NetScaler zero-days exploited for weeks against government and finance
The lead story today is Citrix NetScaler. SecurityWeek and Help Net Security both report that suspected state-sponsored actors have been exploiting NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 since early September, in weeks-long campaigns aimed at government and finance organizations. Help Net Security focuses on CVE-2026-88772 and attributes the activity to state-sponsored hackers.
If you run NetScaler ADC or Gateway at your edge, treat this as active exploitation, not a theoretical risk. These are internet-facing appliances that broker access into the rest of your estate, which is exactly why this class of device keeps drawing targeted attackers. Prioritize vendor fixes for both CVE ids and hunt for signs of compromise, since the exploitation window predates public disclosure.
New CISA KEV add: Apple out-of-bounds write
CISA added one new Known Exploited Vulnerability on 2026-09-29 (advisory G2): CVE-2026-86950, an out-of-bounds write affecting multiple Apple products, with a CVSS of 8.8. It is not currently listed as ransomware-linked, but a KEV listing means it is being exploited in the wild. That moves it from patch eventually to patch now for any managed Macs, iPhones, and iPads in scope.
Push the Apple updates through your MDM. If you manage Apple devices alongside Windows, Senserva's non-Microsoft exploited-CVE tracker follows CISA KEV additions daily so you can confirm this one is on your remediation list.
Hot movers: cPanel, TeamCity, and Adobe Commerce
Among the highest-pressure KEV entries this cycle, two carry ransomware links. CVE-2026-41940, a missing-authentication flaw in WebPros cPanel and WHM (CVSS 9.8), sits at an EPSS of 0.9853 and is ransomware-linked. CVE-2026-63077, JetBrains TeamCity deserialization of untrusted data (CVSS 9.8, EPSS 0.8957), is also KEV-listed and ransomware-linked. TeamCity is a build server, so a compromise there reaches straight into your software supply chain.
CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento (CVSS 9.1, EPSS 0.8751), rounds out the top of the list and is KEV-listed. Two Check Point flaws (CVE-2026-93616 and CVE-2026-85102), a WordPress Core remote file inclusion (CVE-2026-87902), an F5 BIG-IP APM overflow (CVE-2026-94127), and an Arista VeloCloud Orchestrator flaw at CVSS 10 (CVE-2026-93952) are all KEV-listed as well.
Microsoft, Entra ID, and supply-chain notes from the press
On the Microsoft side, this cycle's cumulative updates carry heavy CVE counts and KEV-flagged content: KB5046616 for Windows Server 2022 ships 37 CVEs, KB5046617 for Windows 11 24H2 ARM64 ships 33, and KB5046615 for Windows 10 1809 ships 31, all rated Critical. Senserva's free Microsoft Patch Tracker ranks these open patches by KEV, EPSS, and ransomware linkage so you can see which to deploy first.
BleepingComputer reports Microsoft will begin blocking Entra ID script injection attacks starting in October, so review any tooling that injects scripts into Entra sign-in flows before it breaks. Two identity stories reinforce the theme: attackers broke into Microsoft 365 through forgotten, unwatched accounts (A6), and turned a single compromised account into access to Azure DevOps and Kubernetes (A5). Supply-chain risk shows up in the OpenInfra Europe JFrog Artifactory breach (CVE-2026-82329, A9), where packages may have been compromised.
Do this first
Grounded in today's facts, here is the short list.
- Patch or mitigate NetScaler for CVE-2026-88771 and CVE-2026-88772, and hunt back to early September for compromise.
- Update managed Apple devices for the new KEV entry CVE-2026-86950.
- Prioritize ransomware-linked KEV items: cPanel CVE-2026-41940 and TeamCity CVE-2026-63077.
- Deploy this cycle's Critical Windows cumulative updates (KB5046616, KB5046617, KB5046615, KB5046612).
- Audit Entra ID and Microsoft 365 for forgotten and unmonitored accounts before October's script-injection blocking takes effect.
Sources
- SecurityWeek: Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (2026-09-30)
- Help Net Security: Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) (2026-09-30)
- CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-29)
- BleepingComputer: Microsoft to block Entra ID script injection attacks starting October (2026-09-30)
- Cyber Security News: Hackers Broke Into Microsoft 365 Through Forgotten Accounts Nobody Was Watching (2026-09-30)
- Cyber Security News: Hackers Turn One Compromised Account Into Access to Azure DevOps and Kubernetes (2026-09-30)
- Help Net Security: OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised (2026-09-30)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-09-30.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.