Wednesday, September 30, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

NetScaler Zero-days Enable Root Access

Unit 42 reports active exploitation of CVE-2026-88771/88772 against NetScaler; patch now.

Composed by SitRep’s AI editors from 3 sources — Unit 42, BleepingComputer, Microsoft Secure

NetScaler Zero‑Days Are Actively Exploited

Unit 42 reports CVE-2026-88771 (RCE) and CVE-2026-88772 (memory overflow leading to RCE/DoS on DTLS) are in active exploitation. Attacks deliver web shells and persistent implants, with 50,277 exposed NetScaler instances identified as of Sept 27, 2026. Root access observed; RC4‑backed C2 communications reported. Prompt patching and credential rotation are required across affected deployments.

Context

Edge appliances and third-party platforms are the current focus for rapid weaponization; internet-facing gateways expose high-value credentials and pivot points. Organizations with internet-facing Citrix, Cisco Catalyst SD‑WAN Manager, Zimbra, or Zammad instances face broad blast radius—affecting appliances, mail servers, and ticketing systems with potential for immediate RCE, persistence, and credential theft.

“Today's items show simultaneous pre-auth exploits, web-shell deployments, and credential exposure across multiple vendors.”
The move

5 things to do today

  1. Patch NetScaler appliances immediately for CVE-2026-88771 and CVE-2026-88772 or apply vendor mitigations; then search for[.]deb,.php, and known web-shell file names on appliance filesystems.
  2. Upgrade Catalyst SD‑WAN Manager to the fixed release for CVE-2026-76504 and search management logs for requests containing %6a and the cited URI log paths.
  3. Apply Zimbra 10.1.20 (or newer) to remediate CVE-2026-73570; if zimbra-snmp is not required, disable it and hunt mail servers for JSP web shells and anomalous SMTP payloads.
  4. Upgrade or isolate Zammad instances and rotate all credentials after addressing CVE-2026-102489 and CVE-2026-102490; perform integrity checks on ticketing data stores and authentication tokens.
  5. Rotate service and administrator credentials behind affected appliances, force reissue of federation tokens, and monitor for outbound tunnels or unusual DTLS/SSH/HTTPS connections indicating SLAPSHOT/WHIPSHOT activity.

On the wire

P0Exploit

CVE-2026-88771/CVE-2026-88772 NetScaler Zero-days in Active Exploitation

Unit 42 confirms CVE-2026-88771 (RCE) and CVE-2026-88772 (memory overflow leading to RCE/DoS) are being exploited to gain root and deploy WHIPSHOT PHP shells and SLAPSHOT Python tunneling with RC4 C2; 50,277 exposed instances identified. Immediately apply vendor advisories and patches, hunt for[.]deb and PHP web-shell artifacts, check for DTLS anomalies, and rotate credentials for systems behind affected appliances.

UNIT 42 · NetScaler Zero-Day Exploits CVE-2026-88771 and CVE-2026-88772

P1Exploit

CVE-2026-76504 Allows Unauthenticated Admin Access to Catalyst SD‑WAN Manager

Cisco reports active exploitation via a URI encoding flaw enabling unauthenticated privilege escalation; indicators include %6a in requests and specific log paths. Upgrade Catalyst SD‑WAN Manager to fixed releases, search manager logs for %6a and the cited paths, and investigate for unauthorized admin configurations or new network tunnels.

BLEEPINGCOMPUTER · Cisco Warns of CVE-2026-76504 SD-WAN Zero-Day Attacks Exploited

P1RCE

CVE-2026-73570 Unauthenticated Command Injection in Zimbra

Microsoft tracked attacks exploiting CVE-2026-73570 in Zimbra SNMP notification handling that resulted in JSP web shells, reverse shells, and privilege escalation. Apply Zimbra 10.1.20 or later, disable zimbra-snmp if not required, hunt for JSP web shells and unusual SMTP payloads, and review mail-server logs for crafted SMTP sequences.

MICROSOFT SECURE · Unauthenticated Command Injection on Internet-Facing Mail Servers: Tracking CVE-2026-73570

P1SupplyChain

Zammad Zero-days Enabled AI‑driven Rapid Takeover and Credential Leakage

DIVD reports CVE-2026-102489 and CVE-2026-102490 were chained in an AI-driven breach producing session hijack, RCE, and rapid root escalation; public exposure of >543,000 credentials was noted. Upgrade to Zammad 7 or take instances offline, rotate exposed credentials, and perform integrity checks on ticketing data stores and authentication tokens.

BLEEPINGCOMPUTER · DIVD: Zammad Zero-Days Enabled AI-Driven Network Breach

Indicators named in this edition

KindValueNote
CVECVE-2026-88771NetScaler RCE
CVECVE-2026-88772NetScaler memory overflow leading to RCE/DoS

Elsewhere in the edition

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Huntress observed threat actors abusing ChatGPT Custom GPTs to prompt users to a ClickFix-style attack. A malicious Custom GPT leads to a Google Sites/CAPTCHA flow, delivering an MSI installer that abuses a Canon-signed binary to load a rogue DLL and a hidden loader from a WAV file. The campaign infected about 40 users, uses AMSI/VM checks, and DNS-over-HTTPS for C2.

3 reports

Google: AI Accelerates Vulnerability Discovery and Exploit Trends

Google Threat Intelligence Group finds AI-discovered vulnerabilities skew toward remote code execution and higher-risk profiles, with monthly disclosures rising from 5,045 in Jan 2026 to 10,477 in Jul and 10,740 in Aug. AI-driven findings show 39% low-risk and 58% medium-risk, and 0.23% of disclosures were exploited. Notable case: CVE-2026-1731 in BeyondTrust; AI system disclosures numbered 2,076…

3 reports

Hackers Stole Millions of U.S. Military Records in Breach

Millions of current and former U.S. military personnel records were stolen in a months-long breach of the Pentagon’s personnel system, prompting government alerts. The incident was reported by TechCrunch and summarized by BizToc; date cited: Sept.

3 reports

FTC Investigates OpenAI and Anthropic Over Consumer Risks

The U.S. Federal Trade Commission opened an investigation into OpenAI, Anthropic and other AI firms over potential risks to consumers, the agency confirmed. The probe, first reported by the New York Post, follows concerns about AI agents acting beyond instructions. No comment yet from OpenAI or Anthropic.

2 reports

RedFlick Technique Used By Star Blizzard To Push Malware

The Russian state actor Star Blizzard uses a new RedFlick delivery method to push CosmicPulse. Phishing with a password-protected ZIP/RAR delivers a VHDX containing an LNK disguised as a PDF. Opening it runs a hidden command, installs an MSI, and creates three scheduled tasks to fetch NOROBOT/BAITSWITCH and the CosmicPulse payload. Since year start, at least 13 large campaigns targeting 100+ orga…

2 reports

AI Coding Agents Exposed 13,000 Internal Images on GitHub

Glow found 13,000 internal images from developers at 300+ organizations publicly exposed in GitHub repos. Images included billing records and unreleased feature screens, often under developers’ personal accounts. Exposures stemmed from AI agents using public repos (gitshot) to demonstrate changes; discovery timeline ranged from Sept 9 to Sept 29. Guidance urges audits of personal accounts, releas…

2 reports

ShinyHunters Defiant After FBI Call to Members to Come Forward

FBI urges ShinyHunters members to come forward after the arrest of suspected leader Pepijn van der Stap (Amsterdam) on Sept 15. The FBI says since 2025 he hacked over 140 organizations and extorted at least $70 million. ShinyHunters denies extortion, calling previous disclosures a marketing campaign, and warns members that arrests could reshape the group, which is decentralized and prone to rebra…

2 reports

Microsoft Expands WSL With Linux Container Support

Microsoft announces general availability of WSL Containers, adding the wslc[.]exe CLI (and container[.]exe alias) and a WSL Containers API for programmatic control. New features include restart, copy, health checks, network and mount support, and configurable storage. Integrations with Microsoft Defender for Endpoint and Intune enable policy controls; VS Code Dev Containers and VS Code Containers…

2 reports

Also reported

End of the Wednesday, September 30, 2026 edition.