Five additions to CISA’s exploited-vulnerability catalog make asset matching urgent this week. Layer8’s priorities depend on exposure, business impact and deployment conditions.
| CVE | Impact and applicability | Remediation and exploitation |
|---|---|---|
| CVE-2026-88771 | NetScaler ADC/Gateway: unauthenticated code execution, including default configurations. | Actively exploited. Upgrade the relevant branch to 14.1-73.37/13.1-64.23 or later; FIPS/NDcPP require separate builds. Provider manages cloud updates. |
| CVE-2026-88772 | NetScaler ADC/Gateway: code execution or outage with DTLS enabled, the VPN virtual-server default. | Actively exploited; apply the same branch-specific Citrix updates above. |
| CVE-2026-104286 | FortiMail 7.2/7.4/7.6/8.0: unauthorized file changes. | Exploited. Fixes 8.0.2/7.6.7/7.4.9 remain upcoming; 7.2 requires migration to a fixed 7.4+ release. Meanwhile, disable IBE or restrict webmail per advisory, assessing business impact. |
| CVE-2026-76504 | Catalyst SD-WAN Manager: unauthorized administrator access, regardless of configuration. | Actively exploited. Install the vendor’s branch-matched fixed release. October 2 Live Protect offers temporary, partial protection. Cisco-managed 20.15.605 is fixed. |
| CVE-2026-86950 | iOS/iPadOS/macOS: code execution. | September 28 fixes: iOS/iPadOS 26.7.1, Tahoe 26.7.1, Sequoia 15.8.1. Apple reports possible highly targeted exploitation on pre-iOS 27; catalog addition September 29. |
Within an agreed Managed IT scope, Layer8 would match inventory to these conditions, obtain remediation approval and assign exception owners. Verify the installed build, required restart, service operation and mitigation status. Patching cannot establish that earlier compromise is absent; suspected intrusion needs a separately authorized response.
Revised source: Remediation reviewed October 3, including Cisco’s October 2 update and Fortinet’s current upcoming-release status.