Security Bulletin

❓What:

• Attackers are exploiting two critical flaws in Citrix NetScaler ADC and NetScaler Gateway, and both were exploited before a patch existed. thenextweb

• CVE-2026-88771 lets an attacker run commands without logging in and affects all NetScaler ADC and Gateway deployments, including the default setup. thenextweb

• CVE-2026-88772 is a memory overflow that can lead to remote code execution or a crash; it requires DTLS, which is enabled by default on VPN servers. thenextweb

• Both flaws carry CVSS 4.0 scores of 9.5. bankinfosecurity

❓What:

• F5 Labs disclosed an automated mass-scanning campaign, observed in August 2026, exploiting CVE-2026-39364 (CVSS 8.2), a high-severity Vite vulnerability

• The flaw lets an unauthenticated attacker bypass Vite's server.fs.deny protections using query parameter manipulation (e.g., ?raw, ?import&raw, ?import&url&inline) appended to /@fs/ requests

• Exploitation requires three conditions: the dev server is exposed to the network (via --host or server.host), the target file exists within server.fs.allow directories, and it's a file normally blocked by server.fs.deny

• Under default config, Vite binds to localhost only — exposure typically results from developers passing --host, setting server.host, or misconfigured Docker port mappings

❓What:

• Arctic Wolf is tracking an active cluster (PREY-0058) using voice phishing to compromise Microsoft 365 and connected SaaS platforms — no software vulnerability involved

• Actors impersonate IT/Helpdesk staff via phone calls or texts, directing victims — primarily Directors, VPs, and executives — to Adversary-in-the-Middle (AiTM) phishing pages

• AiTM pages capture credentials and MFA tokens in real time, defeating standard MFA

• Static residential proxy infrastructure (NodeMaven, seen in the majority of cases) is used to mimic legitimate login behavior and evade detection

❓What:

• CISA added two PaperCut NG/MF vulnerabilities — CVE-2026-81578 (missing authentication, CWE-306) and CVE-2026-82078 (unsafe reflection, CWE-470) — to its Known Exploited Vulnerabilities catalog on August 31, 2026

• CVE-2026-81578 lets an unauthenticated attacker modify system configuration settings

• CVE-2026-82078 allows execution of arbitrary Java bytecode already on the application classpath, under the PaperCut server process's security context

• The two can be chained: unauthenticated config change → reflection-based code execution, enabling remote compromise of vulnerable deployments