Citrix NetScaler RCE and five new CISA KEV adds

Citrix NetScaler ADC and Gateway need patching now

The top item today is a new critical remote code execution flaw in Citrix NetScaler ADC and Gateway, tracked as CVE-2026-107406. Both Cyber Security News and SecurityWeek report Citrix is urging customers to patch immediately. NetScaler appliances sit at the network edge and front remote access, which is exactly the kind of target that gets hit fast once a critical RCE is public. If you run NetScaler ADC or Gateway, treat this as drop-everything work and confirm your build is on a fixed version.

Two other edge products are already being exploited. BleepingComputer reports the maximum severity SonicWall SMA1000 flaw CVE-2026-102255 is now used in attacks, and both SecurityWeek and BleepingComputer confirm unpatched AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134) are being exploited in the wild to deploy webshells and mine cryptocurrency.

Five new CISA KEV additions on October 8

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-10-08. These are older bugs with confirmed exploitation, so the instruction is plain: patch now, not eventually.

The standout is CVE-2015-3306, an improper access control flaw in ProFTPD carrying a perfect CVSS of 10 and an EPSS score near 0.98, the hottest mover on the board. The others are CVE-2016-3081 (Apache Struts command injection), CVE-2015-5477 (ISC BIND data processing errors), CVE-2021-3199 (ONLYOFFICE Docs path traversal, CVSS 9.8), and CVE-2023-22894 (Strapi cleartext storage of sensitive information). None are ransomware-linked, but KEV listing means attackers are using them today.

Ransomware-linked and high-buzz CVEs to watch

Two ransomware-linked KEV entries remain high on the exploitation ranking: CVE-2026-63077 in JetBrains TeamCity (deserialization of untrusted data, CVSS 9.8) and CVE-2026-41940 in WebPros cPanel and WHM (missing authentication, CVSS 9.8, EPSS near 0.99). If either runs in your build pipeline or hosting stack, prioritize them alongside the NetScaler fix.

Proof-of-concept code is circulating for several flaws. Cyber Security News reports PoCs for the Zammad session leak CVE-2026-102489 (also KEV listed alongside CVE-2026-102490), the LMCache unauthenticated RCE CVE-2026-105192, and a Telegram Desktop one-click account takeover CVE-2026-107181. A React Server Components flaw CVE-2026-23870 can freeze Next.js servers with a single POST request.

Patch Tuesday context and a Windows end-of-support warning

Help Net Security's October 2026 Patch Tuesday forecast points to an Office cleanup, naming CVE-2026-85880 and CVE-2026-81963. The hottest Microsoft cumulative updates this cycle span Windows Server 2022 (KB5046616, 37 CVEs), Windows 11 24H2 (KB5046617, 33 CVEs), and Windows 10 1809 (KB5046615, 31 CVEs), all carrying KEV-linked content.

BleepingComputer also warns that outdated Windows devices will stop receiving security updates next year, so factor lifecycle status into your remediation plan. CISA separately published an advisory (AA26-281A) on Chinese government-linked actors combining automated and hands-on tooling to steal sensitive data, plus three ICS advisories covering Red Lion, Grid Protection Alliance, and Satel gear.

Do this first

Work the exploitation picture in order and verify your own state rather than assuming.

• Patch Citrix NetScaler ADC and Gateway for CVE-2026-107406 before anything else at the edge.
• Confirm SonicWall SMA1000 (CVE-2026-102255) and AhsayCBS (CVE-2026-105133, CVE-2026-105134) are patched or isolated, since all three are under active attack.
• Remediate the five new KEV adds, starting with ProFTPD CVE-2015-3306 at CVSS 10.
• Prioritize ransomware-linked CVE-2026-63077 (TeamCity) and CVE-2026-41940 (cPanel and WHM).
• Use the Senserva free Microsoft Patch Tracker to rank your open Microsoft updates by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow KEV additions daily.

Sources

• Cyber Security News: Citrix Urges NetScaler ADC and Gateway Customers to Patch for New Critical RCE Vulnerability (2026-10-09)
• SecurityWeek: Citrix Urges Immediate Patching of Critical NetScaler Vulnerability (2026-10-09)
• SecurityWeek: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (2026-10-09)
• BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks (2026-10-09)
• BleepingComputer: Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto (2026-10-09)
• Help Net Security: October 2026 Patch Tuesday forecast: Time for an Office cleanup (2026-10-09)
• BleepingComputer: Microsoft: Outdated Windows devices will stop receiving security updates (2026-10-09)
• Cyber Security News: PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution (2026-10-08)
• Cyber Security News: PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution (2026-10-08)
• Cyber Security News: PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover (2026-10-09)
• Cyber Security News: React Server Components Flaw Lets Attackers Freeze Next.js Servers With a Single POST Request (2026-10-09)
• CISA Cybersecurity Advisories: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (2026-10-08)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-10.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.