Cyber

What changed

On September 27, 2026, Citrix revealed the existence of eight vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Among these, two vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are classified as critical remote code execution (RCE) flaws with a CVSSv4 score of 9.5.

These vulnerabilities have been confirmed to be actively exploited in the wild, indicating an urgent need for remediation.

Who is affected

Organizations utilizing Citrix NetScaler ADC and NetScaler Gateway are at significant risk due to these vulnerabilities. The affected products are widely used in enterprise environments for application delivery and security.

The vulnerabilities impact deployments in their default configurations, meaning that no additional features need to be enabled for exploitation.

• Citrix NetScaler ADC
• Citrix NetScaler Gateway
• Enterprise organizations relying on Citrix for application delivery
• IT departments managing Citrix environments

What to do

Immediate action is required to mitigate the risks associated with these vulnerabilities. Organizations should prioritize applying patches provided by Citrix as soon as they are available.

Additionally, monitoring for unusual activity and implementing network segmentation can help reduce the attack surface.

• Review Citrix's advisory for detailed information on the vulnerabilities.
• Implement available patches as soon as they are released.
• Enhance monitoring for potential exploitation attempts.
• Consider network segmentation to limit exposure.

What changed

On September 1, 2026, SonicWall disclosed two significant vulnerabilities affecting their SMA1000 appliances. These vulnerabilities, CVE-2026-83548 and CVE-2026-83549, are being actively exploited in the wild and can be chained to enable unauthenticated remote code execution (RCE).

CVE-2026-83548 is particularly critical, classified with a CVSS v3.1 base score of 10.0, indicating its severity. This server-side request forgery (SSRF) vulnerability allows remote attackers to exploit sensitive functionalities within the SMA1000 Appliance Work Place interface.

Who is affected

The vulnerabilities primarily impact organizations utilizing SonicWall SMA1000 appliances, which are widely used for secure remote access.

Any entity relying on these appliances for remote work solutions is at risk, especially those with exposed interfaces.

• SonicWall SMA1000 appliances deployed in enterprise environments.
• Organizations with remote work policies utilizing SonicWall products.
• IT teams responsible for maintaining network security in organizations using SonicWall solutions.

What to do

Security teams should prioritize patching affected SonicWall SMA1000 appliances as soon as updates are available. Immediate action is crucial to mitigate the risk of exploitation.

In the interim, organizations should review their network configurations and access controls to limit exposure to these vulnerabilities.

• Monitor SonicWall's official communications for patches and updates.
• Implement network segmentation to limit access to vulnerable appliances.
• Conduct a risk assessment to evaluate potential exposure and impact.