Citrix NetScaler ADC and Gateway need patching now
Citrix is urging NetScaler ADC and Gateway customers to patch a new critical remote code execution vulnerability, tracked as CVE-2026-107406. Both Cyber Security News and SecurityWeek flagged it on October 9, and SecurityWeek frames it as immediate action, not something to schedule for next cycle. NetScaler appliances sit on the network edge and front access to internal apps, which is exactly where attackers like to land. If you run these devices, treat this as the top item of the day and apply the fix before anything else on this list.
Also on the exploitation front, BleepingComputer reports the max severity SonicWall SMA1000 flaw, CVE-2026-102255, is now being exploited in attacks, and SecurityWeek reports unpatched AhsayCBS vulnerabilities, CVE-2026-105133 and CVE-2026-105134, are being hit in the wild. Both are edge and backup products with the same exposure profile as the NetScaler gear.
Five new CISA KEV additions, some from 2015
CISA added five CVEs to the Known Exploited Vulnerabilities catalog on October 8. KEV listing means confirmed exploitation, so these move from patch eventually to patch now:
- CVE-2015-3306, ProFTPD improper access control, CVSS 10, with an EPSS score of 0.9675
- CVE-2016-3081, Apache Struts command injection, CVSS 8.1
- CVE-2015-5477, ISC BIND data processing errors, CVSS 7.5
- CVE-2021-3199, ONLYOFFICE Docs server path traversal, CVSS 9.8
- CVE-2023-22894, Strapi cleartext storage of sensitive information, CVSS 4.9
What is moving on the exploitation charts
The newly added ProFTPD, Struts, and BIND flaws also top the hot CVE rankings this morning, driven by high EPSS scores and fresh KEV status. Two ransomware-linked entries sit just below them and deserve attention if they apply to you: CVE-2026-63077, a JetBrains TeamCity deserialization flaw at CVSS 9.8, and CVE-2026-41940, a WebPros cPanel and WHM missing authentication flaw at CVSS 9.8 with an EPSS of 0.9853. Both are KEV listed and tied to ransomware.
Two Zammad vulnerabilities, CVE-2026-102489 and CVE-2026-102490, are also on the KEV list. Cyber Security News published a proof of concept for the Zammad session leak flaw, CVE-2026-102489, on October 8, so expect broader probing. Proof of concept code also dropped for a Telegram Desktop one-click takeover flaw, CVE-2026-107181, and the LMCache unauthenticated RCE, CVE-2026-105192.
What the press and advisories add
Help Net Security posted its October 2026 Patch Tuesday forecast, pointing to an Office cleanup and naming CVE-2026-85880 and CVE-2026-81963. Separately, Help Net flagged a high severity NVIDIA DCGM exporter flaw, CVE-2026-47483, that lets unauthenticated attackers crash GPU monitoring. BleepingComputer reports Microsoft will stop delivering security updates to outdated Windows devices next year, which is worth checking against your estate now.
CISA and the UK NCSC, alongside international partners, called out Chinese government-linked actors combining automated and hands-on tools to steal sensitive data. CISA also issued ICS advisories for Red Lion Controls N-Tron 700 Series, Grid Protection Alliance openPDC and openHistorian, and Satel. On the Windows side, the monthly cumulative updates KB5046617 for Windows 11 24H2 and KB5046616 for Windows Server 2022 carry 33 and 37 CVEs respectively and are marked critical with KEV content.
Do this first
Work in order of exploitation evidence, not CVSS alone.
- Patch NetScaler ADC and Gateway for CVE-2026-107406 today, then check SonicWall SMA1000 and AhsayCBS exposure.
- Clear the five new KEV adds, starting with the ProFTPD CVSS 10 flaw and the Struts and BIND entries.
- Prioritize the ransomware-linked TeamCity CVE-2026-63077 and cPanel CVE-2026-41940 if those products are in scope.
- Confirm this month's Windows cumulative updates are deployed across the estate.
- Senserva's free Microsoft Patch Tracker ranks your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker follows KEV additions daily so you can confirm your own state against the five adds above.
Sources
- Cyber Security News: Citrix Urges NetScaler ADC and Gateway Customers to Patch for New Critical RCE Vulnerability (2026-10-09)
- SecurityWeek: Citrix Urges Immediate Patching of Critical NetScaler Vulnerability (2026-10-09)
- SecurityWeek: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (2026-10-09)
- Help Net Security: October 2026 Patch Tuesday forecast: Time for an Office cleanup (2026-10-09)
- Help Net Security: High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring (2026-10-09)
- BleepingComputer: Microsoft: Outdated Windows devices will stop receiving security updates (2026-10-09)
- BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks (2026-10-09)
- Cyber Security News: PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution (2026-10-08)
- CISA Cybersecurity Advisories: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (2026-10-08)
- NCSC: China-linked malicious actors called out by UK and international partners for targeting sensitive data globally (2026-10-08)
- CISA Cybersecurity Advisories: Red Lion Controls N-Tron 700 Series (2026-10-08)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-09.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.