Daily Brief
Daily Brief, October 2, 2026
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
CISA added a critical Cisco Catalyst SD-WAN Manager authentication bypass to its Known Exploited Vulnerabilities list after reports of active exploitation. The flaw allows unauthenticated remote access, so affected edge systems need immediate review and patching.
Identify any Cisco Catalyst SD-WAN Manager instances, confirm whether they are exposed, and apply Cisco’s fixes or isolate them until patched.
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Attackers are exploiting a critical pre-authentication command injection flaw in Citrix NetScaler ADC and Gateway to drop web shells and steal configuration data. The activity includes post-exploitation changes that can create persistence and make cleanup harder.
Hunt for web shells, unexpected superuser accounts, and configuration theft on Citrix NetScaler systems, then rebuild any affected appliances rather than cleaning them in place.