CISA Adds One Known Exploited Vulnerability to Catalog

2026-10-01T23:24:02Z•667606613375cec4f6a12d5b9e39bceeb10d7106cc64a3e95f03240a39f8cfa3
CVE-2026-104286CVE-2026-65660CVE-2026-67279CVE-2026-76504CVE-2026-86950CVE-2026-87902CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778AppleCISA KEVCisco Catalyst SD-WANCitrix NetScalerFortinet FortiMailMicrosoft SharePointMikroTik RouterOSWordPressactive exploitationcode injectionimproper input validationindicators of compromisememory corruptionnetwork appliancesout-of-bounds writepath traversalremote code executionremote file inclusionvulnerability remediationzero-day

What happened

CISA reports multiple vulnerabilities added to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The affected products include Fortinet FortiMail, Cisco Catalyst SD-WAN Manager, Apple products, Citrix NetScaler ADC/Gateway, WordPress Core, Microsoft SharePoint, and MikroTik RouterOS. The Citrix NetScaler alert identifies CVE-2026-88771 and CVE-2026-88772 as critical zero-day vulnerabilities capable of independently enabling remote code execution and being actively exploited globally. Organizations should prioritize remediation, assess publicly exposed assets

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
cisa_ncas_current_activity
Record identifier
667606613375cec4f6a12d5b9e39bceeb10d7106cc64a3e95f03240a39f8cfa3
Enrichment time
2026-10-01T23:24:02Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.