CISA Adds One Known Exploited Vulnerability to Catalog
2026-10-01T23:24:02Z•667606613375cec4f6a12d5b9e39bceeb10d7106cc64a3e95f03240a39f8cfa3
CVE-2026-104286CVE-2026-65660CVE-2026-67279CVE-2026-76504CVE-2026-86950CVE-2026-87902CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778AppleCISA KEVCisco Catalyst SD-WANCitrix NetScalerFortinet FortiMailMicrosoft SharePointMikroTik RouterOSWordPressactive exploitationcode injectionimproper input validationindicators of compromisememory corruptionnetwork appliancesout-of-bounds writepath traversalremote code executionremote file inclusionvulnerability remediationzero-day
What happened
CISA reports multiple vulnerabilities added to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The affected products include Fortinet FortiMail, Cisco Catalyst SD-WAN Manager, Apple products, Citrix NetScaler ADC/Gateway, WordPress Core, Microsoft SharePoint, and MikroTik RouterOS. The Citrix NetScaler alert identifies CVE-2026-88771 and CVE-2026-88772 as critical zero-day vulnerabilities capable of independently enabling remote code execution and being actively exploited globally. Organizations should prioritize remediation, assess publicly exposed assets
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- 667606613375cec4f6a12d5b9e39bceeb10d7106cc64a3e95f03240a39f8cfa3
- Enrichment time
- 2026-10-01T23:24:02Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.