Security Advisory

Global – October 17, 2026 -- Citrix confirmed on September 27 that two critical NetScaler zero-day vulnerabilities, each scoring 9.5 in severity, were exploited in the wild. According to cyber insurer Coalition, the vendor's public communications lagged the first reports by at least 36 hours.

Two flaws allow remote code execution on unpatched NetScaler appliances

CVE-2026-88771 is a critical remote code execution (RCE) flaw that lets an unauthenticated attacker run arbitrary commands. CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or a denial-of-service condition. The Citrix patch also fixes six other flaws, bringing the total to eight.

NetScaler provides remote access to internal applications and desktops and is often exposed directly to the internet, which makes it a frequent target. Enterprises across all industries use it.

Global – October 13, 2026 -- Microsoft's October 2026 security release includes an actively exploited Windows Shell zero-day (CVE-2026-96951, CVSS 8.8), 20 Critical remote code execution flaws in Office applications and five CVSS 9.8 vulnerabilities in Outlook. Several of the flaws can be triggered by viewing a file or email in a preview pane, which removes the click-to-compromise barrier many enterprises rely on.

Windows Shell zero-day strips Mark of the Web protections in live attacks

CVE-2026-96951 is an Important security feature bypass that Microsoft confirms is being exploited in the wild. It lets an attacker evade Mark of the Web (MOTW), the trust tag that triggers Protected View in Office and SmartScreen warnings for downloaded executables. Once the tag is stripped, SmartScreen, Office Protected View and Application Guard no longer apply.