NetScaler RCE zero-day exploited, Zammad flaws added to KEV

NetScaler RCE zero-day under active exploitation

The headline this weekend is a Citrix NetScaler remote code execution zero-day being exploited in the wild, called out in Help Net Security's week in review alongside CVE-2026-88771 and CVE-2026-88772. CVE-2026-88771 is a critical NetScaler Application Delivery Controller flaw carrying a CVSS of 9.8 and it is already on the CISA KEV list.

If you run NetScaler ADC in front of applications or as a gateway, treat this as patch now, not patch eventually. Dark Reading's writeup on the Kiteworks and Citrix incidents is a reminder of how messy zero-day response gets when the fix lands after exploitation is already happening. Confirm your appliance version, apply the vendor fix, and hunt for signs of compromise rather than assuming the update alone closes the door.

Two Zammad flaws added to the KEV catalog

On October 2, CISA added two Zammad vulnerabilities to the Known Exploited Vulnerabilities catalog. CVE-2026-102489 is a session fixation flaw and CVE-2026-102490 is an improper privilege management flaw, both rated CVSS 9.8. Neither is tagged ransomware-linked yet, but a KEV listing means confirmed exploitation, so federal timelines and anyone following KEV should move on these.

Zammad is a help desk and ticketing platform, so these often sit on internet-facing support portals. If you run one, patch to a fixed release and review accounts and sessions for abuse.

The exploitation picture: ransomware-linked movers

Several high-interest CVEs remain hot and most carry both KEV and ransomware links. JetBrains TeamCity CVE-2026-63077 (deserialization, CVSS 9.8, EPSS 0.90) and the older CVE-2024-27199 (path traversal, EPSS 0.9999) are both ransomware-associated. WebPros cPanel and WHM CVE-2026-41940 sits at CVSS 9.8 with EPSS 0.98, Palo Alto PAN-OS authentication bypass CVE-2026-0257 at 9.1, Meta React Server Components CVE-2025-55182 at a full 10.0, ConnectWise ScreenConnect CVE-2024-1708, and Oracle E-Business Suite CVE-2025-61882 all remain actively exploited and ransomware-linked. If any of these touch your estate, they belong at the top of the queue.

On the Microsoft side, the latest rollups are carrying a lot of weight. KB5046616 for Windows Server 2022 covers 34 CVEs, KB5046617 for Windows 11 24H2 ARM64 covers 33, and KB5046615 for Windows 10 1809 covers 28, all rated Critical and all flagged as containing KEV-listed fixes.

What the press adds

Warlock ransomware is expanding SharePoint exploitation against critical infrastructure in Portuguese and Spanish-speaking countries, hitting water and telecom operators according to SecurityWeek, The Record, and BleepingComputer. If you run on-premises SharePoint, revisit your patch state and look for the access patterns tied to this activity.

Separately, Microsoft's official X account was hijacked for a crypto pump-and-dump scheme, and Microsoft's 2026 Digital Defense Report warns that attackers are moving faster with AI than defenders. Also still fresh from October 2 is the Fortinet FortiMail zero-day CVE-2026-104286 exploited in the wild, which warrants urgent action if you run FortiMail.

Do this first

Prioritize by confirmed exploitation, not by raw CVSS alone.

• Patch Citrix NetScaler for CVE-2026-88771 and hunt for compromise on exposed appliances.
• Update Zammad for CVE-2026-102489 and CVE-2026-102490 and review sessions and accounts.
• Work the ransomware-linked KEV movers that apply to you: TeamCity, cPanel, PAN-OS, ScreenConnect, Oracle EBS.
• Apply the October Windows rollups (KB5046616, KB5046617, KB5046615, KB5046612) and verify coverage of KEV-listed fixes.
• Review on-premises SharePoint exposure given active Warlock ransomware activity.
• Use Senserva's free Microsoft Patch Tracker to rank your open patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft CVE tracker to follow KEV additions like the Zammad flaws.

Sources

• Help Net Security: Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited (2026-10-04)
• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-02)
• Dark Reading: Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response (2026-10-02)
• SecurityWeek: Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks (2026-10-02)
• The Record: 'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries (2026-10-02)
• BleepingComputer: Warlock ransomware breach SharePoint in water, telecom operator attacks (2026-10-02)
• Help Net Security: Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) (2026-10-02)
• BleepingComputer: Microsoft’s X account hacked in crypto pump-and-dump scheme (2026-10-02)
• Microsoft Security Blog: Insights from the 2026 Microsoft Digital Defense Report (2026-10-01)
• Help Net Security: AI is giving attackers a head start, Microsoft warns (2026-10-02)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-04.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.