Critical FortiMail Zero-Day CVE-2026-104286 Exploited in the Wild: Patch Your Email Gateways Now
CVE-2026-104286 (CVSS 9.8) lets unauthenticated attackers write arbitrary files on FortiMail and is actively exploited. See patches and mitigations.
Vulnerabilities
Citrix NetScaler SAML Zero-Day (CVE-2026-88779) Exploited in Attacks: Fixed Versions and Next Steps
CVE-2026-88779 in SAML-enabled NetScaler ADC and Gateway was exploited before a patch. Attackers inject commands via the username field. Patch now.
Citrix has released emergency patches for NetScaler ADC and NetScaler Gateway. Attackers were exploiting the vulnerability, CVE-2026-88779 (CVSS 8.7), before a fix was available. Citrix classifies it as a denial-of-service flaw. However, what has been seen in real attacks suggests it may also allow remote code execution.
Who is affected
The vulnerability affects appliances that use SAML authentication, meaning those configured as:
- a SAML service provider: the configuration contains
add authentication samlAction, - a SAML identity provider: the configuration contains
add authentication samlIdPProfile.
This setup is very common for single sign-on (SSO) to VPNs and corporate applications.
How the attacks work
According to published reports, attackers enter shell commands in the username field. The commands download a malicious file from 213.209.159[.]55, save it as /v and run it. Even where the attack “only” crashes the appliance, an attacker can trigger the flaw over and over and cut the organization off from remote access.
On October 5, CISA added the flaw to its catalog of known exploited vulnerabilities. It gave federal agencies until October 7 to act and required them to check for signs of compromise.
Fixed versions
- NetScaler ADC and Gateway 14.1-73.41
- NetScaler ADC and Gateway 13.1-64.28
- FIPS deployments: 14.1-73.41 FIPS and 13.1-37.282
Important: if you recently installed the patches for CVE-2026-88771 through CVE-2026-88778, you need to update your appliance again.
What to do
- Check whether any of your NetScaler appliances have SAML configured.
- Install a fixed version.
- Deploy the Global Deny Lists provided by Citrix.
- Review your logs for unusual usernames in SAML logins and for connections to the IP address listed above.
SecurHUB’s take
This is another round of NetScaler vulnerabilities this year. Edge devices that get patched only “when there’s time” are now one of the most common ways ransomware groups get in. These devices deserve their own faster patching process and continuous monitoring, for example through a SOC service.
Sources: BleepingComputer, CISO Series
