Analyst Guidance
This week highlights three actively exploited vulnerabilities across critical infrastructure and enterprise platforms. Dell Container Storage Modules and Citrix NetScaler have critical flaws being weaponized in the wild. Organizations operating SharePoint, Citrix NetScaler, and Dell CSM should prioritize immediate patching to prevent ransomware deployment and unauthorized administrative access.
CVE Details & Remediation
How to read this report
🛡️Verified facts — NVD & CISA KEV
⏳Partially verified — awaiting NVD enrichment
🧠AI analysis — synthesis, verify before acting
🛡️Actionable · Verified facts
NVD-published · CISA KEV cross-checked🛡️CVE-2026-85706 – GitLab Community Edition And Enterprise Edition ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS93% · P100
ActionPatch immediately
AffectedTechnology Energy Telecom
Remediation Steps
- Apply the vendor security update for Gitlab as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-5430 – WSO2 Multiple Products ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P46
ActionPatch immediately
Remediation Steps
- Apply available patches from GitHub
- Review GitHub repository access logs for unauthorized activity
- Audit repository permissions and access controls
- Monitor for credential compromise or token abuse
References:
🛡️CVE-2026-76460 – Cisco Identity Services Engine ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS14% · P96
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Cisco Identity Services Engine as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-93952 – Arista VeloCloud Orchestrator ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P63
ActionPatch immediately
Remediation Steps
- Review VeloCloud Orchestrator instances configured with certificate-based Edge authentication
- Restrict network access to the VCO management interface to trusted administrative networks
- Monitor authentication logs for unauthorized privilege escalation attempts
References:
🛡️CVE-2026-20079 – Cisco Secure Firewall Management Center (FMC) And Security Cloud Control (SCC) Firewall Management ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS88% · P100
ActionPatch immediately
AffectedGovernment Telecom Technology
Remediation Steps
- Apply the vendor security update for Cisco Secure Firewall Management Center as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-75650 – Adobe Commerce And Magento ✓ NVD
CVSS10 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS4% · P90
ActionPatch immediately
Remediation Steps
- Identify systems affected by CVE-2026-75650 using vulnerability scanning tools
- Apply vendor patches according to the vendor's published security advisory
- Verify patch installation across all affected systems
References:
🛡️CVE-2026-84869 – ConnectWise ScreenConnect ✓ NVD
CVSS9.9 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P59
ActionPatch immediately
AffectedGovernment Technology Defense
Remediation Steps
- Apply the vendor security update for Connectwise Screenconnect as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-102489 – Zammad GmbH Zammad ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS1% · P71
ActionPatch immediately
Remediation Steps
- Review recent access logs for suspicious activity on affected instances
- Implement additional authentication controls and session monitoring
- Consult GitHub security advisories for product-specific remediation guidance
References:
🛡️CVE-2026-104286 – Fortinet FortiMail ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
Remediation Steps
- Apply vendor patch for Fortrix to remediate known exploited vulnerability
- Verify patch deployment across all affected instances
- Monitor security logs for exploitation attempts post-patching
References:
🛡️CVE-2026-76504 – Cisco Catalyst SD-WAN Manager ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P75
ActionPatch immediately
AffectedTechnology Government Finance
Remediation Steps
- Apply the vendor security update for Cisco Catalyst Sd-Wan Manager as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88771 – Citrix NetScaler ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P63
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Citrix Netscaler Application Delivery Controller as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-94127 – F5 BIG-IP APM ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P82
ActionPatch immediately
AffectedTechnology Retail
Remediation Steps
- Apply the vendor security update for F5 BIG-IP APM as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-85102 – Check Point Multiple Products ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS8% · P94
ActionPatch immediately
AffectedGovernment Finance Technology
Remediation Steps
- Apply the vendor security update for Check Point Security Gateway, Check Point Spark Firewall as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-93616 – Check Point Multiple Products ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS20% · P97
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Check Point Security Management Server as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-86060 – MikroTik RouterOS ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS6% · P93
ActionPatch immediately
Remediation Steps
- Apply the latest MikroTik RouterOS security update addressing argument-injection in login process
- Restrict SSH access to trusted administrative networks
- Review router authentication logs for unauthorized access attempts
- Consider disabling SSH access from untrusted networks until patching is complete
References:
🛡️CVE-2025-39682 – Linux Kernel ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS3% · P86
ActionPatch immediately
Remediation Steps
- Apply the latest Linux kernel security patches
- Prioritize patching systems exposed to untrusted networks
- Review system logs for signs of active exploitation
- Test patches in non-production environments before deployment
References:
🛡️CVE-2026-76461 – Cisco Secure Email Gateway ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS28% · P98
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for Cisco Asyncos as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-19490 – Citrix NetScaler ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS23% · P98
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Citrix NetScaler as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2025-25249 – Fortinet Multiple Products ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS4% · P90
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Fortinet Multiple Products as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-86218 – N-Able N-Central ✓ NVD
CVSS9.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS13% · P96
ActionPatch immediately
Remediation Steps
- Apply the vendor patch for N-able N-central immediately.
- Verify patch deployment across all instances.
- Monitor for indicators of compromise or suspicious authentication attempts.
- Review access logs for unauthorized pre-authentication activities.
References:
🛡️CVE-2026-88772 – Citrix NetScaler ✓ NVD
CVSS9.5 NVD 4.0
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P69
ActionPatch immediately
AffectedTechnology Government
Remediation Steps
- Apply the vendor security update for Citrix NetScaler ADC/Gateway as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772
🛡️CVE-2026-102490 – Zammad GmbH Zammad ✓ NVD
CVSS9.4 NVD 4.0
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P48
ActionPatch immediately
AffectedTechnology Government Finance
Remediation Steps
- Apply the vendor security update for Zammad Ticketing System as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-71362 – Adobe Commerce And Magento ✓ NVD
CVSS9.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS88% · P100
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Adobe Commerce as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-86950 – Apple Multiple Products ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P68
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Apple iOS, iPadOS, macOS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-65660 – Microsoft SharePoint ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P81
ActionPatch immediately
Remediation Steps
- Apply the latest Microsoft security patch
- Prioritize patching across all affected systems
- Monitor email systems and document processing for suspicious activity
- Review recent file access and document modification logs
References:
🛡️CVE-2026-7273 – Zyxel GS1900 Series Switches ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS3% · P84
ActionPatch immediately
AffectedGovernment Technology
Remediation Steps
- Apply the vendor security update for Zyxel GS1900 Smart Managed Switches as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-53266 – Linux Kernel ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P56
ActionPatch immediately
AffectedTechnology
Remediation Steps
- Apply the vendor security update for Linux Kernel as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-58704 – Google Pixel ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS1% · P46
ActionPatch immediately
AffectedTechnology Government Defense
Remediation Steps
- Apply the vendor security update for Google Android as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-42016 – JFrog Artifactory ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS9% · P95
ActionPatch immediately
Remediation Steps
- Apply vendor security patch for incorrect authorization flaw
- Reset credentials for administrative and service accounts post-patch
- Review audit logs for unauthorized access or privilege escalation
- Restrict Artifactory network access to trusted sources if patching is delayed
References:
🛡️CVE-2026-87491 – Google Chromium V8 ✓ NVD
CVSS8.8 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS3% · P87
ActionPatch immediately
AffectedTechnology Finance
Remediation Steps
- Apply the vendor security update for Google Chromium V8 as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-88779 – Citrix NetScaler ✓ NVD
CVSS8.7 NVD 4.0
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS<1% · P18
ActionPatch immediately
Remediation Steps
- Apply Citrix's emergency security updates for NetScaler zero-day vulnerability CVE-2026-88779
- Monitor NetScaler instances for denial-of-service attack patterns and anomalous traffic
- Restrict administrative access to NetScaler systems to authorized personnel only
- Review Citrix security advisories for version-specific patch availability and deployment guidance
References:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779
- https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174
🛡️CVE-2026-67277 – MikroTik RouterOS ✓ NVD
CVSS8.2 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV ↻ Ongoing
EPSS2% · P74
ActionPatch immediately
Remediation Steps
- Consult CISA KEV catalog and vendor advisory for affected product and version
- Apply vendor patch to all affected systems
- Verify patch deployment across your environment
References:
🛡️CVE-2026-87902 – WordPress Core ✓ NVD
CVSS8.1 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS46% · P99
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for WordPress Core as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
🛡️CVE-2026-67279 – MikroTik RouterOS ✓ NVD
CVSS6.5 NVD 3.1
Triage statusActive Exploit
Exploitation⚠️ In the wild 🔥 In CISA KEV
EPSS1% · P62
ActionPatch immediately
Remediation Steps
- Apply the vendor security update for MikroTik RouterOS as a priority.
- Restrict network exposure of the affected service to trusted sources until patched.
- Review logs and detections for indicators of exploitation.
- Confirm fixed versions against the official vendor advisory before deploying.
References:
⏳Actionable · Partially verified
CVE in source articles · NVD enrichment pending⏳CVE-2026-63688 – Dell Container Storage Modules (CSM) pending NVD
CVSSawaiting NVD
Triage statusUnder Review
ExploitationNo exploitation reported
ActionPatch within 48 hours
AffectedGovernment
Remediation Steps
- Apply Dell's security updates to Dell Container Storage Modules to address missing authentication in the csm-authorization-storage gRPC server
- Restrict network access to affected csm-authorization-storage services to trusted hosts only
- Audit Kubernetes nodes and container environments for signs of unauthorized access or compromise
- Implement monitoring and alerting on csm-authorization-storage for unauthenticated connection attempts
References:
🤖 This vulnerability report was compiled by defend.network using AI-powered analysis of vulnerability databases, vendor advisories, and threat intelligence feeds. Always verify remediation steps through official vendor channels before implementing changes in production environments.