Weekly Exploit Roundup

Generated 2026-10-06T08:00:12.049994+00:00 (UTC)

1. Citrix patches NetScaler SAML zero-day exploited in attacks
   Source: BleepingComputer | Published: 2026-10-04T21:58:01+00:00 | Score: 23.487
   Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. […]
2. New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
   Source: The Hacker News | Published: 2026-10-05T06:40:19+00:00 | Score: 20.846
   Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks.

   The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0.

   "CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to

3. Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
   Source: SecurityWeek | Published: 2026-10-05T05:14:48+00:00 | Score: 20.204
   Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched. The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek .
4. Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)
   Source: Rapid7 Cybersecurity Blog | Published: 2026-09-30T15:09:22+00:00 | Score: 19.927
   Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504 , a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding ( CWE-177 ). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user. According to Cisco, CVE-2026-76504 is being actively exploited in the wild; Cisco PSIRT became aware of the activity in September 2026. Cisco Catalyst SD-WAN Manager systems with ports exposed to the internet are at risk of compromise. The vulnerability affects the product regardless of system configuration, and Cisco has not provided a workaround, however vendor supplied updates are available. Rapid7 strongly recommends that organizations upgrade affected systems to a fixed release on an emergency basis,
5. Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
   Source: The Hacker News | Published: 2026-10-05T08:09:23+00:00 | Score: 19.89
   A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck.

   The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and

6. Rejetto HFS servers now actively scanned for critical RCE flaw
   Source: BleepingComputer | Published: 2026-10-05T20:20:05+00:00 | Score: 19.853
   Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). […]
7. Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
   Source: The Hacker News | Published: 2026-09-30T05:30:30+00:00 | Score: 19.24
   Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild.

   The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler

8. CISA Adds One Known Exploited Vulnerability to Catalog
   Source: Alerts | Published: 2026-10-04T12:00:00+00:00 | Score: 18.69
   CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establish
9. Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
   Source: The Hacker News | Published: 2026-10-02T05:49:50+00:00 | Score: 18.678
   The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.

   The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.

   "An improper

10. Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
    Source: SecurityWeek | Published: 2026-10-05T11:00:05+00:00 | Score: 17.375
    CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE. The post Exploitation Hits Rejetto HFS Vulnerability Discovered by AI appeared first on SecurityWeek .

End of report.