Monday’s brief: NetScaler zero-days, then SharePoint’s deadline, Zimbra OnlyOffice, and a WSO2 JWT bypass

Published: 09/28/26

Monday opens on the edge device that survived the weekend: Citrix confirmed two NetScaler remote-code-execution bugs were exploited before Saturday’s patch, and one of them needs no special feature flag. Also on the desk — SharePoint’s federal KEV deadline is today, Zimbra’s OnlyOffice path can turn a public Briefcase link into a shell, and WSO2’s JWT bypass just missed its Sunday KEV due date.

Lead Story

NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

Citrix bulletin CTX697096 (September 27) fixes eight NetScaler issues. CVE-2026-88771 and CVE-2026-88772 are critical unauthenticated RCEs with confirmed exploitation; 88771 hits every ADC/Gateway in the default configuration. Fixed builds start at 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP matches). Preserve evidence, then patch — there is no workaround.

Why it matters: VPN and app delivery are the front door. Unauthenticated RCE there is a weekend problem that becomes Monday’s incident.

See the upgrade list →

Also Worth Your Attention

SharePoint KEV is due today — confirm the August builds

CVE-2026-65660 is authenticated code injection → RCE on SharePoint Server. Microsoft reports observed attacks; CISA’s due date is September 28. Confirm builds ≥ 16.0.5565.1001 (2016), 16.0.10417.20198 (2019), or 16.0.19725.20522 (Subscription Edition). Hunt ToolPane activity on late farms.

Why it matters: A webshell on the document farm is files, service accounts, and quiet persistence.

Check the build numbers →

Zimbra OnlyOffice: public Briefcase link → shell

CVE-2026-93643 lets an unauthenticated attacker abuse OnlyOffice save fields on a public Briefcase document to write files and run commands as zimbra. Fixed in ZCS 10.1.21. Until then, disable OnlyOffice or kill anonymous Briefcase shares.

Why it matters: Mail servers hold identity. “Easy sharing” should not equal remote code execution.

Patch or disable →

WSO2 JWT bypass missed Sunday’s KEV clock

CVE-2026-5430 (WSO2-2026-5328) lets attackers bypass JWT authentication with an unsupported signing algorithm across API Manager and Universal Gateway. CISA due date was September 27 — apply the update levels today and review admin JWT logins.

Why it matters: The gateway’s opinion of who you are is the whole security model for the APIs behind it.

Apply the update levels →

NetScaler to 14.1-73.37 / 13.1-64.23 today; SharePoint Aug builds (KEV due Mon); Zimbra 10.1.21 or kill OnlyOffice public shares; WSO2-2026-5328 on APIM/Gateway.

Go Deeper

Identity & access: IAM library · Tools & playbooks: Cybersecurity Tools · Subscribe: Daily Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].