Analyst Guidance
This week prioritizes four critical remote code execution vulnerabilities with active exploitation: two zero-days in Citrix NetScaler products affecting default configurations, and two high-severity flaws in Oracle PeopleSoft and Microsoft SharePoint already weaponized by threat actors. Citrix patches are available; Oracle and Microsoft systems require immediate patching and network-level mitigations to block bypass techniques already observed in the wild.
CVE Details & Remediation
🛡️CVE-2026-5430 – WSO2 Multiple Products ✓ NVD
Remediation Steps
- Consult vendor advisory and CISA documentation for specific affected product and version details
- Apply vendor-issued patch or security update
- Validate patch deployment across inventory
- Document patching timeline and results
References:
🛡️CVE-2026-76460 – Cisco Identity Services Engine ✓ NVD
Remediation Steps
- Apply the vendor security update for Cisco Identity Services Engine as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-93952 – Arista VeloCloud Orchestrator ✓ NVD
Remediation Steps
- Review VeloCloud Orchestrator instances configured with certificate-based Edge authentication
- Restrict network access to the VCO management interface to trusted administrative networks
- Monitor authentication logs for unauthorized privilege escalation attempts
References:
🛡️CVE-2026-20079 – Cisco Secure Firewall Management Center (FMC) And Security Cloud Control (SCC) Firewall Management ✓ NVD
Remediation Steps
- Apply the vendor security update for Cisco Secure Firewall Management Center as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-85706 – GitLab Community Edition And Enterprise Edition ✓ NVD
Remediation Steps
- Apply the latest GitLab security patch for Community Edition and Enterprise Edition immediately
- Verify patch application across all GitLab instances in your environment
- Review access logs for evidence of exploitation attempts
- Restrict network access to GitLab instances to trusted networks pending patch confirmation
References:
🛡️CVE-2026-75650 – Adobe Commerce And Magento ✓ NVD
Remediation Steps
- Identify systems affected by CVE-2026-75650 using vulnerability scanning tools
- Apply vendor patches according to the vendor's published security advisory
- Verify patch installation across all affected systems
References:
🛡️CVE-2026-49869 – Kestra OSS ✓ NVD
Remediation Steps
- Apply the vendor security update for Kestra OSS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-83548 – SonicWall SMA1000 Appliances ✓ NVD
Remediation Steps
- Apply SonicWall security updates for SMA 1000 series VPN appliances as released by vendor
- If patching cannot be completed immediately, isolate affected SMA 1000 appliances from untrusted networks
- Monitor appliance logs for unusual SSRF or authentication bypass attempts
- Enforce network access restrictions to administrative interfaces
- Review and revoke any suspicious user sessions or API tokens created on affected appliances
References:
🛡️CVE-2026-84869 – ConnectWise ScreenConnect ✓ NVD
Remediation Steps
- Apply the vendor security update for Connectwise Screenconnect as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-35273 – Oracle PeopleSoft Enterprise PeopleTools ✓ NVD
Remediation Steps
- Apply Oracle PeopleSoft patches to remediate unauthenticated remote code execution
- Deploy or update Web Application Firewall rules to block URL-encoding bypass techniques
- Restrict network access to PeopleSoft endpoints from untrusted networks
- Conduct forensic analysis for indicators of web shell deployment and lateral movement
References:
🛡️CVE-2026-94127 – F5 BIG-IP APM ✓ NVD
Remediation Steps
- Apply the vendor security update for F5 BIG-IP APM as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-85102 – Check Point Multiple Products ✓ NVD
Remediation Steps
- Apply the vendor security update for Check Point Security Gateway, Check Point Spark Firewall as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-93616 – Check Point Multiple Products ✓ NVD
Remediation Steps
- Apply the vendor security update for Check Point Security Management Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-86060 – MikroTik RouterOS ✓ NVD
Remediation Steps
- Apply the latest MikroTik RouterOS security update addressing argument-injection in login process
- Restrict SSH access to trusted administrative networks
- Review router authentication logs for unauthorized access attempts
- Consider disabling SSH access from untrusted networks until patching is complete
References:
🛡️CVE-2025-39682 – Linux Kernel ✓ NVD
Remediation Steps
- Apply the latest Linux kernel security patches
- Prioritize patching systems exposed to untrusted networks
- Review system logs for signs of active exploitation
- Test patches in non-production environments before deployment
References:
🛡️CVE-2026-76461 – Cisco Secure Email Gateway ✓ NVD
Remediation Steps
- Apply the vendor security update for Cisco Asyncos as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-19490 – Citrix NetScaler ✓ NVD
Remediation Steps
- Apply the vendor security update for Citrix NetScaler as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2025-25249 – Fortinet Multiple Products ✓ NVD
Remediation Steps
- Apply the vendor security update for Fortinet Multiple Products as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-86218 – N-Able N-Central ✓ NVD
Remediation Steps
- Apply the vendor patch for N-able N-central immediately.
- Verify patch deployment across all instances.
- Monitor for indicators of compromise or suspicious authentication attempts.
- Review access logs for unauthorized pre-authentication activities.
References:
🛡️CVE-2026-81578 – PaperCut NG/MF ✓ NVD
Remediation Steps
- Apply the vendor patch to address the authentication bypass flaw
- Review access logs for evidence of unauthorized authentication or command execution
- Conduct credential audit of accounts that may have been exposed
- Restrict network access to PaperCut management interfaces
References:
🛡️CVE-2026-9586 – Sangoma Switchvox ✓ NVD
Remediation Steps
- Apply the vendor security update for Sangoma Switchvox as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-82329 – JFrog Artifactory ✓ NVD
Remediation Steps
- Apply the vendor security update for JFrog Artifactory as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88771 – Citrix NetScaler ✓ NVD
Remediation Steps
- Apply Citrix security updates released on September 27, 2026
- Verify patch deployment in non-production environment first
- Monitor for post-exploitation indicators following patching
References:
🛡️CVE-2026-88772 – Citrix NetScaler ✓ NVD
Remediation Steps
- Apply Citrix security updates released on September 27, 2026
- Review deployment scope across all affected Citrix instances
- Coordinate patching schedule to minimize business disruption
- Monitor logs for exploitation attempts during and after patching
References:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
🛡️CVE-2026-71362 – Adobe Commerce And Magento ✓ NVD
Remediation Steps
- Apply the vendor security update for Adobe Commerce as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-82078 – PaperCut NG/MF ✓ NVD
Remediation Steps
- Apply the vendor patch to address the remote code execution vulnerability
- Audit logs for malicious script execution or unauthorized commands
- Verify integrity of system binaries and scripts on affected servers
- Restrict inbound access to PaperCut services to trusted networks
References:
🛡️CVE-2026-65660 – Microsoft SharePoint ✓ NVD
Remediation Steps
- Apply Microsoft security patches for SharePoint code injection vulnerability
- Test patches in development and staging environments
- Monitor SharePoint logs for code injection attempts
- Restrict administrative access to SharePoint during patch rollout
References:
🛡️CVE-2026-7273 – Zyxel GS1900 Series Switches ✓ NVD
Remediation Steps
- Apply the vendor security update for Zyxel GS1900 Smart Managed Switches as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-53266 – Linux Kernel ✓ NVD
Remediation Steps
- Apply the vendor security update for Linux Kernel as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-58704 – Google Pixel ✓ NVD
Remediation Steps
- Apply the vendor security update for Google Android as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-42016 – JFrog Artifactory ✓ NVD
Remediation Steps
- Apply vendor security patch for incorrect authorization flaw
- Reset credentials for administrative and service accounts post-patch
- Review audit logs for unauthorized access or privilege escalation
- Restrict Artifactory network access to trusted sources if patching is delayed
References:
🛡️CVE-2026-87491 – Google Chromium V8 ✓ NVD
Remediation Steps
- Apply the vendor security update for Google Chromium V8 as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-85046 – Google Chromium V8 ✓ NVD
Remediation Steps
- Apply the vendor security update for Google Chrome as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-67277 – MikroTik RouterOS ✓ NVD
Remediation Steps
- Consult CISA KEV catalog and vendor advisory for affected product and version
- Apply vendor patch to all affected systems
- Verify patch deployment across your environment
References:
🛡️CVE-2026-59822 – BerriAI LiteLLM ✓ NVD
Remediation Steps
- Apply the vendor security update for BerriAI LiteLLM as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-87902 – WordPress Core ✓ NVD
Remediation Steps
- Apply the vendor patch for the affected Microsoft product
- Verify patch compatibility with existing deployments
- Prioritize systems in high-risk environments
- Monitor for exploitation attempts post-patching
References:
🛡️CVE-2026-67279 – MikroTik RouterOS ✓ NVD
Remediation Steps
- Apply the vendor security update for MikroTik RouterOS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2025-39964 – Linux Kernel ✓ NVD
Remediation Steps
- Apply the vendor security update for Linux Kernel as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References: