Patch Citrix NetScaler now: CVE-2026-107406
Citrix is telling NetScaler ADC and Gateway customers to patch a new critical remote code execution flaw, CVE-2026-107406, without waiting. Both Cyber Security News and SecurityWeek carried the same urgent-patching message on October 9. NetScaler sits at the edge of a lot of Microsoft 365 and Entra ID environments as the front door for VPN and app access, so a pre-auth RCE here is exactly the kind of thing attackers chain toward identity and internal systems.
There is no KEV listing for this one yet in today's facts, but the vendor's own language is clear enough. Treat it as patch now, not patch eventually, and check your appliance version against the fixed build.
SonicWall SMA1000 and AhsayCBS are already being exploited
BleepingComputer reports the maximum severity SonicWall SMA1000 flaw, CVE-2026-102255, is now exploited in attacks. If you run SMA1000 remote access appliances, move this to the top of the stack.
Separately, SecurityWeek and BleepingComputer both cover active exploitation of unpatched AhsayCBS backup servers, tracked as CVE-2026-105133 and CVE-2026-105134. Attackers are dropping webshells and mining cryptocurrency on exposed, unpatched instances. Backup infrastructure is a favorite target because it holds the data and the keys to recovery. Patch or isolate these servers.
The KEV catalog's hot movers
No new KEV additions came through between October 9 and today, but several already-listed CVEs remain high priority by exploitation probability. CVE-2015-3306 in ProFTPD carries a CVSS of 10 and near-certain EPSS. CVE-2024-27199, a JetBrains TeamCity path traversal, sits at an EPSS of roughly 0.9999 and is ransomware-linked, as is the newer TeamCity deserialization flaw CVE-2026-63077. Palo Alto PAN-OS authentication bypass CVE-2026-0257 and WebPros cPanel missing-authentication flaw CVE-2026-41940 are both KEV-listed, ransomware-linked, and scoring over 0.95 on EPSS.
If you run any of these, KEV plus ransomware linkage is the signal to stop reading and patch. The free Senserva non-Microsoft exploited-CVE tracker follows CISA KEV additions daily if you want to confirm your own exposure.
What the trusted press adds this week
Help Net Security's October Patch Tuesday forecast points to an Office cleanup and flags CVE-2026-85880 and CVE-2026-81963 as ones to watch. Pwn2Own Ireland produced 98 zero-days for a total of 1,262,000 dollars, so expect a wave of vendor fixes in the coming weeks.
A joint CISA and NCSC call-out named China-linked actors combining automated and hands-on tools to steal sensitive data. Microsoft also said outdated Windows devices will stop receiving security updates next year, and separately announced Teams will warn users about malicious links hidden inside QR codes. On the appliance side, a PoC is out for a Telegram Desktop one-click takeover flaw, CVE-2026-107181, and an NVIDIA DCGM exporter flaw CVE-2026-47483 lets unauthenticated attackers crash GPU monitoring.
Do this first
Priorities for the next day, grounded in today's facts:
- Patch Citrix NetScaler ADC and Gateway for CVE-2026-107406 immediately.
- Patch or isolate SonicWall SMA1000 (CVE-2026-102255) and AhsayCBS (CVE-2026-105133, CVE-2026-105134), all under active exploitation.
- Clear out ransomware-linked KEV items if present: TeamCity CVE-2024-27199 and CVE-2026-63077, PAN-OS CVE-2026-0257, cPanel CVE-2026-41940.
- Prep for October Patch Tuesday; the Windows cumulative updates KB5046616 for Server 2022 and KB5046617 for Windows 11 24H2 each cover 30-plus CVEs. The free Senserva Microsoft Patch Tracker ranks open patches by KEV, EPSS, and ransomware linkage.
Sources
- Cyber Security News: Citrix Urges NetScaler ADC and Gateway Customers to Patch for New Critical RCE Vulnerability (2026-10-09)
- SecurityWeek: Citrix Urges Immediate Patching of Critical NetScaler Vulnerability (2026-10-09)
- BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks (2026-10-09)
- SecurityWeek: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (2026-10-09)
- BleepingComputer: Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto (2026-10-09)
- Help Net Security: October 2026 Patch Tuesday forecast: Time for an Office cleanup (2026-10-09)
- BleepingComputer: Hackers get
,262,000 for 98 zero-days at Pwn2Own Ireland (2026-10-09) - BleepingComputer: Microsoft: Outdated Windows devices will stop receiving security updates (2026-10-09)
- Cyber Security News: Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes (2026-10-10)
- CISA Cybersecurity Advisories: Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (2026-10-08)
- NCSC: China-linked malicious actors called out by UK and international partners for targeting sensitive data globally (2026-10-08)
- Cyber Security News: PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover (2026-10-09)
- Help Net Security: High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring (2026-10-09)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-11.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.