eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Citrix NetScaler ADC and Gateway Vulnerabilities Under Exploitation
Bottom Line: Citrix disclosed two critical zero-day vulnerabilities within its NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-88771 and CVE-2026-88772. Within days of their disclosure, eSentire has observed widespread exploitation of both flaws in the wild.
Update: As of October 4th, a third Citrix zero-day vulnerability has been confirmed. CVE-2026-88779 (CVSS: 8.7) is a memory overflow vulnerability impacting NetScaler ADC and NetScaler Gateway "under specific deployment conditions" that can lead to Denial of Service (DoS). Additional security patches have been released to address the flaw.
On September 27th, 2026, Citrix disclosed two zero-day vulnerabilities impacting its Citrix NetScaler ADC and NetScaler Gateway products, following speculation of unpatched Remote Code Execution (RCE) vulnerabilities impacting the products “circulating in the wild”. The first zero-day vulnerability is CVE-2026-88771 (CVSS v4: 9.5), an improper input validation flaw within NetScaler ADC and NetScaler Gateway, regardless of configuration, that can lead to an unauthenticated attacker executing arbitrary commands on impacted devices. The second zero-day flaw is CVE-2026-88772 (CVSS v4: 9.5), impacting NetScaler ADC and NetScaler Gateway when DTLS configuration is enabled, a default setting on VPN virtual servers, which can lead to RCE or Denial of Service (DoS). Citrix released patches to address these flaws, along with six other vulnerabilities outlined within their advisory; Citrix also confirmed that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed in the wild.
Following Citrix’s disclosure, CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on September 27th, giving a deadline of September 30th for Federal Civilian Executive Branch (FCEB) agencies to apply relevant patches. Following disclosure, both CERT-EU and Google published technical reports on exploitation of the flaws, which were leveraged to deploy webshells. watchTowr Labs published technical reports and Proof-of-Concept (PoC) exploit code for CVE-2026-88771 and CVE-2026-88772, providing insights into the exploitation chains. On September 29th, security researcher Kevin Beaumont confirmed that the vulnerabilities, referred to as PitScaler, were under “mass exploitation”.
eSentire Threat Intelligence Analysis:
When Citrix initially disclosed CVE-2026-88771 and CVE-2026-88772, no details were shared on the attacks that had been observed. Over the course of several days, reports emerged providing details on attacks that had been identified, including Google highlighting the exploitation of CVE-2026-88772 to deploy the WHIPSHOT webshell and SLAPSHOT TCP tunneling tool. Palo Alto Networks’ Unit 42 stated that exploitation of CVE-2026-88772 was identified as early as September 4th, with fingerprinting going back to August 2026. Exploitation of both flaws weeks before their disclosure, along with webshell deployment, would suggest that a highly skilled threat actor was behind the attacks, with a likely goal of achieving stealthy persistent access. However, no official attribution on these initial attacks has been provided at the time of writing. Since then, the release of technical details and PoC exploit code for both flaws appear to have initiated more widespread exploitation.
The discovery that exploitation has been ongoing for weeks prior to disclosure suggests that any Internet-facing NetScaler appliance that was unpatched in early September 2026 should be treated as compromised until an integrity assessment confirms that they were not affected. Citrix has released generic Indicators of Compromise (IoCs) through the NetScaler Console to assist customers to “perform a faster initial assessment” of whether NetScaler deployments have been impacted. Citrix states that customers who do not use NetScaler Console should contact Citrix Support to request access to the relevant IoCs. As exploitation is ongoing, organizations should ensure that relevant patches are applied immediately; patching the flaws does not remove any webshells or persistence mechanisms added by possible exploitation.
eSentire's Threat Response Unit (TRU) has developed MDR for Network detections to identify exploitation attempts against both CVE-2026-88771 and CVE-2026-88772, and MDR for Log detections for CVE-2026-88771. eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to both flaws. On September 28th, eSentire published an advisory for both vulnerabilities; a follow up advisory was released on September 29th detailing observed in-the-wild exploitation and post-compromise activity. eSentire's TRU is continuing to track both CVE-2026-88771 and CVE-2026-88772 for additional information and detection opportunities.
Cisco Catalyst SD-WAN Manager Zero-Day Vulnerability
Bottom Line: Cisco disclosed CVE-2026-76504, a critical, actively exploited zero-day in Cisco Catalyst SD-WAN Manager allowing unauthenticated attackers to gain admin-level API access. Organizations should patch Internet-exposed deployments immediately and review Cisco’s published indicators of compromise.
On September 30th, 2026, Cisco disclosed CVE-2026-76504 (CVSS: 9.8), a critical vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager, confirming active exploitation in the wild. The flaw allows an unauthenticated remote attacker to access an affected system with the privileges of the admin user, exploitable by sending a crafted request to the system’s API. Cisco’s Product Security Incident Response Team (PSIRT) became aware of active exploitation in September 2026, but has not shared details on the threat actor, the number of affected organizations, or when exploitation actually began.
The advisory noted that Internet-exposed instances are particularly vulnerable to compromise, as attackers can leverage the flaw without prior authentication. Cisco also published Indicators of Compromise (IOCs), including suspicious requests to URI-encoded variants of the j_security_check endpoint and log entries involving system accounts prefixed with viptela-reserved-. Cisco’s own cloud-managed SD-WAN offering (Cisco SD-WAN Cloud, Release 20.15.605) has already been remediated, with no customer action required for that deployment model; only on-premises SD-WAN Manager deployments require manual patching.
CISA added CVE-2026-76504 to its Known Exploited Vulnerabilities (KEV) catalog the same day, giving Federal Civilian Executive Branch (FCEB) agencies a compressed remediation deadline of October 3rd, 2026, just three days later.
eSentire Threat Intelligence Analysis:
The addition of CVE-2026-76504 to CISA’s KEV catalog significantly increases the severity and urgency of this vulnerability. While Cisco had already confirmed active exploitation, inclusion in the KEV catalog indicates that exploitation is ongoing and is considered a credible, confirmed threat to organizations operating affected Cisco Catalyst SD-WAN Manager deployments.
This vulnerability is particularly concerning because it affects the centralized management plane of SD-WAN environments. By exploiting the authentication bypass flaw, an attacker can obtain administrator-level API access without valid credentials. Compromise of a Cisco Catalyst SD-WAN Manager instance could provide attackers with visibility into, and control over, enterprise-wide network infrastructure. Administrative access may enable malicious actors to modify routing policies, deploy unauthorized configurations, obtain sensitive network information, create persistent accounts, or facilitate lateral movement across connected environments. Cisco has not publicly attributed the activity to a specific threat actor, nor has it disclosed the number of affected organizations.
Organizations operating Internet-exposed SD-WAN Manager instances should assume heightened targeting and prioritize patching accordingly. Recommended actions include applying Cisco’s patch to the appropriate fixed release immediately, auditing the two published log files for the specified indicators while accounting for false-positive potential, restricting SD-WAN Manager exposure to trusted networks and placing it behind a filtering device if immediate patching isn’t possible, and conducting a retrospective review of administrative access logs predating this disclosure given Cisco’s limited disclosure of when exploitation actually began. eSentire's Threat Response Unit (TRU) has published a security advisory on this vulnerability and created a new detection in eSentire MDR for Network to identify related activity.
FortiMail Zero-Day Vulnerability
Bottom Line: Fortinet recently disclosed CVE-2026-104286, a zero-day vulnerability impacting FortiMail that can lead to unauthenticated file writes on impacted devices. As the vulnerability is under exploitation, organizations should ensure that patches and mitigation steps are applied.
On October 1st, 2026, Fortinet disclosed a critical vulnerability affecting FortiMail, tracked as CVE-2026-104286 (CVSS: 9.8). The vulnerability combines a path traversal flaw (CWE-22) with improper NULL byte handling (CWE-158), allowing an unauthenticated attacker to write arbitrary files to the underlying system via crafted HTTP or HTTPS requests. Fortinet confirmed that the vulnerability has been actively exploited in the wild.
According to Fortinet’s advisory, the vulnerability affects multiple supported versions of FortiMail. Successful exploitation enables an unauthenticated attacker to write arbitrary files to the operating system, potentially leading to unauthorized code execution, system compromise, and persistent access. Affected versions include FortiMail 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9.
As part of its advisory, Fortinet published multiple Indicators of Compromise (IOCs), including suspicious file modifications, malicious binaries, log artifacts, and associated IP addresses. On October 1st, 2026, CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation. Federal Civilian Executive Branch agencies have been directed to apply the patch or workarounds by October 4th, 2026.
eSentire Threat Intelligence Analysis:
Within their advisory, Fortinet states that the vulnerability was “internally discovered and reported” by the Fortinet Product Security team, while also indicating that CVE-2026-104286 has been exploited in the wild. This would suggest that the flaw was uncovered while investigating customer systems that had already been exploited. Historically, the development of zero-day exploits would have suggested a well-resourced or sophisticated threat actor was behind an attack. However, with the adoption of AI, threat actors of all skill levels are able to use AI tools to aid in the development of zero-day exploits, significantly complicating attribution. Details on deployed payloads or post-compromise activity can help infer motivations behind attacks, but at the time of writing, details on exploitation of CVE-2026-104286 have not been shared.
Technical details are also currently limited for CVE-2026-104286, and at the time of writing, no Proof-of-Concept (PoC) exploit code is publicly available, which can lower the barrier for attacks. As threat actors, including ransomware operators and APTs, have a history of targeting Fortinet devices within attacks, organizations should ensure that relevant patches to address CVE-2026-104286 are applied as soon as possible. For organizations that cannot patch immediately, Fortinet recommends disabling the Identity-Based Encryption (IBE) feature support, and restricting access to the FortiMail management interface to trusted networks only. eSentire published an advisory for CVE-2026-104286 on October 2nd, and eSentire's Threat Response Unit (TRU) is continuing to monitor the flaw for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
