Security issues that need timely attention.

On October 8, seven governments — including Canada — jointly warned that Chinese state-linked hackers known as Flax Typhoon are actively breaking into organizations worldwide. In the same move, the FBI seized seven internet domains used to run the attackers' tools, and CISA added five exploited flaws to its Known Exploited Vulnerabilities catalog with an October 11 remediation deadline for federal agencies.

Here's the twist: none of the five flaws are new. They date from 2015 to 2023 — a 10.0-rated ProFTPD flaw (CVE-2015-3306), a 9.8 ONLYOFFICE Docs flaw (CVE-2021-3199), an Apache Struts command-injection flaw (CVE-2016-3081), a BIND denial-of-service flaw (CVE-2015-5477), and a Strapi information-disclosure flaw (CVE-2023-22894).

The campaign's power comes from automation: botnets scanning the internet for systems that were never patched, password spraying against Microsoft Exchange servers, VPN software planted for persistent access, and stolen emails and credentials exfiltrated to attacker servers. Three more flaws in the same campaign were already on CISA's exploited list — Shellshock, an old Pulse Secure VPN flaw, and an old GitLab flaw.

What to do

1. Hunt for forgotten systems — the risk isn't your maintained servers, it's the FTP server someone set up years ago, the self-hosted document tool, the legacy web app nobody owns. Inventory anything running ProFTPD, self-hosted ONLYOFFICE Docs, Apache Struts, BIND, or Strapi, and bring it current or take it offline.
2. Check the indicators — the joint advisory includes attacker IP addresses, domains, and malware signatures; review your logs for matches, especially on internet-facing systems.
3. Turn on multi-factor authentication everywhere, starting with email — password spraying against Exchange is part of this campaign's standard playbook; MFA is the cheapest effective defense.
4. Treat the October 11 date as a signal, not an obligation — it applies to US federal agencies, but CISA only sets deadlines that short when exploitation is active and ongoing.

Posted October 10, 2026 by Enterprise Managed IT Solutions.

Citrix has released patches for a critical vulnerability (CVE-2026-107406, rated 9.5/10) in NetScaler ADC and NetScaler Gateway. A memory-overflow flaw could let an attacker run code on the appliance or knock it offline — but only where the appliance is configured for SAML authentication, as an identity provider or a service provider.

The facts

CVE-2026-107406 was patched on October 8–9. It affects NetScaler ADC and NetScaler Gateway configured as a SAML IdP (identity provider) or SAML SP (service provider) — the authentication setup common in remote-access and single-sign-on deployments.

Affected ranges include 14.1-73.37 through 14.1-73.41 and 13.1-64.23 through 13.1-64.28 (IdP configurations), with broader ranges for SAML configurations generally. Fixed releases: 14.1-73.46+, 13.1-64.29+ (and matching FIPS builds).

Citrix reports no known exploitation of this flaw so far — so this is patch-before-it-burns, not an active incident.

Context

This is the fourth NetScaler bulletin in a week. The three earlier flaws (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779) are all under active attack, and Secure Private Access Hybrid deployments using NetScaler are affected by this one too.

What to do

1. Check your SAML configuration. Review your NetScaler configuration for SAML IdP or SP entries; the exposure depends on that, not just the version number.
2. Patch to the fixed builds. Upgrade affected appliances to 14.1-73.46+ or 13.1-64.29+, verifying the build against Citrix's current bulletin.
3. Don't assume last week's patch covered this. If you patched for the earlier SAML zero-day, you need this update too.

Posted October 9, 2026 by Enterprise Managed IT Solutions.

Small-business networks love MikroTik routers — affordable, capable, everywhere. That popularity is also why a critical new flaw in RouterOS deserves attention: CVE-2026-84411, rated 9.8/10, lets an unauthenticated attacker run code as root on the router with a single crafted HTTP request to its web management interface. No login, no user interaction.

The facts

CVE-2026-84411, rated 9.8/10 (Critical), was disclosed September 29 in CISA advisory ICSA-26-272-06. The bug is an integer underflow in the web management service's HTTP handling — it triggers before any authentication check, so the request that crashes it never needs a username.

RouterOS is affected below 7.24.2 on the stable branch, below 7.23.4 on the long-term branch, and below 6.49.21 on 6.x; MikroTik's fix ships in 7.24.2 or later (stable line), 7.23.4 or later (long-term line — 7.23.5 is current), 6.49.21 (the only fix for any 6.x), and 7.25 beta 3.

No confirmed exploitation yet — CISA reports no known public exploitation and no confirmed public proof-of-concept. This is a patch-before-it-burns advisory, not an active incident. Researchers note the fixed release saw very slow adoption in its first week — a large vulnerable footprint still sits exposed.

Added context

CERT Polska reports attackers have been actively exploiting other MikroTik flaws ('MikroTrick') since early September, so these routers are squarely on attackers' radar right now.

What to do

1. Update RouterOS. Stable line: 7.24.2 or later; long-term line: 7.23.4 or later; 6.x line: 6.49.21, the only fix for any 6.x. Older lines have no fix in-line: 7.21 long-term, 7.22, and older 7.x must move to 7.23.4+ or 7.24.2; 6.48 or older must go to 6.49.21 or a fixed 7.x (a major upgrade — plan for configuration migration).
2. Check for compromise markers. The fixed releases flag routers showing known signs of unauthorized changes; review the log and /system/device-mode/print for the 'flagged' value after upgrading, and audit users, scripts, and scheduled tasks for anything unfamiliar regardless.
3. Hide the web management interface. Do not expose router management to the internet; restrict it to trusted networks or a VPN. This applies regardless of patch status.
4. Inventory your routers. Branch offices, home offices, and third-party-installed gear are easy to miss.

Posted October 9, 2026 by Enterprise Managed IT Solutions.

AhsayCBS, a backup server product used by IT service providers, carries a critical flaw that lets an unauthenticated attacker run operating-system commands on the server — with full SYSTEM privileges. Since October 7, threat actors have been exploiting it in the wild, and even the vendor's latest release is still vulnerable.

The facts

CVE-2026-105134 (rated 10.0/10 under CVSS 3.1) allows unauthenticated command injection through the Replication Receiver component. Attackers chain it with CVE-2026-105133, a medium-severity authentication bypass (7.3/10 under CVSS 3.1) in the API's password-check function — no login required either way. The flaws were disclosed October 3–4, and public exploit code is circulating.

There is no patch. The vulnerability database lists 10.3.4 as fixed, but security firm Huntress confirmed on October 8 that 10.3.4 — the latest release — is also vulnerable, effectively making these zero-days. (Ahsay's own 10.3.4 release notes list no security fixes.)

Huntress has observed real-world exploitation against at least five organizations since October 7: attackers drop JSP web shells, deploy XMRig cryptocurrency miners disguised as Microsoft Edge processes, and install persistence — including a Windows service (MicrosoftEdgeUpdateSvc) and the WinRing0x64 kernel driver used to boost mining. Managed service providers are the primary targets.

What to do

1. Get the console off the internet. Until a patch exists, restrict the AhsayCBS management interface to trusted IPs or a VPN. This is the single most important step.
2. Check for compromise — don't assume a newer version is safe. Review for JSP web shells in the application directory, unexpected Windows services, Edge-named processes launched under cbssvcX64.exe, and unusual PowerShell or certutil activity.
3. If compromised, rebuild. A later patch won't remove web shells or persistence. Restore from a clean backup and validate backup integrity before you need it.

Posted October 9, 2026 by Enterprise Managed IT Solutions.

A maximum-severity flaw in self-managed GitLab (CVE-2026-85706, CVSS 10.0) lets an unauthenticated attacker read arbitrary files — including credentials and source code — from the server through the repository commits API. Active exploitation began within a day of the September 10 patch, and CISA confirmed real-world attacks on September 11. Any self-hosted GitLab instance still on an affected build is now over a month behind: patch to 19.1.8 / 19.2.6 / 19.3.2 (matching your version line), hunt API logs for traversal probing, and rotate every credential the GitLab process could have exposed. GitLab.com and GitLab Dedicated customers are unaffected. Related: CVE-2026-90970 (9.9/10) in the self-hosted GitLab AI Gateway lets authenticated Duo Agent Platform users run commands on the gateway — update the AI Gateway to 19.2.4 / 19.3.2 / 19.4.1 and rotate AI provider API keys.

Posted October 8, 2026 by Enterprise Managed IT Solutions.

CVE-2026-102255 is a pre-authentication server-side request forgery (SSRF) in the WorkPlace interface of SonicWall SMA1000 appliances, rated 10.0 out of 10. The interface's "unintended alternate access path" lets a remote attacker with no credentials and no user interaction send crafted requests through the appliance — directing it to issue requests on their behalf and reach internal functionality, effectively performing unauthorized operations through a box that guards your network edge. Three companion flaws are included in the same release: CVE-2026-102256 (7.8, OS command injection in the Appliance Management Console), CVE-2026-102257 (7.2, Zip Slip file overwrite in the console), and CVE-2026-102258 (5.5, stored XSS) — but all three require an administrator login, so the urgency belongs to the pre-auth flaw. SonicWall initially stated there was no evidence of exploitation — but as of October 9, researchers report exploitation attempts in the wild, detected on honeypots just three days after the October 6 patch. Treat unpatched appliances as a potential active compromise: hunt for indicators of compromise, don't just patch. SMA1000 flaws were exploited as zero-days in July 2026 and again in September, and Shadowserver counts more than 400 internet-exposed appliances.

The September patch doesn't cover this

The affected versions are exactly the ones SonicWall named as fixes for September's exploited flaws: 12.4.3-03526 and older, and 12.5.0-02952 and older (models 6210, 7210, and 8200v). The new fixed releases are 12.4.3-03670 and higher, and 12.5.0-03082 and higher. If your appliance was patched last month, it needs patching again. SSL-VPN running on SonicWall firewalls and the SMA 100 Series are not affected. There is no workaround; the hotfix installs from the MySonicWall portal and the appliance restarts when installation finishes.

Why this one is serious

SMA1000 appliances are remote-access gateways — the front door for remote workers into company networks and applications. A flaw that needs no login on an internet-facing box at that position is the worst kind of exposure, and threat actors have made this product line a favorite: July's zero-days were linked to ransomware gangs. Patching fast and reducing internet exposure are both worth doing.

What to do now

1. Find every SMA1000. Inventory models 6210, 7210, and 8200v and compare platform-hotfix versions against the fixed releases above — even if you patched in September.
2. Apply the hotfix. Upgrade to 12.4.3-03670+ or 12.5.0-03082+ and plan for the restart; schedule it outside working hours for production gateways.
3. Reduce exposure. Ask whether your appliance needs to face the internet directly, or whether access can be narrowed — IP allow-lists, a management subnet, or fronting it through a stricter perimeter.

How we help

We inventory your SonicWall remote-access deployments, schedule the hotfix with a maintenance window that respects the restart, and review whether your gateways' internet exposure can be reduced. If you're unsure whether your business is affected, contact us and we'll work through it with you.

Posted October 7, 2026 by Enterprise Managed IT Solutions.

CVE-2026-86360 is a path-traversal vulnerability in Dell System Update (DSU), the command-line deployment tool enterprise IT teams use to push BIOS, firmware, and software updates onto PowerEdge servers. It is rated 9.6 out of 10. Dell says "an unauthenticated attacker with remote access could potentially exploit this vulnerability," which can be leveraged to execute arbitrary code with root privileges — complete compromise of the application and the underlying operating system. The CVSS vector indicates some user action may be required, so this is not a simple wormable case — but a privileged, widely deployed management tool with a public remote-root flaw is exactly the kind of thing attackers study.

Five flaws in one release

Dell's advisory DSA-2026-324 (published October 1, 2026) fixes five vulnerabilities in System Update versions before 2.3.0.0. Alongside the critical path-traversal bug: CVE-2026-63697 (7.6), an improper certificate-validation flaw enabling remote code execution; CVE-2026-71168 (7.3), a second path-traversal flaw enabling remote code execution; and CVE-2026-86361 and CVE-2026-86362 (both 8.2), privilege-escalation flaws letting a low-privileged local user raise their rights. Upgrading to 2.3.0.0 or later resolves all five. There is no workaround. Dell has not reported active exploitation and no public proof-of-concept has surfaced; none of the five CVEs are in CISA's Known Exploited Vulnerabilities catalog.

Why this one is serious

System Update runs with root-level privileges by design, and most shops deploy the same DSU build across their entire server fleet — so a single vulnerable version can leave a whole data center exposed. Attackers favor trusted management components precisely because compromising one yields privileged access everywhere it manages.

What to do now

1. Find every DSU install. Inventory PowerEdge hosts on Windows Server, Linux, ESXi, and Azure Stack HCI — including standalone boxes outside central management — and flag anything older than 2.3.0.0. Dell's download record shows the fixed build dates to July 2026, so servers updated in your normal cycle may already be covered.
2. Upgrade to 2.3.0.0 or later. Take the package from Dell and verify the checksums before deploying; "or later" is the instruction to follow, not 2.3.0.0 exactly.
3. Shrink exposure in the meantime. Limit which systems and users can reach DSU components, and which catalogs or repositories they can use, until every host is patched. Treat any server you can't patch quickly as a candidate for extra monitoring.

How we help

We inventory your Dell server fleet, plan the System Update upgrade with a scheduled maintenance window, and review exposure while patches roll out. If you're unsure whether your business is affected, contact us and we'll work through it with you.

Posted October 6, 2026 by Enterprise Managed IT Solutions.

CVE-2026-21589 is rated 9.3 out of 10 and affects self-hosted installations of eight Atlassian products: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Fisheye and Crucible.

An attacker needs no login and no user interaction to read files inside the application's web directory. In Jira setups tied to Atlassian Crowd for identity management, researchers demonstrated that the file access could escalate to full administrator privileges. Attack attempts were detected on the internet within two hours of the public exploit release, and the pace is expected to increase. Atlassian Cloud customers are unaffected because Atlassian has already patched the cloud service.

What to do now

1. Patch immediately. Atlassian published fixed releases for each affected product. Apply the update for your version line and verify the exact fixed version against Atlassian's current bulletin before making changes.
2. Limit exposure. If your Atlassian server is reachable from the internet, restrict that access while the update is planned and deployed.
3. Block known attacker IP addresses. Add 38.60.157.86, 146.70.187.234 and 159.26.119.225 to appropriate deny lists, while recognizing that blocking these addresses does not replace patching.
4. Check for compromise. Atlassian cannot determine whether any given server was already compromised, so review logs for unexpected access rather than treating the patch as the end of the response.

How we help

We can identify exposed Atlassian servers, apply the correct updates, harden internet-facing services and review systems for signs of compromise. If your business runs Atlassian software, contact us and we'll assess your exposure.

Posted October 7, 2026 by Enterprise Managed IT Solutions

CVE-2026-102489 and CVE-2026-102490 are a session-fixation vulnerability and an improper-privilege-management vulnerability in Zammad, the open-source helpdesk and ticketing platform. Chained together, an attacker hijacks a session to execute code as the Zammad service account, then escalates to root on the host — full control of the server. Researchers at DIVD, the Dutch vulnerability-disclosure organization whose own Zammad system was breached through these flaws, rate the chained path at 9.4 out of 10. CISA added both to its Known Exploited Vulnerabilities catalog on October 2, 2026, with a federal remediation deadline of October 5, 2026 — now passed, so any still-unpatched system is overdue.

Patching isn't the whole job this time

CISA is explicitly calling for forensic triage rather than patch-and-move-on. That language is the agency's way of saying it expects some exposed systems are already compromised: exploitation evidence goes back to at least September 21. If your Zammad system was reachable during that window, the upgrade should be paired with a compromise check — session logs, unexpected administrative or root-level activity, and indicators of session hijacking.

What versions are affected

The remote code-execution flaw is practically exploitable on Zammad 6.3.0 through 6.5.4, per researchers; Zammad's own advisory states exploitation is only possible on 6.5 and earlier and that 7.0 and later are not affected in practice. Critically, 6.5 and older are end-of-life and no longer receive security updates — so for those systems the fix is an emergency migration to 7.x (current stable 7.2.0 includes the hardened code), not a patch. Check the exact installed build against Zammad's current advisory before acting.

What to do now

1. Find your Zammad systems. Ticketing systems are easy to forget about — inventory every Zammad instance, including ones run by individual departments.
2. Migrate off 6.5 and older now. They are end-of-life with no security updates; move to 7.x as an emergency change, not a routine window.
3. Check for compromise, don't just upgrade. Review for session-hijacking indicators and unexpected root-level activity dating back to mid-September before declaring a system clean.

How we help

We inventory your Zammad deployments, migrate end-of-life 6.5-and-older systems to 7.x with a planned emergency window, and pair the move with a forensic review of the exposure window — because this is one where the update alone isn't the answer. If you're unsure whether your business runs Zammad, contact us and we'll work through it with you.

Posted October 7, 2026 by Enterprise Managed IT Solutions.

Veeam has fixed a critical remote-code-execution vulnerability in Veeam Backup & Replication 12. CVE-2025-64393 is rated 9.4 out of 10 under CVSS 4.0 and is caused by unsafe handling of data received through the Mount Service.

An attacker needs an authenticated account with the low-privileged Backup Viewer role, so this is not an unauthenticated internet attack. That requirement does not make the flaw routine: if an attacker gains that account through stolen credentials or another foothold, the vulnerability can turn limited access into code execution on the backup server.

Why backup infrastructure deserves priority

Backup servers hold the recovery data businesses depend on after ransomware, system failure or human error. Control of that infrastructure can give an intruder a chance to disrupt recovery, alter backup operations or move deeper into the environment. Veeam has not reported active exploitation, and no confirmed public proof of concept was reported when the issue was disclosed, making this a patch-before-it-burns priority rather than an active incident.

Affected and fixed builds

Veeam Backup & Replication build 12.3.2.4854 and earlier version 12 builds are affected. The fix is included in version 12.3.2 P4 (build 12.3.2.4934); version 13 is not affected. Confirm the current supported upgrade path and release guidance before making changes.

What to do now

1. Confirm every build. Inventory Veeam Backup & Replication servers and record the exact version and build running on each one.
2. Apply the fixed release. Upgrade affected version 12 systems to 12.3.2 P4 or a later supported release, then verify that backup jobs, repositories and restore testing still operate as expected.
3. Review Backup Viewer access. Remove accounts that do not need the role, protect the remaining identities with strong authentication controls and investigate unfamiliar role assignments or sign-ins.
4. Keep backup systems isolated. Limit administrative and service access to trusted management paths, and monitor the backup server for unexpected processes, configuration changes or recovery-point activity.

How we help

We can identify affected Veeam servers, confirm their builds, plan the update and validate backup and restore operations after patching. Review the published vulnerability summary and Veeam's current release guidance before upgrading. If you're unsure whether your business is affected, contact us and we'll work through it with you.

Posted October 7, 2026 by Enterprise Managed IT Solutions.

Cisco Catalyst SD-WAN Manager, formerly vManage, has a critical authentication bypass that should be treated as an emergency. CVE-2026-76504 is rated 9.8 out of 10. A remote attacker who can reach the management interface can send a crafted HTTP request, bypass authentication and access the API with administrator privileges — no username, password or user interaction required.

This is especially serious because SD-WAN Manager is the central management plane for network policies, configurations and branch connectivity. Cisco says the vulnerability affects the product regardless of system configuration and confirmed that it was being actively exploited in September. CISA added it to the Known Exploited Vulnerabilities catalog on September 30, with a federal remediation deadline of October 3.

There is no complete workaround

Cisco has released a Live Protect shield as temporary partial protection, and recommends restricting on-premises management access to known, trusted hosts behind a filtering device. Neither measure replaces the software upgrade. Cisco-managed SD-WAN Cloud was fixed in release 20.15.605 and requires no customer upgrade action.

What to do now

1. Identify every deployment. Confirm the release running on each Cisco Catalyst SD-WAN Manager and whether its management interface is reachable from the internet or another untrusted network.
2. Upgrade to a fixed release. The first fixed builds are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1 and 26.2.1. Releases earlier than 20.9 must migrate to a supported fixed release.
3. Restrict access while upgrading. Allow only known administrative hosts to reach the management interface and keep control components behind an appropriate firewall. Treat this as risk reduction, not remediation.
4. Check for signs of exploitation. Review serviceproxy-access.log and vmanage-server.log for unexpected requests to encoded variants of j_security_check, unfamiliar source addresses and activity involving accounts whose names begin with viptela-reserved-. Cisco recommends collecting an admin-tech bundle and opening a TAC case if compromise is suspected.

How we help

We can inventory affected SD-WAN Manager systems, plan the correct upgrade path, restrict management exposure and review the published indicators for signs of attack. Refer to Cisco's security advisory for the latest fixed-release and investigation guidance. If you're unsure whether your business is affected, contact us and we'll work through it with you.

Posted October 6, 2026 by Enterprise Managed IT Solutions.

CVE-2026-88779 is a memory-overflow flaw in the SAML authentication handler of Citrix NetScaler ADC and NetScaler Gateway, rated 8.7 out of 10. An unauthenticated attacker can send a crafted SAML request that crashes the appliance's authentication service, cutting off VPN, single sign-on and remote access. Citrix has confirmed targeted attacks; Norway's National Security Authority has reported indications the flaw could allow remote code execution, a scope Citrix has not confirmed. CISA added it to its Known Exploited Vulnerabilities catalog on October 4, with a federal remediation deadline of October 7, 2026.

Only SAML configurations are exposed

The flaw applies where the appliance is configured as a SAML service provider or identity provider. Appliances without SAML authentication configured are not exposed to this flaw (though the earlier NetScaler flaws are a separate matter).

Patch again — the new build numbers

The fixed releases are NetScaler ADC and Gateway 14.1-73.41 and later, 13.1-64.28 and later, plus FIPS equivalents. Critically, the builds from last week's emergency patch round do not include this fix — an appliance patched for the earlier flaws is still vulnerable to this one. Citrix has also released interim deny-list signatures that can be deployed through the NetScaler Global Deny List feature while an upgrade is planned.

What to do now

1. Check SAML configuration. Review NetScaler configurations for SAML authentication actions or identity-provider profiles; only those deployments are exposed.
2. Upgrade to the fixed builds. Move to 14.1-73.41 or 13.1-64.28 (FIPS equivalents where applicable), and apply the interim deny-list signatures if the upgrade can't happen immediately.
3. Look for signs of attack. Researchers and administrators have reported appliance crashes and reboots, and attacks have been observed against honeypots — review appliance logs and uptime history for unexpected outages during the exposure window.

How we help

We inventory your NetScaler deployments, check which are configured for SAML, apply the fixed builds with a planned maintenance window, and review logs for signs of compromise. If you're unsure whether your business is affected, contact us and we'll work through it with you.

Posted October 5, 2026 by Enterprise Managed IT Solutions.

Microsoft released an out-of-band security update for Exchange Server on October 2, 2026—eleven days before the regular October Patch Tuesday—because of a high-severity authorization flaw it decided could not wait.

CVE-2026-96940 is rated 8.8 out of 10. A weak authorization check in Exchange Server lets an authenticated attacker with ordinary privileges read the mailboxes and attachments of other users in the same organization, with no user interaction and over the network. There is no access across organization boundaries. Microsoft’s Exchange Team says it is not aware of active exploitation, but considers exploitation “more likely” and notes that flaws of this type have been exploited in the past.

Even patched servers need the update again

The fix shipped as a reissue of the September update, labelled “September 2026 V2.” If a server received the original September patch, it still needs the V2 version. Microsoft’s Exchange Team recommends installing the security update on all Exchange servers—and on any server or workstation running the Exchange Management Tools, so the tools stay compatible.

What to do now

1. Confirm your build. The fix applies to Exchange Server Subscription Edition RTM (KB5129955), Exchange 2019 CU15 (KB5129956) and CU14 (KB5129957), and Exchange 2016 CU23 (KB5129958). Identify every on-premises Exchange server and record its current build.
2. Install the V2 update. Apply it even if the September patch is already in place, then restart and run Microsoft’s Exchange Server Health Checker to confirm nothing is missing.
3. Plan the 2016/2019 exit. This fix requires enrolment in the Extended Security Update Period 2 program, which expires at the end of October 2026. After that there is no patch path for Exchange 2016 or 2019—affected organizations should move to Exchange Server Subscription Edition or Exchange Online.

How we help

We can inventory your on-premises Exchange servers, apply the update with a planned restart, and put you on a supported path for 2016 and 2019. If you are unsure whether your business is affected, contact us and we’ll work through it with you.

Posted October 5, 2026 by Enterprise Managed IT Solutions.

Organizations using Citrix NetScaler ADC or NetScaler Gateway should treat two newly disclosed vulnerabilities as an incident-response priority, not a routine maintenance item.

CVE-2026-88771 and CVE-2026-88772 are both rated 9.5 out of 10 and are being actively exploited. An attacker does not need a username or password to run commands on a vulnerable appliance. Because NetScaler systems often sit at the edge of the network in front of remote access and business applications, a successful compromise can provide a valuable foothold.

Why an upgrade may not be enough

Evidence of exploitation predates the available fixes, and attackers have installed web shells that can remain after the vulnerable software is upgraded. Patching closes the entry point, but it does not prove the appliance was clean before the update or remove persistence that is already present.

What to do now

1. Confirm exposure. Identify any NetScaler ADC or Gateway appliances, especially systems reachable from the internet, and record their current builds.
2. Use Citrix's current guidance. Review bulletin CTX697096, confirm the affected and fixed build numbers, and upgrade without delay.
3. Hunt for compromise. Review the indicators in Citrix's bulletin and investigate appliance activity back to early September. Look for unexpected files, web shells, commands, accounts and outbound connections.
4. Respond to findings. If there are signs of compromise, isolate the appliance, preserve evidence and follow a full incident-response process. Rebuilding from a known-good image may be safer than trusting an in-place upgrade.

How we help

We can help identify exposed appliances, coordinate the correct upgrade path and review systems for signs of compromise. If you are unsure whether your business is affected, contact us and we’ll work through it with you.

Posted October 5, 2026 by Enterprise Managed IT Solutions.

If your business runs a Fortinet FortiMail email gateway, read this today—not next week.

On October 1, Fortinet disclosed a critical flaw in FortiMail (CVE-2026-104286, severity 9.8 out of 10) and confirmed it was already being exploited in the wild. Attackers need no username or password: a crafted web request is enough to write files anywhere on the appliance and take it over. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalog, with a federal remediation deadline of October 4.

Who’s affected

The affected releases are FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9. Fortinet lists upgrades to 8.0.2 or later, 7.6.7 or later, and 7.4.9 or later; deployments on 7.2 should move to the 7.4 branch or later. Verify the current upgrade path and instructions in Fortinet advisory FG-IR-26-175 before making changes.

What to do right now

1. Apply Fortinet’s workarounds immediately. Disable the affected Identity-Based Encryption (IBE) feature and make sure the management interface isn’t reachable from the internet.
2. Don’t assume you’re safe just because you patched. Patching closes the hole, but it doesn’t remove an attacker who already got in. Check for signs of compromise: unfamiliar accounts, modified binaries, tampered web configurations or unexpected outbound connections.
3. Watch for the published indicators. Fortinet has shared suspicious IP addresses and file hashes with the advisory.

The bigger pattern: attackers are coming in through the front door

Separately, Microsoft’s security team recently reported phishing campaigns that trick employees into installing legitimate remote-access tools—MSP360, then ScreenConnect—disguised as meeting invites or software updates. There was no malware to detect, just trusted IT software in the wrong hands. The fix there isn’t a patch; it’s awareness and good endpoint control.

How we help

This is exactly what proactive IT management is for: monitoring threat alerts like this one, checking your systems before attackers do and applying protections the same day—not when something breaks. If you’re not sure whether your business is exposed, contact us and we’ll take a look.

Posted October 4, 2026 by Enterprise Managed IT Solutions.