NetScaler zero-days actively exploited against government and finance
The story to lead with today is Citrix NetScaler. SecurityWeek and Help Net Security both report weeks-long zero-day attacks against government and finance organizations, tied to CVE-2026-88771 and CVE-2026-88772. Help Net Security attributes the activity to suspected state-sponsored actors and says exploitation of CVE-2026-88772 has been running since early September.
CVE-2026-88771, a Citrix NetScaler Application Delivery Controller flaw rated Critical severity with a CVSS of 9.8, is on the CISA Known Exploited Vulnerabilities list. That changes the timeline from patch eventually to patch now. If you run NetScaler ADC or Gateway as an internet-facing device, treat this as an active incident: apply the vendor fix, then hunt for signs of prior compromise, because the exploitation window predates the public disclosure.
KEV and the hot movers worth your attention
There were no new CISA KEV additions in the window since September 30, though CISA did add one known exploited vulnerability to the catalog on September 29 (G2). The ranked exploitation list is where the pressure is.
Two of the top movers are both KEV-listed and ransomware-linked, which puts them at the front of the queue. CVE-2026-63077, a JetBrains TeamCity deserialization flaw, is Critical severity at CVSS 9.8 with EPSS 0.8957. CVE-2026-41940 in WebPros cPanel and WHM is Critical at CVSS 9.8 with EPSS 0.9853 and a missing-authentication root cause. The older CVE-2024-27199 TeamCity path traversal is also KEV-listed and ransomware-linked with EPSS at 0.9999, so if you have not closed that one, it is overdue.
- CVE-2026-71362 Adobe Commerce and Magento, Critical, CVSS 9.1, KEV listed
- CVE-2026-87902 WordPress Core remote file inclusion, High, CVSS 8.1, KEV listed
- CVE-2026-5430 WSO2 path traversal, Critical, CVSS 10, KEV listed
- CVE-2026-65660 Microsoft SharePoint code injection, Critical, CVSS 9.3, KEV listed
What the press adds on identity and supply chain
Two reports hit close to home for Microsoft 365 teams. Cyber Security News describes attackers breaking into Microsoft 365 through forgotten accounts nobody was watching, and a separate piece on turning one compromised account into access to Azure DevOps and Kubernetes. Both come down to stale and over-privileged identities.
BleepingComputer reports that Microsoft will begin blocking Entra ID script injection attacks starting in October, which is worth noting in your change calendar. On the supply chain side, OpenInfra Europe's JFrog Artifactory instance was breached with packages potentially compromised (CVE-2026-82329), and OpenSSL fixed a High severity flaw that can leak server memory in plaintext (CVE-2026-84782). Octopus Server also patched an authenticated code execution flaw through insecure JSON deserialization (CVE-2026-101169).
Do this first
Work the exploited and ransomware-linked items in order, then clean up the identity gaps the press is highlighting.
- Patch NetScaler ADC and Gateway for CVE-2026-88771 and CVE-2026-88772 now, and hunt for compromise going back to early September.
- Close CVE-2026-63077 and CVE-2024-27199 on any TeamCity servers, and CVE-2026-41940 on cPanel and WHM hosts, since all are KEV listed and ransomware-linked.
- Audit Entra ID for forgotten, unmonitored, and over-privileged accounts before the Microsoft 365 account-abuse pattern reaches you, and confirm the October Entra ID script injection block will not break your flows.
- Patch OpenSSL for CVE-2026-84782 and review any JFrog Artifactory package sources after the OpenInfra breach.
Check your own exposure
Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by CISA KEV, EPSS, and ransomware linkage, which is the fastest way to confirm whether SharePoint CVE-2026-65660 or the October Windows cumulative updates like KB5046616 for Windows Server 2022 are still open in your estate. The non-Microsoft exploited-CVE tracker follows KEV additions daily for the NetScaler, TeamCity, and cPanel items above.
For the identity side, Senserva's Three Free Unlimited Audits let you run a complete check of your Microsoft 365, Intune, Defender, and Entra ID environment to surface the exact kind of stale and over-privileged accounts attackers used to reach Azure DevOps and Kubernetes.
Sources
- SecurityWeek: Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (2026-09-30)
- Help Net Security: Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) (2026-09-30)
- CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-29)
- Cyber Security News: Hackers Broke Into Microsoft 365 Through Forgotten Accounts Nobody Was Watching (2026-09-30)
- Cyber Security News: Hackers Turn One Compromised Account Into Access to Azure DevOps and Kubernetes (2026-09-30)
- BleepingComputer: Microsoft to block Entra ID script injection attacks starting October (2026-09-30)
- Help Net Security: OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised (2026-09-30)
- Cyber Security News: OpenSSL Fixes High-Severity Flaw That Can Leak Server Memory in Plaintext (2026-09-30)
- Cyber Security News: Octopus Server Flaw Lets Authenticated Users Execute Code Through Insecure JSON Deserialization (2026-09-30)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-02.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.