CYBER THREATCAST

Upgrade SAML-configured Citrix NetScaler ADC and Gateway appliances to a fixed release immediately. CVE-2026-88779 was exploited as a zero-day in targeted attacks, and CISA has added the memory-buffer bounds vulnerability to its Known Exploited Vulnerabilities catalog. Administrators should prioritize every affected NetScaler deployment rather than waiting for broader attack activity.

Disable IBE or restrict FortiMail webmail exposure while applying available remediation for CVE-2026-104286; supported branches without fixes should be migrated or kept behind compensating controls. Investigate activity involving 45.129.0.192 and 79.141.169.187. An unauthenticated request can exploit path traversal to write arbitrary files and execute code on affected FortiMail releases.

Inventory WSO2 API Manager deployments and treat CVE-2026-5430 as an immediate incident-response priority. Examine administrative authentication activity for forged JWTs or unexpected administrator identities, then invalidate suspicious tokens and sessions. Active exploitation can bypass authentication, impersonate administrators, and take over accounts; watchTowr has observed forged administrator tokens in honeypots, and CISA lists the flaw in its Known Exploited Vulnerabilities catalog.

Patch unprotected Microsoft SharePoint systems now and investigate exposed deployments for Warlock ransomware activity. Hunt for stolen ASP.NET machine keys and the vulnerable K7RKScan driver, which attackers use to disable security products; rotate machine keys where compromise is suspected. Longlegs is actively exploiting old SharePoint vulnerabilities, with victims reported in water, telecommunications, government, and education.

Audit Base blockchain vault whitelists immediately and suspend affected vault activity if an unrecognized newly created contract has been authorized. Revoke unauthorized contracts and trace borrowing and transfer activity involving aBaswstETH. The reported attack was ongoing and used a newly whitelisted contract to borrow assets and transfer approximately $2.02 million to an attacker-controlled contract across four transactions.