The week

Active NetScaler Zero‑Days Exploited

Unit 42 reports NetScaler zero-days actively exploited; patch now and monitor web shells.

Composed by SitRep’s AI editors from 4 sources — Unit 42, Mandiant Threat Intelligence, Exploitdb, Microsoft Secure

NetScaler Zero‑Days Actively Exploited

Unit 42 reports two NetScaler zero-days (CVE-2026-88771 RCE and CVE-2026-88772 memory overflow leading to RCE/DoS) are being actively exploited, with web shells and RC4 C2 deployed. As of Sept 27, 2026, 50,277 exposed NetScaler instances were identified across governments, finance, education, legal, and professional services.

Context

Edge appliances and unauthenticated internet‑facing apps are the accelerating entry points for initial access and persistence; Google/Mandiant analysis shows disclosures and exploit rates rising sharply, increasing likelihood of fast weaponization. Organizations with internet‑exposed appliances, unmanaged RMM, or public web applications face the largest blast radius because these vectors allow unauthenticated or low‑complexity RCE leading to long‑term access.

“The through‑line is rapid public weaponization of exposed services plus lateral persistence via abused RMM.”

The move

5 things to do today

Patch Citrix/NetScaler for CVE-2026-88771 and CVE-2026-88772 immediately; if patching is delayed, isolate management interfaces and apply ACLs to block internet access to NAS/ADC management.
Upgrade InvoicePlane to 1.7.2 to remediate CVE-2026-40297 and audit setup logs and token accesses for signs of config injection.
Remove or rotate default credentials for TigerGraph and restrict REST++ to trusted networks; hunt for EDB‑ID 52691 exploitation by checking /home/tigergraph/.ssh/authorized_keys and recent SSH key additions.
Upgrade WordPress to 7.1.2 or the 7.0.6 backport to close CVE-2026-87902, and scan webserver logs for unusual page‑template traversal requests and local file inclusion attempts.
Enforce RMM allowlists and elevate detection for MSP360/ScreenConnect binaries, monitor for unexpected UAC elevation events, and block unapproved installers at email and endpoint controls.

On the wire

P0Exploit

CVE-2026-88771 and CVE-2026-88772: NetScaler Active Exploitation

Unit 42 observed active exploitation delivering web shells and RC4 C2 against 50,277 exposed NetScaler instances; attacks used a three‑stage command injection chain. Patch NetScaler appliances immediately, remove internet exposure for management interfaces, apply network‑level ACLs, and hunt for web shell indicators and abnormal DTLS or RC4 outbound connections.

UNIT 42 · NetScaler Zero-Day Exploits CVE-2026-88771 and CVE-2026-88772

P1Exploit

TigerGraph Community Edition 4.2.4 Arbitrary File Write and SSH RCE (EDB‑ID 52691)

Exploit‑DB documents a multi‑stage chain using default tigergraph:tigergraph credentials and unauthenticated REST++ to write to /home/tigergraph/.ssh/authorized_keys enabling SSH RCE. Mitigate by removing/rotating default credentials, disabling or restricting REST++ to trusted networks, and detect unauthorized modifications to /home/tigergraph/.ssh/authorized_keys and unexpected SSH keys or sessions.

EXPLOITDB · TigerGraph_Community_Edition 4.2.4 Arbitrary File Write and SSH RCE

P1Exploit

InvoicePlane 1.7.1 Configuration Injection (CVE-2026-40297) Enables RCE

Exploit‑DB shows unsanitized db_hostname in setup allows arbitrary configuration injection and potential remote code execution; a patch is available in 1.7.2. Upgrade to 1.7.2 immediately, review setup logs for exploitation attempts, and isolate affected instances until patched.

EXPLOITDB · InvoicePlane 1.7.1 RCE via Configuration Injection (CVE-2026-40297) Critical

P2Exploit

WordPress 7.0.2 Path Traversal (CVE-2026-87902) Allows Local Include

Exploit‑DB provides a PoC for an unauthenticated path traversal that can cause local PHP inclusion and possible code execution; fixes are in 7.1.2 and backported to 7.0.6. Upgrade WordPress, scan web logs for unusual page‑template requests, and search file system for unexpected PHP file uploads or include attempts.

EXPLOITDB · WordPress 7.0.2 Path Traversal CVE-2026-87902 PoC Details Unauthenticated

P2Intelligence

Phishing Campaigns Abuse RMM to Establish Persistent Access

Microsoft observed phishing deploying a masqueraded MSP360 installer that establishes persistent access and launches ScreenConnect as a secondary channel, using UAC elevation and credential theft. Enforce allowlists for RMM tooling, block known malicious RMM installers, and detect atypical RMM process launches, UAC elevations, and remote session activity.

MICROSOFT SECURE · Phishing Abuses RMM Tools for Persistent Access

Indicators named in this edition

Kind	Value	Note
CVE	CVE-2026-88771	NetScaler RCE observed in active exploitation
CVE	CVE-2026-88772	NetScaler memory overflow leading to RCE/DoS on DTLS
EDB-ID	EDB-ID 52691	TigerGraph Community Edition arbitrary file write and SSH RCE
CVE	CVE-2026-40297	InvoicePlane configuration injection in setup module
CVE	CVE-2026-87902	WordPress 7.0.2 unauthenticated path traversal
CREDENTIAL	tigergraph:tigergraph	Default TigerGraph Community Edition credential used in exploit chain
PATH	/home/tigergraph/.ssh/authorized_keys	Target path for unauthorized SSH key insertion in TigerGraph exploit

End of the Saturday, October 3, 2026 weekend edition.