Your Perimeter Had a Bad Two Weeks: 9 Exploited Flaws, 6 Vendors, 13 Days

Between September 22 and October 4, CISA added nine actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. Every one of them sits in a product that lives on the edge of a network. Six vendors, thirteen days, and Citrix NetScaler showed up twice.

If you run any of these, this is the week to look. If you don't, the pattern is still worth five minutes, because it repeats every quarter now.

The list

NetScaler: patched, then hit again

On September 27, Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 through CVE-2026-88778. Two of them, 88771 and 88772, can each give an attacker remote code execution on their own, and CISA said they were being exploited globally. Its guidance was unusually blunt: check for compromise before you patch, and preserve forensic evidence before you apply the update. On October 2 it added Sigma detection rules to the alert.

So admins patched. A week later, appliances that were fully up to date started rebooting.

CVE-2026-88779 (CVSS 8.7) is a memory overflow that affects NetScaler configured as a SAML service provider or identity provider. Citrix says it saw targeted attacks against unmitigated deployments that cause denial of service, with no impact on data integrity identified. watchTowr's analysis also points to DoS only, possibly used to knock appliances over and make the earlier bugs easier to exploit. CISA added it on October 4, with a federal deadline three days later.

Two things worth taking from this:

• "Patched" is a timestamp, not a state. The appliance you fixed last weekend was exposed again by Saturday.
• A patch closes the hole. It doesn't evict whoever already came through it. That's why CISA's order was hunt first, then patch.

It's the sixth NetScaler vulnerability CISA has added to KEV this year.

FortiMail: unauthenticated file write, CVSS 9.8

CVE-2026-104286 lets an unauthenticated attacker write arbitrary files on a FortiMail appliance through crafted HTTP or HTTPS requests. Under the hood it's a path traversal combined with bad NULL byte handling. Fortinet's advisory confirms exploitation in the wild, and CISA added it on October 1 with an October 4 deadline for federal agencies.

• Affected: 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9.
• Fixed: 8.0.2, 7.6.7, 7.4.9. On 7.2, move to a fixed release on a supported branch.
• Can't patch today: disable the IBE feature and restrict the management interface to trusted internal networks.
• Before you call it clean: the indicators Fortinet published include modified or added files such as liblog.so, webconsole and mailservice.

The other four

Less noise, same category. On September 22, CISA added two Check Point flaws (improper certificate validation and a path traversal), an input validation bug in Arista's VeloCloud Orchestrator, and a heap overflow in F5 BIG-IP APM. On September 30 it was Cisco Catalyst SD-WAN Manager.

The orchestrator and the SD-WAN manager deserve a second look. They don't pass traffic, but they configure everything that does.

Why it's always the edge

VPN gateways, ADCs, mail gateways and SD-WAN controllers share three properties attackers love. They're reachable from the internet by design. They hold credentials and session tokens. And they almost never run an EDR agent. A compromised edge appliance is a foothold that most monitoring stacks simply don't see.

What to check this week

1. Inventory. Do you run anything in the table? Include the boxes nobody owns: the FortiMail a vendor set up three years ago, the NetScaler only one person logs into.
2. Hunt, then patch. For NetScaler especially, follow CISA's order. Look for compromise and keep evidence before updating, because patching first can wipe what you need.
3. Get management interfaces off the internet. FortiMail's own workaround is restricting the management interface. That should be the default for every appliance, not an emergency step.
4. Plan for the reboot. If your NetScaler is a SAML SP or IdP, expect instability until you're on the build that fixes CVE-2026-88779, and tell the helpdesk why logins may drop.
5. Watch KEV, not just vendor emails. A three-day federal deadline is a good proxy for "this is being exploited right now", and the KEV feed is free.

Also this fortnight

• Arrests. Two alleged ShinyHunters members were arrested, one in Amsterdam and one detained in Jordan. Separately, Operation KillSwitch led to the arrest in Spain of a 16-year-old believed to lead the KillSec ransomware group; investigators seized 110 TB from the leak site and searched properties in Greece, Romania, Spain and the UK.
• AI coding agents leaking screenshots. Research dubbed PixelLeak found AI coding agents had pushed more than 13,000 sensitive corporate screenshots from 343 companies to public GitHub repositories, after developers asked them for visual proof of their changes. If your developers give agents write access to repos, check what those agents commit.
• Spectre, again. A new Branch Target Reuse variant of Spectre v2 leaked Linux root password hashes within 3–5 minutes on Intel processors in a research setting.

Sources

• CISA: Adds Four Known Exploited Vulnerabilities to Catalog (Sep 22)
• CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (Sep 27, updated Oct 2)
• CISA: Adds One Known Exploited Vulnerability to Catalog (Sep 30)
• SecurityWeek: Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
• BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks
• The Hacker News: Critical FortiMail Zero-Day Flaw Exploited in Attacks
• The Hacker News: Weekly Recap, October 5, 2026

Questions? Find me on u/Arch0ne or Ionut-Robert Sandu.