Monday, September 28, 2026|Issue 10|6 min read|Join the discussion
Yesterday’s uncertainty became today’s incident-response queue
Citrix has now confirmed and patched the NetScaler zero-days we were tracking, Kiteworks has narrowed and lifted its emergency shutdown, and a Google SecOps disruption reminds defenders that security tooling is itself production infrastructure.
The short version
- UPDATE: Citrix confirmed exploitation of NetScaler CVE-2026-88771 and CVE-2026-88772 and shipped fixed builds; CISA added both to KEV with a September 30 deadline.
- UPDATE: Kiteworks lifted its precautionary shutdown and says the flaw is confined to Advanced Forms, used by fewer than 50 organizations, with no evidence of exploitation.
- Federal deadline today for exploited SharePoint Server CVE-2026-65660 and MikroTik RouterOS CVE-2026-67279.
- Google SecOps is reporting intermittent login failures and HTTP 500 errors in us-east1, us-central1 and europe-west1; Google says ingestion and SIEM APIs are unaffected.
- Mandiant says ShinyHunters is mass-exploiting PeopleSoft CVE-2026-35273 again, using a URL-encoding trick to slip past WAF rules instead of patched systems.
Issue at a glance
1 critical2 high1 notable
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler ADC and Gateway | Unauthenticated remote command execution via improper input validation; affects default configurations | Critical (CVSS v4 9.5), exploited |
| CVE-2026-88772 | Citrix NetScaler ADC and Gateway | Memory overflow leading to RCE or denial of service when DTLS is enabled (default on VPN vServer) | Critical (CVSS v4 9.5), exploited |
Also on the vulnerability desk
- Due today, September 28 (added September 25): Microsoft SharePoint Server CVE-2026-65660, code injection letting a low-privileged signed-in user run code (Microsoft first listed it as spoofing), and MikroTik RouterOS CVE-2026-67279, an SSH workflow flaw chained with CVE-2026-86060 in the MikroTrick exploit. CERT Polska reports attacks on exposed routers since at least September 2.
- Not a CVE: Kiteworks says a critical vulnerability chain is confined to its Advanced Forms product. Self-hosted Advanced Forms customers should contact Kiteworks support; everyone else can run normally.
Breaking
network / vulnerability / incident response
Citrix confirms the NetScaler zero-days, and patching is only step three
Citrix bulletin CTX697096 fixes eight NetScaler ADC and Gateway flaws. Two are exploited: CVE-2026-88771, unauthenticated command execution in default configurations, and CVE-2026-88772, a memory overflow reachable when DTLS is on. CISA added both to KEV on September 27 and says partner intelligence confirms exploitation globally. watchTowr had warned of unpatched exploitation on September 26.
Why it matters. These appliances sit at the remote-access front door. Attacks began before any fix existed, so a patched box today says nothing about whether it was entered last week. CISA explicitly warns that updating may wipe forensic visibility.
What to do. Preserve evidence first, run Citrix's IOC checks in NetScaler Console, then upgrade: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 FIPS/NDcPP or later. There is no workaround. If anything looks wrong, rotate sessions, credentials and certificates the appliance handled, and keep monitoring.
CVE-2026-88771, CVE-2026-88772
file transfer / threat intelligence
Kiteworks lifts its shutdown and narrows the problem to Advanced Forms
Kiteworks lifted its precautionary shutdown recommendation on September 27 and restored the systems it hosts. In customer emails reported by SecurityWeek, it said a severe vulnerability is confined to Advanced Forms, enabled for fewer than 1% of customers (under 50 organizations). It says it has no evidence of exploitation or customer compromise and is sharing intelligence with partners including Mandiant.
Why it matters. A vendor acted on federal threat intelligence before it had a full technical picture, then used the downtime to find the actual flaw. That is the right order of operations when the warning is credible, even if it is rare.
What to do. If you run self-hosted Advanced Forms, contact Kiteworks support before bringing it back and treat it as offline until fixed. Everyone else: confirm your instances are back, review logs from before the shutdown window, and watch for a CVE or technical disclosure.
vulnerability / network
SharePoint and MikroTik hit their federal deadline today
CISA's September 28 deadline arrives for SharePoint Server CVE-2026-65660 and RouterOS CVE-2026-67279. Microsoft says it had reliable evidence of attacks as of September 25; CERT Polska reports MikroTrick attacks on internet-exposed routers since at least September 2.
Why it matters. Both fixes have been out for weeks, so the question is less whether you patched and more whether someone got in first.
What to do. Confirm the updates are applied, then look for web shells and unexpected accounts on SharePoint and for unfamiliar files, users or SSH sessions on RouterOS devices.
CVE-2026-65660, CVE-2026-67279
SOC / cloud
Google SecOps disruption hits logins, not ingestion
Google's status page reports an active incident since 06:30 PDT on September 28: intermittent login failures and HTTP 500 errors for Google SecOps in us-east1, us-central1 and europe-west1. Google says ingestion and SIEM APIs are unaffected and it is testing mitigations.
Why it matters. Data still flowing in does not help if analysts cannot get to the console. Security tooling is production infrastructure and needs a degraded-mode plan like anything else.
What to do. Check the status page for updates. Make sure your team knows where alerts route when the console is down, and that critical detections also notify through a separate channel.
Trends
The unit of defense is not the patch
Yesterday's point was that risk follows the path to consequence. Today extends it: a patch removes a vulnerability, not an attacker who already used it. NetScaler, SharePoint and MikroTik all saw exploitation before many teams could patch. The mature sequence is detect exposure, understand the threat, preserve evidence, investigate, remediate, rotate trust and keep watching. CISA's NetScaler guidance says the same thing in plainer terms: check for compromise before you update.
Mitigations that stop short of the patch get tested
Mandiant and Google Threat Intelligence Group say ShinyHunters (UNC6240) has renewed mass exploitation of PeopleSoft CVE-2026-35273, which Oracle patched in June. The new wave bypasses WAF rules that blocked the PSEMHUB endpoint by URL-encoding one character, and has spread to government, healthcare, technology and other sectors. A filter is a stopgap; attackers will probe its edges.
Edge devices are an observability problem
F5, Check Point, VeloCloud, Zyxel, MikroTik and now NetScaler have filled recent issues. These trust-boundary devices rarely run the endpoint tooling defenders rely on elsewhere, which is why vendors keep shipping IOC scanners after the fact. Plan to collect logs from them centrally before the next emergency, not during it.
Clearance corner
NIST maps the SSDF onto a working DevSecOps pipeline
NIST's NCCoE added new material to its live DevSecOps Practices document: a mapping of SSDF practices to its reference model, a second example implementation covering CI/CD automation and container deployment, phase-by-phase scenarios, and an updated AI section. A webinar on October 28 will cover plans for agentic AI in DevSecOps. For teams attesting to secure development on federal work, it turns SSDF tasks into pipeline steps you can point to.
What we are watching next
NetScaler follow-on
Watch for IOCs, attribution and post-exploitation reporting ahead of the September 30 federal deadline.
Kiteworks disclosure
Look for a CVE, fix or technical details for the Advanced Forms vulnerability.
Google SecOps resolution
Watch for the incident to close and for Google's summary of cause.
ShinyHunters and PeopleSoft
Expect more victim claims; confirm the June Oracle patch is actually installed, not just filtered.
Sources
Join the discussion
Loading comments…