Loki Intelligence — Security Briefs · Published
Daily Security Brief: Zimbra, Cisco SD-WAN, and Citrix Exploitation
Today's risk is concentrated in mail servers and network management planes, with exploited Zimbra and Cisco SD-WAN Manager flaws and newly published technical details for an exploited Citrix NetScaler bug. Teams should patch these systems urgently, take management interfaces off the internet, and hunt for web shells and stolen secrets that patching alone will not remove.
Signal 01 · The Hacker News
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Microsoft reported attackers exploiting CVE-2026-73570, an unauthenticated command injection in Zimbra Collaboration Suite, fixed in version 10.1.20, that a crafted email can trigger when SNMP notifications and the optional zimbra-snmp package are enabled. Post-exploitation included web shells, privilege escalation, theft of Zimbra authentication secrets and staging of mailbox data.
Why it matters: Upgrade Zimbra to 10.1.20 or later, remove zimbra-snmp if unused, rotate Zimbra authentication secrets, and hunt for redundant web shells and unfamiliar systemd services.
Source: The Hacker News
Signal 02 · The Hacker News
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
watchTowr published an analysis of CVE-2026-88772, the exploited NetScaler ADC and Gateway flaw, showing that inconsistent fragment-length handling during DTLS message reassembly overflows a buffer in the packet processing engine and can be turned into root-level code execution without authentication. A proof of concept for the companion bug CVE-2026-88771 appeared a day earlier.
Why it matters: Public technical details shorten the window before broader exploitation, so patch NetScaler appliances now and treat DTLS-enabled Gateways as the highest priority.
Source: The Hacker News
Signal 03 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-76504, a Cisco Catalyst SD-WAN Manager hex encoding vulnerability, to the KEV catalog. According to the catalog entry, improper handling of URI encoding in HTTP requests could let an unauthenticated remote attacker access the system with admin-level privileges.
Why it matters: Upgrade SD-WAN Manager to a fixed release, restrict its interfaces to management networks, and review access logs for unknown sources reaching login paths.
Source: CISA
Signal 04 · The Hacker News
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco disclosed active exploitation of CVE-2026-76504, a CVSS 9.8 authentication bypass in Catalyst SD-WAN Manager that lets an unauthenticated attacker use the API as the admin user through a crafted, URI-encoded request. Fixed releases exist with no workaround, and Managers patched for earlier 2026 SD-WAN flaws still need this update.
Why it matters: Upgrade on-prem Managers, block internet access to them, check service-proxy and vmanage-server logs for suspicious j_security_check entries, and collect admin-tech output before upgrading.
Source: The Hacker News
Signal 05 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA confirmed active exploitation of CVE-2026-86950 by adding it to the KEV catalog. The flaw is an out-of-bounds write in Apple's CoreGraphics component affecting iOS, iPadOS and macOS that may allow arbitrary code execution when a malicious file is processed.
Why it matters: Check fleet reports for Apple devices still below the fixed releases and set compliance policies that block outdated devices from sensitive corporate resources.
Source: CISA
Signal 06 · CISA
Baicells Nova 430H
Baicells Nova 430H eNodeB units running BaiBLQ_3.0.12 or earlier are affected by CVE-2026-96274, which lets a nearby unauthenticated device cause a temporary cell outage by sending a malformed message during connection setup. CISA says the vendor has not engaged, no fix is planned, and the issue is not remotely exploitable.
Why it matters: Treat affected base stations as carrying an accepted availability risk: document it, monitor signaling for repeated association drops, and evaluate supported replacement hardware.
Source: CISA
Signal 07 · CISA
MikroTik RouterOS
MikroTik RouterOS versions earlier than 7.24 contain CVE-2026-84411, a critical integer underflow in how the web management service handles HTTP request bodies before authentication. CISA says it could allow root-level code execution or denial of service, although no public exploitation has been reported to the agency so far.
Why it matters: Given recent RouterOS exploitation activity, upgrade promptly, restrict web management to trusted administrator networks, and keep router interfaces off the public internet.
Source: CISA
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.