Vulnerability intelligence

CVE-2026-88771 is identified as an improper input validation vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway products. This flaw enables an unauthenticated attacker to execute arbitrary commands on affected systems. The vulnerability impacts all deployments of NetScaler ADC and NetScaler Gateway, and no specific additional features are required for it to be exploitable. Citrix confirmed that this vulnerability, alongside CVE-2026-88772, has been actively exploited in the wild on unmitigated NetScaler deployments. The company released security updates to address these issues, which were attacked before a public fix was available. NetScaler ADC and NetScaler Gateway appliances are commonly deployed at the edge of enterprise networks, handling functions such as VPN, remote access, load balancing, and user authentication.

CVE-2026-88772 is a memory overflow vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances. This flaw can result in remote code execution (RCE) or a denial-of-service (DoS) condition. The vulnerability specifically affects appliances where Datagram Transport Layer Security (DTLS) is enabled. DTLS is typically enabled by default for VPN virtual servers, meaning NetScaler Gateway deployments are susceptible unless DTLS has been explicitly disabled. Citrix has confirmed that this vulnerability, alongside CVE-2026-88771, has been actively exploited in unmitigated NetScaler deployments.

CVE-2026-88778 is identified as a TCP Initial Sequence Number (ISN) prediction flaw affecting Citrix NetScaler ADC and NetScaler Gateway appliances. This vulnerability specifically impacts devices configured with TCP-based virtual servers, such as those handling HTTP, SSL, or generic TCP traffic, when the "Enhanced ISN Generation" feature is disabled. To address this issue, Citrix advises applying software updates and implementing a configuration change to enable Enhanced ISN Generation on affected appliances.

CVE-2026-87902 is an unauthenticated path traversal vulnerability found in WordPress Core's page-template resolution mechanism. Specifically, the flaw resides within the `get_page_template()` function in `wp-includes/template.php`, where insufficient handling of encoded traversal elements allows request-derived page information to influence the filename WordPress attempts to resolve as a template. This enables the template loader to include readable PHP files located outside the intended theme directories. This vulnerability can lead to local file inclusion (LFI), and under certain server and theme configurations, it can be escalated to remote code execution (RCE). The issue affects WordPress Core versions 4.7.0 through 7.1.1 and was addressed with the release of WordPress 7.1.2, along with backported fixes for earlier versions.

CVE-2026-67279 describes a vulnerability in MikroTik RouterOS SSH where the system improperly handles a client-requested rekey operation. This flaw allows the SSH server to proceed to the connection protocol stage and accept session channel requests, even though user authentication has not been completed. As a result, an unauthenticated client can open an SSH session channel and issue `exec` requests. This capability permits the creation, overwriting, and reconstruction of files within the RouterOS managed file namespace, including critical configuration and diagnostic data.

CVE-2026-65660 is a vulnerability affecting Microsoft Office SharePoint, specifically SharePoint Server 2016, 2019, and Subscription Edition, with potential impact on SharePoint 2013. This flaw stems from an improper control of code generation, characterized as a 'code injection' vulnerability. It involves a parser desynchronization issue within SharePoint's `SafeControls` filter, which is designed to prevent the loading of dangerous classes. The vulnerability arises when the `ToolPane` component processes web-part markup, failing to properly escape quotes within attribute values when reconstructing `Register` directives. This oversight allows an attacker to inject additional directives through unescaped quotes, enabling the registration of arbitrary .NET classes. While initially described by Microsoft as a spoofing vulnerability, further technical analysis revealed that CVE-2026-65660 can lead to authenticated remote code execution (RCE). Researchers have also demonstrated that this flaw can be chained with other vulnerabilities to achieve pre-authentication remote code execution on servers configured to allow anonymous page access.