Daily Brief — October 5, 2026

• GTIG confirmed on September 29 it is actively tracking exploitation of the NetScaler ADC and Gateway vulnerabilities and published defensive guidance for affected organizations.
• CVE-2026-88771 carries a CVSS v4 score of 9.5 and, per Citrix, affects every deployment on the vulnerable version even in default configuration.
• Citrix's September 27 bulletin covers eight CVEs total (CVE-2026-88771 through 88778) and ships fixes for all of them.
• CISA added CVE-2026-88771 and CVE-2026-88772 to the KEV Catalog, which under BOD 26-04 forces expedited remediation timelines for federal agencies.
• CISA added CVE-2026-88779, a Citrix NetScaler improper restriction of operations within the bounds of a memory buffer vulnerability, to the KEV Catalog on October 4 based on evidence of active exploitation.
• Some administrators reportedly took NetScaler appliances offline before patches were available, after watchTowr flagged unpatched RCE exploitation a day earlier.

Bottom line The KEV addition for CVE-2026-88779 broadens the NetScaler response: organizations should patch affected appliances and hunt for compromise across exposed systems.

• CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities Catalog on October 1, 2026, citing evidence of active exploitation.
• The flaw carries a CVSS score of 9.8 and allows unauthenticated attackers to write arbitrary files on the underlying FortiMail system.
• A report published October 2 said exploitation was underway, required no login, and that some administrators were still waiting for patches.
• CISA described the vulnerability class as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise.

Bottom line If you run FortiMail, identify affected systems and prioritize containment, investigation, and remediation immediately; federal civilian agencies should follow the applicable CISA vulnerability-management requirements.

• CVE-2026-73570 is an unauthenticated operating-system command-injection flaw in Zimbra Collaboration Suite with a CVSS score of 8.9; exploitation can lead to remote code execution.
• Synacor issued a patch on July 20, 2026, but did not disclose the vulnerability for more than three weeks afterward.
• Observed attackers used the flaw to deploy web shells, access mailbox data, and seek authentication credentials from vulnerable organizations.
• Attackers were probing the Zimbra mail-server flaw weeks before it had a CVE identifier or was disclosed publicly.

Bottom line If you run Zimbra Collaboration Suite, verify the July 20 patch is deployed now and investigate for web shells, mailbox access, and exposed authentication credentials.