Weekly Threat Intelligence Brief — 3 October 2026

EDGE / ACTIVE EXPLOITATION

27 September · updated 2 October

Citrix NetScaler: preserve evidence while closing exposure

CISA's NetScaler alert describes eight disclosed vulnerabilities, but specifically confirms active global exploitation of CVE-2026-88771 and CVE-2026-88772. Each can independently enable remote code execution. The 2 October update adds a SIGMA-rule resource. Do not describe all eight as confirmed exploited.

• Identify affected ADC and Gateway instances and consult Citrix's bulletin for the exact configurations and fixed releases.
• Where feasible, check for compromise and preserve logs before updating; coordinate urgent remediation with the incident-response owner so evidence collection does not become an indefinite delay.
• Review CISA's linked SIGMA repository and validate rule applicability against your actual log sources. Patching alone is not proof that an earlier compromise has been removed.

NETWORK MANAGEMENT

30 September

Cisco SD-WAN Manager: treat the control plane as a priority

CISA added the Cisco Catalyst SD-WAN Manager hex-encoding vulnerability to KEV based on evidence of active exploitation. The alert establishes exploitation evidence; it does not quantify victim counts or provide the affected-version matrix.

• Match installed versions and exposure to Cisco's current advisory; restrict management access to approved administrative networks.
• Review administrative/API access, unexpected configuration changes and newly created accounts. Missing control-plane logs are a visibility gap, not a clean bill of health.

ENDPOINT UPDATE COVERAGE

29 September

Apple: verify installation, not only update availability

CISA added an out-of-bounds write vulnerability affecting multiple Apple products to KEV. The reviewed alert does not establish a specific attack campaign, affected device population or QMasters customer impact.

• Use Apple's current security-release guidance to identify affected products and approved updates. Confirm installed versions through device-management inventory.
• Include remote users and unmanaged devices that access company data. Record update exceptions with an owner and a deadline.

MAIL INFRASTRUCTURE

1 October

FortiMail: investigate access as well as patch status

CISA added a Fortinet FortiMail path-traversal vulnerability to KEV based on evidence of active exploitation. The alert alone does not prove a mail-data breach or identify a specific malicious actor.

• Check Fortinet's advisory for affected versions and remediation. Reduce unnecessary exposure of administrative interfaces.
• Preserve available appliance and authentication logs. Investigate unusual access and configuration changes without treating a lack of alerts as proof of absence.

SUPPORT PLATFORM / IDENTITY

2 October

Zammad: review sessions and privilege changes

CISA added two Zammad vulnerabilities to KEV: session fixation and improper privilege management. Their listing is evidence of exploitation; it does not establish that they were chained in every incident.

• Confirm affected versions and the vendor's session-remediation guidance before changing authentication settings or invalidating sessions.
• Review agent/admin role changes, suspicious session reuse and ticket access outside normal duties. Support tickets may contain sensitive operational information.