Generated · Archived snapshot 10 findings · 5 CVEs
On this page

Exploitation Report

Executive Summary

Citrix NetScaler appliances are under active exploitation via two critical remote code execution zero-days (CVE-2026-88771 and CVE-2026-88772), with one vulnerability affecting every deployment on impacted versions including default configurations. Citrix has released patches for both flaws alongside six additional vulnerabilities, and administrators are urged to apply updates immediately or take systems offline.

Simultaneously, the ShinyHunters extortion group has resumed mass exploitation of the critical Oracle PeopleSoft vulnerability CVE-2026-35273 (CVSS 9.8) using a URL-encoding technique to bypass web application firewall protections, deploying web shells across multiple sectors globally.

Active Exploitation Details

CriticalActive exploitationPatchCVE-2026-88771CVE-2026-88772#

  • Description: Two critical remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. One of the flaws affects every deployment on an affected version, including those in the default configuration. Both were exploited as zero-days before patches were available.
  • Impact: Unauthenticated remote code execution leading to full appliance compromise, potential lateral movement, and data exfiltration.
  • Status: Actively exploited in the wild; security updates released by Citrix on September 27 addressing both zero-days plus six additional flaws.

CriticalActive exploitationPatchCVE-2026-35273#

  • Description: Critical unauthenticated remote code execution vulnerability in Oracle PeopleSoft (CVSS 9.8). Originally exploited as a zero-day, the flaw has seen renewed mass exploitation after threat actors developed a URL-encoding technique to bypass WAF rules that previously mitigated the issue.
  • Impact: Unauthenticated remote code execution enabling web shell deployment, data theft, and persistent access to PeopleSoft environments.
  • Status: Actively exploited in renewed campaign; WAF bypass technique allows exploitation despite prior mitigations.

HighPotentialMitigate#

  • Description: Cross-site request forgery vulnerability in the Elementor Website Builder WordPress plugin (CVSS 8.8) that allows unauthenticated attackers to create rogue administrator accounts when an admin clicks a crafted link. No CVE identifier has been assigned yet.
  • Impact: Full site takeover via unauthorized administrator account creation.
  • Status: Vulnerability disclosed with exploit details available; affects specific Elementor versions.

HighActive exploitationPatchCVE-2026-65660#

  • Description: Code injection vulnerability in Microsoft Office SharePoint (CVSS 8.8) allowing remote code execution. Added to CISA's Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
  • Impact: Remote code execution in SharePoint environments leading to server compromise and potential domain escalation.
  • Status: Actively exploited; listed in CISA KEV catalog.

HighActive exploitationPatch#

  • Description: Vulnerability in MikroTik RouterOS added to CISA's Known Exploited Vulnerabilities catalog citing evidence of active exploitation. Specific CVE identifier not provided in source articles.
  • Impact: Router compromise enabling traffic interception, network pivoting, and persistent infrastructure access.
  • Status: Actively exploited; listed in CISA KEV catalog.

CriticalActive exploitationPatchCVE-2026-5430#

  • Description: Critical authentication bypass vulnerability affecting multiple products from enterprise software provider WSO2. CISA warns of active exploitation in attacks.
  • Impact: Authentication bypass leading to unauthorized administrative access across WSO2 product deployments.
  • Status: Actively exploited per CISA warning.

HighActive exploitationPatch#

  • Description: Vulnerability in Adobe Commerce actively exploited in attacks per CISA warning. Specific CVE identifier not provided in source articles.
  • Impact: E-commerce platform compromise enabling payment data theft, order manipulation, and customer data exposure.
  • Status: Actively exploited per CISA warning.

HighNot observedPatch#

  • Description: Vulnerability in Cloudflare Containers and Sandboxes allowing customers with Workers Paid accounts to recover residual data from other customers' containers on the same physical host.
  • Impact: Cross-tenant data leakage exposing sensitive customer information across shared infrastructure.
  • Status: Fixed by Cloudflare; no indication of active exploitation in the wild.

HighObservedInvestigate#

  • Description: Unauthenticated path traversal vulnerability in Grav CMS used by the Clop ransomware gang's data leak site. Exploited by ShinyHunters to compromise and deface the leak site.
  • Impact: File system access leading to site defacement and potential data exposure.
  • Status: Exploited in targeted attack against Clop infrastructure; unpatched at time of exploitation.

HighObservedInvestigate#

  • Description: Two third-party GitHub Actions (actions-cool/issues-helper and actions-cool/maintain-one-comment) compromised during the May 2026 Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for over a week while still pointing to malicious code.
  • Impact: Supply chain compromise affecting any repository using the poisoned Actions, enabling credential theft and malicious code execution in CI/CD pipelines.
  • Status: Malicious payloads remained active after re-enabling; repositories since disabled again.

Affected Systems and Products

Attack Vectors and Techniques

Threat Actor Activities