cybr.cx Daily Digest — September 29, 2026

Critical Vulnerabilities

⚠️ Actively exploited — CVE-2026-88771 & CVE-2026-88772 | Citrix NetScaler ADC / Gateway
Two critical vulnerabilities in Citrix NetScaler are being actively weaponised right now, with CISA's remediation deadline already passed (September 30). CVE-2026-88771 allows an unauthenticated attacker to execute arbitrary commands via improper input validation; CVE-2026-88772 enables remote code execution or denial of service through an out-of-bounds memory operation. NetScaler is a high-value perimeter target — if you haven't patched or isolated these appliances, treat this as a fire drill.

⚠️ Actively exploited — CVE-2026-87902 | WordPress Core
WordPress Core is being actively exploited via a remote file inclusion flaw that lets an unauthenticated attacker hijack page-template resolution to include arbitrary local .php files outside theme directories, leading to RCE. With WordPress powering a significant share of the web, the blast radius here is enormous. Update immediately and audit web-facing WordPress installs for signs of compromise.

⚠️ Actively exploited — CVE-2026-65660 | Microsoft SharePoint
An authenticated code injection vulnerability in Microsoft SharePoint is under active exploitation, allowing a network-accessible attacker with standard credentials to execute arbitrary code. SharePoint deployments in enterprise environments often carry sensitive internal data and trust relationships — lateral movement risk is high. Patch or restrict access now.

⚠️ Actively exploited — CVE-2026-67279 | MikroTik RouterOS
An improper workflow enforcement bug in RouterOS lets an unauthenticated client open a session channel and send exec requests — and it chains directly with CVE-2026-86060 for full unauthenticated exploitation. MikroTik devices are ubiquitous in SMB and ISP environments and historically slow to patch. Assume internet-exposed RouterOS instances are targeted; isolate management interfaces immediately.

⚠️ Actively exploited — CVE-2026-85102 & CVE-2026-93616 | Check Point Security Gateway / Management Server
Two active Check Point vulnerabilities round out a brutal week for perimeter security. CVE-2026-85102 affects Security Gateway and Spark Firewall — improper certificate validation in VPN configurations allows unauthenticated RCE. CVE-2026-93616 hits Security Management Server and related products with a path traversal that allows unauthenticated script upload and execution. Both are being exploited in the wild; patch or segment management planes now.

⚠️ Actively exploited — CVE-2026-94127 | F5 BIG-IP APM
A heap-based buffer overflow in F5 BIG-IP APM triggers when both an access policy and OAuth profile are configured on a virtual server, enabling unauthenticated RCE. OAuth-enabled APM deployments are common in large enterprises. CISA's due date has passed — if you haven't acted, you're already late.

⚠️ Actively exploited — CVE-2026-71362 | Adobe Commerce / Magento
An incorrect authorisation flaw in Adobe Commerce and Magento allows privilege escalation to sensitive resources with no user interaction required. E-commerce platforms are prime targets for payment skimming and data theft. Patch, then audit transaction logs and admin access for anomalies.

⚠️ Actively exploited — CVE-2026-5430 | WSO2 API Control Plane, API Manager, Universal Gateway
A path traversal vulnerability across multiple WSO2 products enables unrestricted file upload leading to RCE. API gateways sit at the heart of modern service architectures — compromise here can cascade across an entire backend estate. CISA's deadline has passed; prioritise immediately.

CVE-2026-101062 | Obot (CVSS 8.8)
Obot versions ≤0.22.1, even when authentication is enabled, exposes unauthenticated OAuth dynamic client registration with no redirect URI restrictions. Because the authorisation flow auto-completes for already-logged-in users with no consent screen, an attacker can register a malicious client and silently harvest OAuth tokens. Upgrade to v0.23.0.

CVE-2026-87741 | WordPress ConvertPlus Plugin (CVSS 8.8)
All versions of the ConvertPlus plugin up to 3.6.3 allow PHP object deserialisation via the style parameter in an AJAX action — no capability check is enforced when the nonce parameter is omitted entirely. This is a reliable pre-auth code execution path on any site running the plugin. Remove or update immediately.

CVE-2026-101009 | aaPanel BaoTa ≤11.8.0 (CVSS 8.4)
An OS command injection vulnerability in aaPanel's unzip handler allows remote attackers to manipulate the Password argument and execute arbitrary system commands. The exploit is already public. Hosting control panels are a favourite initial-access vector; patch or restrict network exposure now.

CVE-2026-93355 | LiteLLM (CVSS 8.1)
LiteLLM's JWT authentication falls back to email-based user lookup without verifying the email_verified claim, meaning any attacker with a valid JWT from the configured identity provider can authenticate as any existing user by presenting a token with an unverified matching email. In AI infrastructure deployments this could mean full access to model APIs and underlying credentials. Patch and audit identity provider configurations.

Headline News

KiteWorks Urges Customers to Shut Down Servers Ahead of Zero-Day Attack

KiteWorks, the American secure file-sharing and collaboration platform, has taken the highly unusual step of directly emailing customers urging them to temporarily shut down their servers in anticipation of an imminent zero-day attack. The advisory, communicated from the company's CISO, signals that a credible, time-sensitive threat has been identified against a vulnerability for which no patch is yet available. KiteWorks is used extensively in regulated industries including defence, government, and financial services — environments that handle sensitive and often classified data — making it a high-value target for both criminal ransomware groups and nation-state actors. The recommendation to proactively take systems offline is an aggressive but defensible posture when an unpatched RCE-class vulnerability is in play. Practitioners running KiteWorks deployments should follow the vendor's guidance immediately and monitor for further technical details as they emerge.

Arista VeloCloud Orchestrator Under Active Exploitation

Arista's VeloCloud Orchestrator (VCO), the centralised management plane for SD-WAN deployments, is being actively exploited in the wild via CVE-2026-93952 — an improper input validation flaw that allows remote attackers to access privileged internal functionality and compromise the host's confidentiality, integrity, and availability. SD-WAN orchestrators represent an exceptionally high-value target: full control of the VCO effectively means control over an organisation's entire wide-area network fabric, including routing policy and connectivity between branch offices, cloud environments, and data centres. The vulnerability requires no authentication, and with the CISA due date already passed on September 25, any unpatched VCO exposed to the internet should be treated as potentially compromised. Incident responders should review VCO access logs for anomalous API calls, unexpected configuration changes, and unusual outbound connections from orchestrator hosts.

Schrödinger's Feed

Florida State University has secured $2.1 million in funding to establish a quantum communication testbed, adding to a growing wave of national infrastructure investment in quantum networking alongside AI and semiconductor programmes. Quantum communication testbeds are where abstract cryptographic theory meets the messy real world — testing whether quantum key distribution (QKD) and entanglement-based protocols actually hold up across real fibre and atmospheric links. The security implication isn't purely future-tense: decisions being made now about long-haul network architecture will determine how quickly organisations can transition to quantum-safe communication channels once classical encryption timelines tighten. Practitioners involved in long-lifecycle infrastructure — government networks, critical infrastructure, defence — should be watching testbed results closely, as empirical performance data will shape post-quantum migration roadmaps far more than vendor slide decks will.

/dev/random

Someone has built Parley, a federated, decentralised chat system with a delightful architectural quirk: under the hood, it speaks plain IRC. The project routes messages across a distributed network of nodes while exposing the decades-old IRC protocol at the transport layer — meaning your 1997-era IRC client can, in principle, join a modern federated chat. It's either a beautiful act of protocol archaeology or a reminder that IRC was ahead of its time and the rest of us just spent thirty years rediscovering it with worse names. Either way, if your threat model includes "I need a chat platform that could survive a datacenter apocalypse and still work with BitchX," Parley may be your answer.