SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefMonday, September 28, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Citrix NetScaler Zero-Day RCE Vulnerabilities Exploited | CRITICAL |
|
5 C2 IPs | 80 OTX IOCs | 8 ARTICLES |
|
■ ANALYST TLDR Active exploitation of critical remote code execution (RCE) zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway poses an immediate threat to enterprise perimeters. Concurrently, CISA has added a Microsoft SharePoint vulnerability (CVE-2026-65660) to its Known Exploited Vulnerabilities catalog, signaling urgent remediation requirements. Organizations must also address newly patched cross-tenant data exposure flaws in Cloudflare Containers and multiple vulnerabilities in Wireshark. |
|
■ CRITICAL STORIES Citrix confirms two NetScaler RCE zero-days exploited in attacks Attackers are actively exploiting two zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway. Because these appliances sit at the perimeter, successful exploitation grants unauthenticated remote code execution, making immediate patching vital to prevent network compromise. |
Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks CISA has added CVE-2026-65660, a SharePoint vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog with a rapid patching deadline. This indicates active exploitation in the wild, threatening corporate intranet environments and sensitive document repositories. |
Cloudflare fixes Containers cross-tenant flaw exposing customer data A vulnerability in Cloudflare's Containers and Sandboxes allowed Workers Paid account holders to access residual data from other tenants on the same host. While now mitigated by Cloudflare, it highlights the persistent risks of multi-tenant cloud architectures and potential data leakage. |
|
■ CVEs IDENTIFIED CVE-2026-88771 Citrix NetScaler ADC and Gateway — Remote Code Execution (RCE) |
CVE-2026-88772 Citrix NetScaler ADC and Gateway — Remote Code Execution (RCE) |
CVE-2026-65660 Microsoft SharePoint — Remote Code Execution / Privilege Escalation |
[CVE-TBD] Cloudflare Containers and Sandboxes Cloudflare Containers and Sandboxes — Cross-tenant data exposure |
|
■ THREAT ACTORS Unknown Threat Actors | Advanced Persistent Threat (APT) / Cybercriminals |
Actively exploiting zero-day RCE vulnerabilities (CVE-2026-88771, CVE-2026-88772) in Citrix NetScaler ADC and Gateway. |
Unknown Threat Actors | Cybercriminals |
Exploiting CVE-2026-65660 in Microsoft SharePoint to compromise enterprise environments. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Exploitation of Citrix NetScaler RCE zero-days (CVE-2026-88771, CVE-2026-88772) and Microsoft SharePoint (CVE-2026-65660). |
| T1195 | | Supply Chain Compromise | Potential risks introduced by Anthropic's new Claude Marketplace with 2,000+ third-party plugins. |
| T1046 | | Network Service Scanning | Scanning for vulnerable Citrix NetScaler appliances and SharePoint servers. |
|
■ PATCH PRIORITY Citrix NetScaler ADC and Gateway — Actively exploited zero-day RCE vulnerabilities (CVE-2026-88771, CVE-2026-88772) — BleepingComputer |
Microsoft SharePoint — Active exploitation of CVE-2026-65660 added to CISA KEV — SecurityWeek |
Wireshark — 19 vulnerabilities fixed in version 4.6.9 — SANS ISC |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch Citrix NetScaler ADC and Gateway immediately to remediate the actively exploited RCE zero-days CVE-2026-88771 and CVE-2026-88772. |
| 2 | [P1] Apply security updates for Microsoft SharePoint to address CVE-2026-65660, adhering to the CISA KEV deadline. |
| 3 | [P2] Upgrade Wireshark installations to version 4.6.9 to resolve 19 security vulnerabilities and bugs. |
| 4 | [P3] Review and audit the use of third-party plugins and connectors within the newly launched Anthropic Claude Marketplace to mitigate supply chain risks. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |