Loki Intelligence — Security Briefs · Published
Daily Security Brief: SD-WAN, NetScaler, Zimbra and FortiMail Under Attack
Today's risk picture is dominated by active exploitation of internet-facing management and gateway systems, including Cisco Catalyst SD-WAN Manager, Citrix NetScaler, Fortinet FortiMail and Zimbra mail servers. Teams should prioritize patching these platforms, removing management interfaces from the internet, and hunting for web shells, rogue admin accounts and stolen secrets before assuming patched systems are clean.
Signal 01 · The Hacker News
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
CISA added CVE-2026-76504, a critical Cisco Catalyst SD-WAN Manager authentication bypass rated CVSS 9.8, to its KEV catalog following reports of exploitation. Improper handling of URI encoding lets an unauthenticated attacker reach the Manager's API with admin privileges, and Cisco has published log-based indicators customers can use to check for abuse.
Why it matters: Upgrade SD-WAN Manager to a fixed release, review the service-proxy and vmanage-server logs for unexpected j_security_check entries, and keep the Manager off the public internet.
Source: The Hacker News
Signal 02 · The Hacker News
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Microsoft reported attackers exploiting CVE-2026-73570, a Zimbra Collaboration Suite command injection flaw fixed in version 10.1.20, on servers with the optional SNMP package and notifications enabled. Observed activity included JSP web shells, privilege escalation, persistence, movement between Zimbra nodes, and theft of mailbox data and central authentication secrets.
Why it matters: Update Zimbra, or remove zimbra-snmp and restrict SNMP and SMTP access if patching must wait, then rotate Zimbra authentication secrets and sweep servers for redundant web shells.
Source: The Hacker News
Signal 03 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added one entry to its Known Exploited Vulnerabilities catalog: CVE-2026-104286, a path traversal flaw in Fortinet FortiMail. The listing reflects evidence of active exploitation, and the catalog entry describes unauthenticated arbitrary file writes on the underlying system through crafted HTTP or HTTPS requests.
Why it matters: Identify FortiMail appliances, apply Fortinet's fixes or workarounds, keep the management interface off the internet, and check for signs of compromise that predate patching.
Source: CISA
Signal 04 · The Hacker News
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
watchTowr published a technical analysis of CVE-2026-88772, an exploited memory overflow in the DTLS handling of Citrix NetScaler ADC and Gateway rated CVSS 9.5. The researchers showed the pre-authentication bug can be turned into root-level code execution, a day after releasing a proof of concept for the related, also-exploited CVE-2026-88771.
Why it matters: Public technical detail shortens the path to wider exploitation, so confirm every NetScaler appliance runs a fixed build and review exposed gateways for signs of compromise.
Source: The Hacker News
Signal 05 · CISA
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added a single vulnerability to the KEV catalog on September 30: CVE-2026-76504, a hex encoding flaw in Cisco Catalyst SD-WAN Manager. According to the catalog entry, an unauthenticated remote attacker can gain admin-level access because the product mishandles URI encoding in HTTP requests.
Why it matters: Treat SD-WAN Manager as a priority patch, verify every on-premises instance runs a fixed release, and limit management access to trusted hosts or a management subnet.
Source: CISA
Signal 06 · The Hacker News
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
LevelBlue analyzed exploitation of CVE-2026-88771, a critical pre-authentication command injection flaw in Citrix NetScaler ADC and Gateway, across several customer environments. Follow-on scripts created a superuser account, archived and exfiltrated NetScaler configuration, opened reverse shells, and hid a PHP web shell behind URLs made to resemble CSS resources.
Why it matters: After patching NetScaler, audit ns.conf for unknown privileged accounts, inspect web server configuration and logon directories for planted files, and rotate secrets held in appliance configuration.
Source: The Hacker News
Signal 07 · The Hacker News
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco disclosed that attackers are exploiting CVE-2026-76504, a zero-day in Catalyst SD-WAN Manager that lets an unauthenticated user operate the Manager's API as admin. Fixed releases are available with no workaround, and managers last updated for the May or June SD-WAN flaws still need this newer upgrade.
Why it matters: Upgrade on-premises managers, restrict access to known hosts, and collect diagnostic output before upgrading if compromise is suspected, since patching alone may not remove an existing intruder.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.