Published: 09/28/26
Monday opens on the edge device that survived the weekend: Citrix confirmed two NetScaler remote-code-execution bugs were exploited before Saturday’s patch, and one of them needs no special feature flag. Also on the desk — SharePoint’s federal KEV deadline is today, Zimbra’s OnlyOffice path can turn a public Briefcase link into a shell, and WSO2’s JWT bypass just missed its Sunday KEV due date.
Lead Story
NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today
Citrix bulletin CTX697096 (September 27) fixes eight NetScaler issues. CVE-2026-88771 and CVE-2026-88772 are critical unauthenticated RCEs with confirmed exploitation; 88771 hits every ADC/Gateway in the default configuration. Fixed builds start at 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP matches). Preserve evidence, then patch — there is no workaround.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: VPN and app delivery are the front door. Unauthenticated RCE there is a weekend problem that becomes Monday’s incident.
Also Worth Your Attention
SharePoint KEV is due today — confirm the August builds
CVE-2026-65660 is authenticated code injection → RCE on SharePoint Server. Microsoft reports observed attacks; CISA’s due date is September 28. Confirm builds ≥ 16.0.5565.1001 (2016), 16.0.10417.20198 (2019), or 16.0.19725.20522 (Subscription Edition). Hunt ToolPane activity on late farms.
Why it matters: A webshell on the document farm is files, service accounts, and quiet persistence.
Zimbra OnlyOffice: public Briefcase link → shell
CVE-2026-93643 lets an unauthenticated attacker abuse OnlyOffice save fields on a public Briefcase document to write files and run commands as zimbra. Fixed in ZCS 10.1.21. Until then, disable OnlyOffice or kill anonymous Briefcase shares.
Why it matters: Mail servers hold identity. “Easy sharing” should not equal remote code execution.
WSO2 JWT bypass missed Sunday’s KEV clock
CVE-2026-5430 (WSO2-2026-5328) lets attackers bypass JWT authentication with an unsupported signing algorithm across API Manager and Universal Gateway. CISA due date was September 27 — apply the update levels today and review admin JWT logins.
Why it matters: The gateway’s opinion of who you are is the whole security model for the APIs behind it.
NetScaler to 14.1-73.37 / 13.1-64.23 today; SharePoint Aug builds (KEV due Mon); Zimbra 10.1.21 or kill OnlyOffice public shares; WSO2-2026-5328 on APIM/Gateway.
Go Deeper
Identity & access: IAM library · Tools & playbooks: Cybersecurity Tools · Subscribe: Daily Brief
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
