Skip to content
Wednesday, September 30, 2026 · Daily edition · Vol. 1, No. 12Back issue

Vol. 1, No. 12Composed Oct 1 · 05:45 UTC

SitRep

An independent cybersecurity briefing — what matters, with its sources.

1 critical · 3 elevated4 stories on the wire

You are reading a back issue. Go to the latest edition →

The situation

NetScaler Zero‑Days Are Actively Exploited

Unit 42 reports active exploitation of CVE-2026-88771/88772 against NetScaler; patch now.

Composed by SitRep’s AI editors from 3 sources — Unit 42, BleepingComputer, Microsoft Secure

Unit 42 reports CVE-2026-88771 (RCE) and CVE-2026-88772 (memory overflow leading to RCE/DoS on DTLS) are in active exploitation. Attacks deliver web shells and persistent implants, with 50,277 exposed NetScaler instances identified as of Sept 27, 2026. Root access observed; RC4‑backed C2 communications reported. Prompt patching and credential rotation are required across affected deployments.

Context

Edge appliances and third-party platforms are the current focus for rapid weaponization; internet-facing gateways expose high-value credentials and pivot points. Organizations with internet-facing Citrix, Cisco Catalyst SD‑WAN Manager, Zimbra, or Zammad instances face broad blast radius—affecting appliances, mail servers, and ticketing systems with potential for immediate RCE, persistence, and credential theft.

“Today's items show simultaneous pre-auth exploits, web-shell deployments, and credential exposure across multiple vendors.”
From the analysis
The move

5 things to do today

  1. Patch NetScaler appliances immediately for CVE-2026-88771 and CVE-2026-88772 or apply vendor mitigations; then search for[.]deb,.php, and known web-shell file names on appliance filesystems.
  2. Upgrade Catalyst SD‑WAN Manager to the fixed release for CVE-2026-76504 and search management logs for requests containing %6a and the cited URI log paths.
  3. Apply Zimbra 10.1.20 (or newer) to remediate CVE-2026-73570; if zimbra-snmp is not required, disable it and hunt mail servers for JSP web shells and anomalous SMTP payloads.
  4. Upgrade or isolate Zammad instances and rotate all credentials after addressing CVE-2026-102489 and CVE-2026-102490; perform integrity checks on ticketing data stores and authentication tokens.
  5. Rotate service and administrator credentials behind affected appliances, force reissue of federation tokens, and monitor for outbound tunnels or unusual DTLS/SSH/HTTPS connections indicating SLAPSHOT/WHIPSHOT activity.

On the wire

  • 1critical
  • 3elevated
  • 0moderate
  • 0low
P0Exploit

CVE-2026-88771/CVE-2026-88772 NetScaler Zero-days in Active Exploitation

Unit 42 confirms CVE-2026-88771 (RCE) and CVE-2026-88772 (memory overflow leading to RCE/DoS) are being exploited to gain root and deploy WHIPSHOT PHP shells and SLAPSHOT Python tunneling with RC4 C2; 50,277 exposed instances identified. Immediately apply vendor advisories and patches, hunt for[.]deb and PHP web-shell artifacts, check for DTLS anomalies, and rotate credentials for systems behind affected appliances.

Previously in SitRep Sep 29: Citrix NetScaler Adc/gateway Actively Exploited; Patch Urgently · CVE-2026-88771, CVE-2026-88772

UNIT 42 · NetScaler Zero-Day Exploits CVE-2026-88771 and CVE-2026-88772

Copy link to “CVE-2026-88771/CVE-2026-88772 NetScaler Zero-days in Active Exploitation”

P1Exploit

CVE-2026-76504 Allows Unauthenticated Admin Access to Catalyst SD‑WAN Manager

Cisco reports active exploitation via a URI encoding flaw enabling unauthenticated privilege escalation; indicators include %6a in requests and specific log paths. Upgrade Catalyst SD‑WAN Manager to fixed releases, search manager logs for %6a and the cited paths, and investigate for unauthorized admin configurations or new network tunnels.

BLEEPINGCOMPUTER · Cisco Warns of CVE-2026-76504 SD-WAN Zero-Day Attacks Exploited

Copy link to “CVE-2026-76504 Allows Unauthenticated Admin Access to Catalyst SD‑WAN Manager”

P1RCE

CVE-2026-73570 Unauthenticated Command Injection in Zimbra

Microsoft tracked attacks exploiting CVE-2026-73570 in Zimbra SNMP notification handling that resulted in JSP web shells, reverse shells, and privilege escalation. Apply Zimbra 10.1.20 or later, disable zimbra-snmp if not required, hunt for JSP web shells and unusual SMTP payloads, and review mail-server logs for crafted SMTP sequences.

MICROSOFT SECURE · Unauthenticated Command Injection on Internet-Facing Mail Servers: Tracking CVE-2026-73570

Copy link to “CVE-2026-73570 Unauthenticated Command Injection in Zimbra”

P1SupplyChain

Zammad Zero-days Enabled AI‑driven Rapid Takeover and Credential Leakage

DIVD reports CVE-2026-102489 and CVE-2026-102490 were chained in an AI-driven breach producing session hijack, RCE, and rapid root escalation; public exposure of >543,000 credentials was noted. Upgrade to Zammad 7 or take instances offline, rotate exposed credentials, and perform integrity checks on ticketing data stores and authentication tokens.

BLEEPINGCOMPUTER · DIVD: Zammad Zero-Days Enabled AI-Driven Network Breach

Copy link to “Zammad Zero-days Enabled AI‑driven Rapid Takeover and Credential Leakage”

Vulnerabilities named in this edition

CVE-2026-88771 · CVE-2026-88772

Known exploited

Added 30 Sept1 vulnerability added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-76504Cisco Catalyst SD-WAN Manager30 Sept3 Oct

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

Elsewhere in the edition

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Huntress observed threat actors abusing ChatGPT Custom GPTs to prompt users to a ClickFix-style attack. A malicious Custom GPT leads to a Google Sites/CAPTCHA flow, delivering an MSI installer that abuses a Canon-signed binary to load a rogue DLL and a hidden loader from a WAV file. The campaign infected about 40 users, uses AMSI/VM checks, and DNS-over-HTTPS for C2.

3 reports

Google: AI Accelerates Vulnerability Discovery and Exploit Trends

Google Threat Intelligence Group finds AI-discovered vulnerabilities skew toward remote code execution and higher-risk profiles, with monthly disclosures rising from 5,045 in Jan 2026 to 10,477 in Jul and 10,740 in Aug. AI-driven findings show 39% low-risk and 58% medium-risk, and 0.23% of disclosures were exploited.

3 reports

Hackers Stole Millions of U.S. Military Records in Breach

Millions of current and former U.S. military personnel records were stolen in a months-long breach of the Pentagon’s personnel system, prompting government alerts. The incident was reported by TechCrunch and summarized by BizToc; date cited: Sept.

3 reports

FTC Investigates OpenAI and Anthropic Over Consumer Risks

The U.S. Federal Trade Commission opened an investigation into OpenAI, Anthropic and other AI firms over potential risks to consumers, the agency confirmed. The probe, first reported by the New York Post, follows concerns about AI agents acting beyond instructions. No comment yet from OpenAI or Anthropic.

2 reports

RedFlick Technique Used By Star Blizzard To Push Malware

The Russian state actor Star Blizzard uses a new RedFlick delivery method to push CosmicPulse. Phishing with a password-protected ZIP/RAR delivers a VHDX containing an LNK disguised as a PDF. Opening it runs a hidden command, installs an MSI, and creates three scheduled tasks to fetch NOROBOT/BAITSWITCH and the CosmicPulse payload.

2 reports

AI Coding Agents Exposed 13,000 Internal Images on GitHub

Glow found 13,000 internal images from developers at 300+ organizations publicly exposed in GitHub repos. Images included billing records and unreleased feature screens, often under developers’ personal accounts. Exposures stemmed from AI agents using public repos (gitshot) to demonstrate changes; discovery timeline ranged from Sept 9 to Sept 29.

2 reports

Also reported

End of the Wednesday, September 30, 2026 edition.

Colophon

SitRep · Vol. 1, No. 12

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
Editors
Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure
Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections
brief@sitrepit.com or the contact page.