You are reading a back issue. Go to the latest edition →

The week

NetScaler Zero‑Days Actively Exploited

Unit 42 reports NetScaler zero-days actively exploited; patch now and monitor web shells.

Composed by SitRep’s AI editors from 4 sources — Unit 42, Mandiant Threat Intelligence, Exploitdb, Microsoft Secure

Unit 42 reports two NetScaler zero-days (CVE-2026-88771 RCE and CVE-2026-88772 memory overflow leading to RCE/DoS) are being actively exploited, with web shells and RC4 C2 deployed. As of Sept 27, 2026, 50,277 exposed NetScaler instances were identified across governments, finance, education, legal, and professional services.

Context

Edge appliances and unauthenticated internet‑facing apps are the accelerating entry points for initial access and persistence; Google/Mandiant analysis shows disclosures and exploit rates rising sharply, increasing likelihood of fast weaponization. Organizations with internet‑exposed appliances, unmanaged RMM, or public web applications face the largest blast radius because these vectors allow unauthenticated or low‑complexity RCE leading to long‑term access.

“The through‑line is rapid public weaponization of exposed services plus lateral persistence via abused RMM.”

From the analysis

Analysis

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Adversaries are combining mass exploitation of edge appliances with unauthenticated RCEs and abuse of legitimate remote‑management tooling to gain and maintain access.

Unit 42 · Exploitdb · Microsoft Secure

Contrarian view

SitRep’s judgement from the cited reporting, not reported fact. Written by AI.

Edge Patching Only Is the Wrong Read

Most teams will treat this as 'edge appliance patching only'. That is the wrong read because unauthenticated RCEs and abuse of legitimate RMM create identity, telemetry, and segmentation priorities beyond simple appliance patching.

Unit 42 · Exploitdb · Microsoft Secure

Anyone with the link reads the whole edition, free. The link says nothing about you.

Email it

The move

5 things to do today

Patch Citrix/NetScaler for CVE-2026-88771 and CVE-2026-88772 immediately; if patching is delayed, isolate management interfaces and apply ACLs to block internet access to NAS/ADC management.
Upgrade InvoicePlane to 1.7.2 to remediate CVE-2026-40297 and audit setup logs and token accesses for signs of config injection.
Remove or rotate default credentials for TigerGraph and restrict REST++ to trusted networks; hunt for EDB‑ID 52691 exploitation by checking /home/tigergraph/.ssh/authorized_keys and recent SSH key additions.
Upgrade WordPress to 7.1.2 or the 7.0.6 backport to close CVE-2026-87902, and scan webserver logs for unusual page‑template traversal requests and local file inclusion attempts.
Enforce RMM allowlists and elevate detection for MSP360/ScreenConnect binaries, monitor for unexpected UAC elevation events, and block unapproved installers at email and endpoint controls.

On the wire

1critical
2elevated
2moderate
0low

P0Exploit

CVE-2026-88771 and CVE-2026-88772: NetScaler Active Exploitation

Unit 42 observed active exploitation delivering web shells and RC4 C2 against 50,277 exposed NetScaler instances; attacks used a three‑stage command injection chain. Patch NetScaler appliances immediately, remove internet exposure for management interfaces, apply network‑level ACLs, and hunt for web shell indicators and abnormal DTLS or RC4 outbound connections.

Previously in SitRep Oct 1: Citrix NetScaler CVE-2026-88771/88772 Exploited at Scale; Upgrade Now · CVE-2026-88771, CVE-2026-88772

UNIT 42 · NetScaler Zero-Day Exploits CVE-2026-88771 and CVE-2026-88772

Copy link to “CVE-2026-88771 and CVE-2026-88772: NetScaler Active Exploitation”

P1Exploit

TigerGraph Community Edition 4.2.4 Arbitrary File Write and SSH RCE (EDB‑ID 52691)

Exploit‑DB documents a multi‑stage chain using default tigergraph:tigergraph credentials and unauthenticated REST++ to write to /home/tigergraph/.ssh/authorized_keys enabling SSH RCE. Mitigate by removing/rotating default credentials, disabling or restricting REST++ to trusted networks, and detect unauthorized modifications to /home/tigergraph/.ssh/authorized_keys and unexpected SSH keys or sessions.

EXPLOITDB · TigerGraph_Community_Edition 4.2.4 Arbitrary File Write and SSH RCE

Copy link to “TigerGraph Community Edition 4.2.4 Arbitrary File Write and SSH RCE (EDB‑ID 52691)”

P1Exploit

InvoicePlane 1.7.1 Configuration Injection (CVE-2026-40297) Enables RCE

Exploit‑DB shows unsanitized db_hostname in setup allows arbitrary configuration injection and potential remote code execution; a patch is available in 1.7.2. Upgrade to 1.7.2 immediately, review setup logs for exploitation attempts, and isolate affected instances until patched.

EXPLOITDB · InvoicePlane 1.7.1 RCE via Configuration Injection (CVE-2026-40297) Critical

Copy link to “InvoicePlane 1.7.1 Configuration Injection (CVE-2026-40297) Enables RCE”

P2Exploit

WordPress 7.0.2 Path Traversal (CVE-2026-87902) Allows Local Include

Exploit‑DB provides a PoC for an unauthenticated path traversal that can cause local PHP inclusion and possible code execution; fixes are in 7.1.2 and backported to 7.0.6. Upgrade WordPress, scan web logs for unusual page‑template requests, and search file system for unexpected PHP file uploads or include attempts.

Previously in SitRep Sep 25: Active Exploitation: Roundcube CVE-2026-48842 and WordPress CVE-2026-87902

EXPLOITDB · WordPress 7.0.2 Path Traversal CVE-2026-87902 PoC Details Unauthenticated

Copy link to “WordPress 7.0.2 Path Traversal (CVE-2026-87902) Allows Local Include”

P2Intelligence

Phishing Campaigns Abuse RMM to Establish Persistent Access

Microsoft observed phishing deploying a masqueraded MSP360 installer that establishes persistent access and launches ScreenConnect as a secondary channel, using UAC elevation and credential theft. Enforce allowlists for RMM tooling, block known malicious RMM installers, and detect atypical RMM process launches, UAC elevations, and remote session activity.

MICROSOFT SECURE · Phishing Abuses RMM Tools for Persistent Access

Copy link to “Phishing Campaigns Abuse RMM to Establish Persistent Access”

Indicators named in this edition

Vulnerabilities named CVE-2026-88771 · CVE-2026-88772 · CVE-2026-40297 · CVE-2026-87902

Kind	Value	Note
FILE PATH	/home/tigergraph/.ssh/authorized_keys	Target path for unauthorized SSH key insertion in TigerGraph exploit

Known exploited

Added 26 Sept – 2 Oct7 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVE	Vendor and product	Added	Due
CVE-2026-102489	Zammad GmbH Zammad	2 Oct	5 Oct
CVE-2026-102490	Zammad GmbH Zammad	2 Oct	5 Oct
CVE-2026-104286	Fortinet FortiMail	1 Oct	4 Oct
CVE-2026-76504	Cisco Catalyst SD-WAN Manager	30 Sept	3 Oct
CVE-2026-86950	Apple Multiple Products	29 Sept	13 Oct
CVE-2026-88771	Citrix NetScaler	27 Sept	30 Sept
CVE-2026-88772	Citrix NetScaler	27 Sept	30 Sept

Source: CISA KEV catalogue, version 2026.10.21 (released 21 Oct 2026; read by SitRep 23 Oct 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

The full catalogue at cisa.gov

End of the Saturday, October 3, 2026 weekend edition.

Read the whole paper free, by email each morning. Get the brief →

Colophon

SitRep · Vol. 1, No. 15

Publisher: Published and funded by its independent maintainer. No advertising or sponsors.
Editors: Curator, Writer, Editor and IOC Sanitizer — four AI agents.
AI disclosure: Each edition is selected, written, edited and sanitized by four AI agents (Curator, Writer, Editor, IOC Sanitizer). The maintainer builds and oversees the pipeline; editions are not reviewed by a person before they are published.
Corrections: brief@sitrepit.com or the contact page.