws within a set timeframe. The addition of these NetScaler issues underscores the urgency for organizations running the affected products to patch immediately or apply mitigations. Given the severity of the flaws and confirmed exploitation, defenders should prioritize reviewing their Citrix NetScaler ADC and Gateway deployments and ensure they are running supported, up-to-date versions. Source: The Hacker News Is your organization running Citrix NetScaler ADC or Gateway, and if so, how are you handling the patching?

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a weekend directive requiring U.S. federal agencies to secure their systems against active attacks targeting two critical vulnerabilities in Citrix NetScaler. The order sets a deadline of Wednesday for agencies to apply the necessary patches. The two flaws are being actively exploited in the wild, which prompted CISA to invoke its emergency directive authority to compel rapid remediation across federal networks. Agencies are expected to verify whether their environments are affected and take immediate action to close the exposure window. Key points from the directive: Affected product: Citrix NetScaler Two critical vulnerabilities, both under active exploitation Federal agencies must complete patching by Wednesday CISA issued the order over the weekend, underscoring the urgency Administrators running Citrix NetScaler in any environment, not just federal agencies, should treat this as a priority. Given the active exploitation, delays in patching leave systems open to compromise. Source: Publication Name Are you running Citrix NetScaler in your environment, and if so, have you already applied the patches or are you still working through the remediation?

F5 has disclosed a critical zero-day vulnerability in BIG-IP Access Policy Manager (APM) that is actively being exploited in the wild. The flaw, tracked as CVE-2026-94127, allows attackers to execute code on a vulnerable BIG-IP system without authentication. According to F5, the vulnerability only affects systems where APM is configured to act as an OAuth authorization server, issuing access tokens to applications. Environments using APM in other roles are not impacted by this specific flaw. F5 published an advisory on September 22 and has released engineering hotfixes to address the issue. Given that exploitation has already been observed, administrators running APM as an OAuth authorization server should treat this as urgent and apply the available fixes as soon as possible. Key points: Vulnerability: CVE-2026-94127 Impact: unauthenticated remote code execution on BIG-IP systems Affected configuration: APM serving as an OAuth authorization server Status: actively exploited zero-day Fix: engineering hotfixes released by F5 Advisory date: September 22 If your organization runs BIG-IP APM in an OAuth authorization server role, verify your version against F5's advisory and deploy the hotfix immediately. Until patching is complete, consider restricting management and token-issuing interfaces from untrusted networks as an interim control. Source: The Hacker News Is your organization running BIG-IP APM as an OAuth authorization server, and have you already applied F5's hotfix?

A use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem can be exploited to escape a container and obtain root privileges on the host system, according to research published by DepthFirst on September 22. The flaw is tracked as CVE-2026-80521 with a CVSS score of 7.8. While it was fixed upstream on August 6, Ubuntu has not yet shipped the patch for its 26.04, 24.04, or 22.04 LTS releases, leaving those systems exposed. Affected releases still awaiting the patch: Ubuntu 26.04 LTS Ubuntu 24.04 LTS Ubuntu 22.04 LTS Administrators running containerized workloads on these Ubuntu versions should treat this as a priority, since a successful exploit allows an attacker to break out of the container boundary and gain root on the underlying host. Until Ubuntu publishes the fix, mitigation options are limited to applying upstream kernel patches manually or restricting access to untrusted container workloads. Source: The Hacker News Has anyone confirmed whether the upstream patch applies cleanly to the affected Ubuntu LTS kernels, or are you waiting on Canonical's backport?

Two unpatched zero-day vulnerabilities in Citrix NetScaler are reportedly being exploited in active attacks. Cybersecurity agencies, security researchers, and IT providers have been privately warning organizations about the flaws ahead of patches expected next week. Because no patches are available yet, administrators are being advised to consider shutting down exposed NetScaler appliances as a precaution until fixes are released. Key points so far: The vulnerabilities affect Citrix NetScaler and remain unpatched at this time. Exploitation has reportedly been observed in the wild. Patches are expected to arrive next week, according to the warnings circulating among agencies and researchers. Until then, taking affected systems offline is one of the few defensive options available. Organizations running NetScaler in an internet-facing capacity should treat this as urgent and review their exposure while awaiting official fixes. Source: BleepingComputer Is your organization running NetScaler, and are you planning to take it offline until patches land?

Cloudflare has patched a security flaw in Containers and Sandboxes that could have let customers on a Workers Paid plan recover leftover data belonging to other customers whose containers ran on the same physical host. The issue is a cross-tenant isolation problem, meaning a malicious or curious user could potentially access residual data left behind in memory or storage from another tenant's container workload. Key points about the flaw: Affected products: Cloudflare Containers and Sandboxes Affected users: customers with a Workers Paid account Impact: potential recovery of residual data from other customers' containers on the same host Status: the vulnerability has been fixed by Cloudflare While the exact exploitation requirements and the scope of exposed data have not been detailed in the report, this kind of cross-tenant leak is significant because it undermines the isolation guarantees that multi-tenant cloud platforms are built on. If you are running workloads on Cloudflare Containers or Sandboxes, it is worth reviewing your security posture and checking for any official Cloudflare guidance. No specific CVE ID was provided in the source, so none is listed here. Source: BleepingComputer Are you using Cloudflare Containers or Sandboxes in production, and if so, how are you handling tenant isolation now?

watchTowr reported on September 26 that two unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are being actively exploited in the wild. Both flaws allow remote code execution. Citrix has not yet confirmed the vulnerabilities or released a patch. In response, some administrators have chosen to take their appliances offline rather than wait for a fix to become available. Affected products: Citrix NetScaler ADC Citrix NetScaler Gateway Given the lack of an official patch, organizations running these appliances should assess their exposure and consider interim risk mitigations until Citrix responds. Source: The Hacker News Has your organization taken any NetScaler appliances offline or applied temporary mitigations in response to this threat?

Two vulnerabilities in MikroTik RouterOS can be chained together to give attackers full administrative control of internet-exposed routers. The chain, dubbed MikroTrick by CERT Polska, allows compromise without a password, an SSH key, or even a completed authentication handshake. The attack combines an SSH state-machine flaw tracked as CVE-2026-67279 with an argument-injection bug in the RouterOS login process tracked as CVE-2026-86060. Exploiting the two together bypasses the normal login flow entirely, granting administrative access to the device. Key points: Affected platform: MikroTik RouterOS devices with SSH exposed to the internet Vulnerability 1: SSH state-machine flaw — CVE-2026-67279 Vulnerability 2: Argument-injection bug in the RouterOS login process — CVE-2026-86060 Impact: Full administrative takeover without credentials or a completed authentication step Attack logs observed by researchers date back to at least [date truncated in source] Because the chain does not require valid credentials, any router with SSH reachable from the internet should be treated as a potential target. Restricting SSH exposure to trusted networks and applying vendor fixes as they become available are the most direct mitigations. Source: The Hacker News Do you have MikroTik routers with SSH exposed to the internet, and if so, how are you securing them?

ClickFix has evolved from a late-2023 novelty into what is now described as the most common initial access technique targeting enterprise networks. According to a new global threat report by CTM360, the method requires no exploit, no malicious attachment, and no file written to disk, which is precisely what makes it so difficult to defend against. The report, built from an analysis of roughly 17,000 URLs, traces how ClickFix has matured into a subscription-based criminal product. Its infrastructure reportedly includes on-chain components, and its user base now extends to state-sponsored actors. The technique weaponizes trusted websites, turning them into delivery points that convince victims to run malicious commands themselves. Because there is no payload on disk to scan and no software vulnerability to patch, traditional domain-blocking defenses are described as no longer useful against this threat. The report argues that organizations need to rethink detection and prevention strategies for this class of social-engineering-driven execution. Key points from the findings: ClickFix is now the most common path into enterprise networks. The technique relies on no exploit, no attachment, and no on-disk file. Analysis covered approximately 17,000 URLs. ClickFix has become a subscription product with on-chain infrastructure. State-sponsored actors are among its users. Blocking malicious domains alone is no longer an effective defense. Source: The Hacker News Has your organization adjusted its defenses to account for ClickFix-style attacks, and if so, what approach are you taking?

Google is warning of a renewed mass exploitation campaign targeting a known vulnerability in Oracle PeopleSoft, with activity observed across multiple sectors worldwide. The campaign has been linked to ShinyHunters and centers on the weaponization of CVE-2026-35273, a critical flaw rated CVSS 9.8 that can lead to unauthenticated remote code execution. The vulnerability was first exploited as a zero-day, and attackers are now bypassing WAFs to exploit it and deploy web shells. Affected product: Oracle PeopleSoft Vulnerability: CVE-2026-35273 (CVSS 9.8, unauthenticated RCE) Threat actor: ShinyHunters-linked activity Initial exploitation: as a zero-day Observed impact: mass exploitation across multiple sectors globally, WAF bypass, web shell deployment Given the severity of the flaw and the active exploitation, organizations running Oracle PeopleSoft should prioritize patching and review their environments for signs of compromise, particularly web shell activity. Source: The Hacker News Is your organization running Oracle PeopleSoft, and if so, what steps are you taking to mitigate this threat?

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog, confirming evidence of exploitation in the wild. The first is CVE-2026-65660, a code injection vulnerability in Microsoft Office SharePoint carrying a CVSS score of 8.8. This flaw allows remote code execution, making it a serious risk for organizations running affected SharePoint deployments. The second vulnerability affects MikroTik RouterOS. While the advisory does not provide a specific CVE identifier for this flaw in the available details, its inclusion in the KEV catalog signals that attackers are already leveraging it in real-world campaigns. Given that both flaws are under active exploitation, defenders should treat them as urgent. Recommended actions include: Review the CISA KEV catalog entry for both vulnerabilities and apply any available vendor patches immediately Prioritize remediation for internet-facing SharePoint servers and MikroTik RouterOS devices Monitor for signs of compromise on affected systems and restrict unnecessary external exposure Track vendor advisories from Microsoft and MikroTik for updated guidance Source: The Hacker News Has your organization already patched these flaws, or are you still assessing exposure across your SharePoint and MikroTik infrastructure?

Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could allow an unauthenticated attacker to create rogue administrator accounts and seize control of a site. The issue is a cross-site request forgery (CSRF) vulnerability, which has not yet been assigned a CVE identifier and carries a CVSS score of 8.8 out of 10.0. It only affects certain versions of the plugin. Successful exploitation requires an administrator to click a crafted link, after which the attacker can establish a malicious admin account and take over the affected website. Affected users should confirm whether their installed version is impacted and update to a patched release as soon as one is available. Watch for unexpected administrator accounts Review recent admin activity and plugin versions Apply vendor updates promptly once released Until a fix is available, treat unsolicited links received by site administrators with heightened caution. Source: The Hacker News Has your organization already checked its Elementor version and audited for suspicious admin accounts?

The Canadian Centre for Cyber Security has issued a warning about a Roundcube Webmail vulnerability that has been patched but is now being actively exploited in the wild. The flaw is tracked as CVE-2026-48842 with a CVSS score of 8.1. It is a pre-authentication SQL injection in the virtuser_query plugin, affecting: Roundcube Webmail 1.6.x before 1.6.16 Roundcube Webmail 1.7.x before 1.7.1 The issue stems from a preg_replace() backslash problem in the plugin's handling, which enables the injection before authentication occurs. Since the vulnerability can be triggered without valid credentials, any exposed instance running an affected version should be considered at risk. If you run Roundcube, verify your version and upgrade to 1.6.16, 1.7.1, or a later release as soon as possible. Given that exploitation is confirmed in the wild, patching should be treated as urgent, and administrators should review logs for signs of suspicious requests to the virtuser_query endpoint. Source: The Hacker News Has your organization already patched Roundcube, or are you still assessing exposure?

Kiteworks has issued an urgent advisory urging customers worldwide to temporarily shut down their servers this coming Saturday for a six-hour window. The precaution follows threat intelligence indicating a potentially imminent cyberattack targeting the secure file-sharing platform, with the possibility of an unpatched zero-day exploit being used. The shutdown is intended to reduce exposure during the period when the threat is expected to be most acute. Operators running affected Kiteworks deployments should plan for service downtime and communicate the maintenance window to users in advance. Key points: Affected product: Kiteworks secure file-sharing software Recommended action: shut down servers for a six-hour window on Saturday Reason: threat intelligence warning of a potentially imminent cyberattack, including possible zero-day exploitation No specific CVE ID, advisory ID, or patch version was provided in the source reporting Administrators should monitor official Kiteworks channels for further guidance, including any patch or mitigation instructions, and be prepared to extend the outage or apply emergency updates if new details emerge. Source: BleepingComputer Is your organization running Kiteworks, and if so, how are you handling the planned shutdown window?

A cross-site request forgery (CSRF) vulnerability has been identified in the Elementor plugin for WordPress that could allow an unauthenticated attacker to create administrator accounts. According to the report, the flaw can be triggered without authentication, giving attackers a path to gain elevated privileges on affected sites. The vulnerability affects installations running the Elementor plugin. Administrators are advised to check their plugin version and update to the latest release as soon as possible to close the attack vector. Sites that cannot update immediately should consider additional protections such as restricting access to the WordPress admin area or deploying a web application firewall rule to block CSRF-style requests. Key points to keep in mind: The issue is a CSRF flaw in the Elementor plugin Exploitation could result in the creation of administrator accounts The attack does not require authentication Updating the plugin is the primary mitigation No specific CVE identifier was provided in the source article. Source: BleepingComputer Has your organization already patched Elementor, or are you relying on compensating controls in the meantime?

CISA has added two critical vulnerabilities affecting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog. The move, announced on Thursday, follows evidence that both flaws are being actively exploited in the wild. The first issue is tracked as CVE-2026-5430, a path traversal vulnerability in the WSO2 API Control Plane with a CVSS score of 9.8. Path traversal flaws of this severity typically allow an unauthenticated attacker to reach files and directories outside the intended scope, which makes them attractive targets for initial access and follow-on compromise. The second flaw affects Adobe Commerce and Magento deployments. Organizations running either platform should treat this as urgent given the confirmed exploitation activity. Key points to note: CVE-2026-5430 carries a CVSS score of 9.8 and affects the WSO2 API Control Plane A separate critical flaw impacts Adobe Commerce and Magento Both vulnerabilities are now listed in the CISA KEV catalog based on evidence of active exploitation Federal agencies are expected to remediate KEV-listed issues within the mandated timeframe If your organization runs WSO2 products, Adobe Commerce, or Magento, prioritize identifying exposed instances and apply vendor patches or mitigations as soon as possible. Given the active exploitation, delaying remediation carries real risk. Source: The Hacker News Does your organization run WSO2 or Adobe Commerce/Magento, and have you already started patching?

Cloudflare has addressed a security flaw in Cloudflare Containers that could have allowed a paying customer to read leftover data from other customers' containers on the same server, according to Cloudflare and the researchers who discovered it. The issue stemmed from disk space that earlier containers had used and then released, not from any active workload. According to Cloudflare, an attacker had no way to select whose data they would receive. Key points: The exposed data came from previously used and relinquished disk space, not live container activity. Attackers could not control or target specific victims' data. Cloudflare and the reporting researchers disclosed the finding on Thursday. Source: The Hacker News Do you think disk space reuse in multi-tenant container platforms deserves more scrutiny from cloud providers?

This week's threat landscape is a reminder that trusted paths are often the easiest ones to poison. Whether it's an update prompt, a login box, a search result, or a coding assistant, attackers keep finding ways to dress dangerous payloads as routine interactions. A few themes stand out: old bugs being repurposed, AI tools leaking more than users expect, and fake prompts that look legitimate enough to fool careful users. Some attacks barely require an exploit at all — just a convincing link or a familiar workflow is enough to trigger one-click code execution. Search poisoning tied to AI tools is also gaining traction, alongside incidents where AI coding assistants have leaked repositories. The takeaway is consistent: anything that shortcuts trust is worth a second look. Key points worth noting: AI search results are being poisoned to steer users toward malicious content AI coding tools have leaked repository data One-click code execution remains a viable attack path without a traditional exploit Older vulnerabilities continue to be repurposed in new campaigns If your organization relies on AI-assisted search or coding tools, review how those tools handle trust boundaries and what data they can access. Assume that anything surfaced by an AI layer can be manipulated, and verify before acting. Source: [email protected] (The Hacker News) Does your organization use AI coding or search tools, and how are you handling the trust and data exposure risks they introduce?

A researcher has demonstrated that a OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, without that app requesting any special permissions. According to the report, researcher Rasmus Moorats chained two flaws in OnePlus's own software to obtain root access, which is the highest level of control over an Android device. The concerning part is the scope. OnePlus reportedly told the researcher that the same flaws affect many more of its own devices as well as devices from OPPO — though it has not yet been confirmed whether a fix has been released. Key points: Attack vector is a locally installed app requiring no special permissions Two flaws were chained together to achieve root Affected hardware reportedly extends beyond the OnePlus 15 to other OnePlus and OPPO devices No patch details were provided at the time of reporting If you use a OnePlus or OPPO device, it is worth watching for official updates and being cautious about sideloaded applications until the vendor ships a fix. Source: The Hacker News Does your organization manage OnePlus or OPPO devices, and if so, how are you handling the lack of a patch so far?

The Canadian Centre for Cyber Security has warned that a high-severity vulnerability in Roundcube Webmail, patched back in May, is now being actively exploited in the wild. The flaw enables code injection attacks against vulnerable installations. Administrators running Roundcube should treat this as urgent: the patch has been available since May, yet exploitation is ongoing, which suggests many instances remain unpatched. Code injection of this kind can allow attackers to execute arbitrary code on the mail server, making it a serious risk for organizations that expose webmail to the internet. Given that the article does not specify a CVE identifier for this flaw, refer to the vendor's May security advisory and patch release for the exact fix rather than relying on third-party summaries. Verify your Roundcube version against the patched release and apply the update immediately if you have not already done so. Check your current Roundcube version against the vendor's patched release from May Apply the latest security update without delay Restrict or monitor external access to webmail interfaces where possible Review logs for suspicious activity on mail servers running unpatched versions If your organization runs Roundcube, confirm whether the May patch was deployed and audit for any signs of compromise. Source: BleepingComputer Has your organization already applied the May Roundcube patch, or are you still working through the rollout?