Daily Brief
Active exploitation in Cisco and Citrix products
Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
Cisco said attackers are exploiting a critical zero-day in Catalyst SD-WAN Manager, tracked as CVE-2026-76504. A remote attacker with no login access can use the Manager’s API as the admin user, and fixed releases are available with no workaround. This matters because it gives direct privilege escalation on a core network management tool.
Identify any Cisco Catalyst SD-WAN Manager instances and patch to a fixed release immediately. Review API and admin activity for signs of unauthorised use.
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Researchers say attackers exploited Citrix NetScaler CVE-2026-88772 to deploy web shells, tunnelling malware, gain root access and steal credentials. The activity spread into internal networks, showing a path from an exposed appliance to broader compromise. This matters because perimeter devices can become the first foothold for deeper intrusion.
Check Citrix NetScaler appliances for web shells, new accounts, tunnelling tools and credential theft indicators. Treat any sign of exploitation as a full incident response case.