Cyber

What changed

A vulnerability has been identified in the API session-based authentication management of Cisco Catalyst SD-WAN Manager. This flaw stems from improper handling of URI encoding in HTTP requests, enabling unauthorized access to the system.

An attacker could exploit this issue by sending a specially crafted HTTP request, bypassing authentication measures and gaining admin-level access to the API.

Who is affected

Organizations utilizing Cisco Catalyst SD-WAN Manager are at risk due to this vulnerability. The potential for unauthorized access to sensitive administrative functions poses a significant security threat.

Affected groups include network administrators and IT security teams responsible for managing Cisco SD-WAN environments.

• Cisco Catalyst SD-WAN Manager users
• Network administrators managing Cisco environments
• IT security teams overseeing API security

What to do

Immediate action is recommended for organizations using Cisco Catalyst SD-WAN Manager. It is crucial to assess the potential impact of this vulnerability and implement necessary security measures.

Monitoring API access logs for unusual activity and applying any available patches or updates from Cisco should be prioritized.

• Review and update security policies regarding API access
• Monitor for unauthorized access attempts
• Apply patches or updates provided by Cisco as soon as they are released

What changed

On September 27, 2026, Citrix revealed the existence of eight vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Among these, two vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are classified as critical remote code execution (RCE) flaws with a CVSSv4 score of 9.5.

These vulnerabilities have been confirmed to be actively exploited in the wild, indicating an urgent need for remediation.

Who is affected

Organizations utilizing Citrix NetScaler ADC and NetScaler Gateway are at significant risk due to these vulnerabilities. The affected products are widely used in enterprise environments for application delivery and security.

The vulnerabilities impact deployments in their default configurations, meaning that no additional features need to be enabled for exploitation.

• Citrix NetScaler ADC
• Citrix NetScaler Gateway
• Enterprise organizations relying on Citrix for application delivery
• IT departments managing Citrix environments

What to do

Immediate action is required to mitigate the risks associated with these vulnerabilities. Organizations should prioritize applying patches provided by Citrix as soon as they are available.

Additionally, monitoring for unusual activity and implementing network segmentation can help reduce the attack surface.

• Review Citrix's advisory for detailed information on the vulnerabilities.
• Implement available patches as soon as they are released.
• Enhance monitoring for potential exploitation attempts.
• Consider network segmentation to limit exposure.