NetScaler Zero-Days, Astrana Health Breach, and New CISA KEV Entries

Security leaders enter October 2026 tracking two fast-moving fronts: suspected state-sponsored actors have been exploiting a second Citrix NetScaler zero-day since early September, and Astrana Health has told the SEC that a social-engineering breach exposed patient, employee and business data. CISA also added actively exploited Fortinet FortiMail and Cisco Catalyst SD-WAN Manager flaws to its Known Exploited Vulnerabilities catalog this week, alongside a patched Apple Core Graphics zero-day used in a targeted attack.

State-Sponsored Actors Exploited Second NetScaler Zero-Day Since Early September

Mandiant and Google's Threat Intelligence Group say advanced, suspected state-sponsored actors have exploited Citrix NetScaler flaw CVE-2026-88772 since at least early September, bypassing authentication to gain root-level access on ADC and Gateway appliances. The attackers deployed web shells and a custom TCP tunneling tool to move into internal networks. Dozens of organizations across North America and Europe, including government, financial services, education, telecommunications, and legal sectors, have been affected. Mandiant warns that patching alone will not remove attackers already inside, since stolen credentials remain a separate risk. (Help Net Security)

CISA Flags Actively Exploited FortiMail Path Traversal Bug

CISA added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw lets attackers write arbitrary files on affected systems via crafted HTTP or HTTPS requests. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize remediation of KEV-listed flaws on internet-facing assets that grant full control post-exploitation, and must check whether systems were already compromised before patching. CISA urges all organizations, not just federal agencies, to treat this FortiMail flaw as a priority. (CISA)

Cisco Catalyst SD-WAN Manager Flaw Joins CISA's Exploited Vulnerability List

CISA added CVE-2026-76504, a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager, to its KEV catalog based on evidence of active exploitation. The flaw lets an unauthenticated remote attacker reach an affected system with admin-level privileges by abusing improper handling of URI encoding in an HTTP request. Binding Operational Directive 26-04 requires federal civilian agencies to remediate such high-risk, publicly exposed vulnerabilities quickly and to verify whether compromise occurred before the patch was applied. CISA again encourages all organizations to adopt the same risk-based prioritization. (CISA)

Apple Patches Core Graphics Zero-Day Used in Targeted Attack

Apple shipped iOS and macOS updates fixing CVE-2026-86950, an out-of-bounds write in the Core Graphics framework that can allow arbitrary code execution when a device processes a malicious file. Apple said it is aware of a report that the flaw was exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. The bug was reported by Meta's Product Security team and is fixed in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1; CISA has added it to the KEV catalog. (Help Net Security)

Astrana Health Discloses Material Breach After Employee Social Engineering

Healthcare management company Astrana Health told the SEC that threat actors impersonated company personnel and spoofed its main phone number to trick employees into granting system access. A forensic investigation found certain private and confidential information on affected servers was accessed and possibly acquired, covering patient, employee, provider and business data. The company determined the incident was material on September 22, 2026, reset affected credentials, restricted remote access tools, and notified law enforcement. No ransomware group has claimed responsibility, and the scope of the breach is still under review. (HIPAA Journal)

OpenInfra Europe's Artifactory Instance Breached, Packages Possibly Compromised

OpenInfra Europe, part of the Linux Foundation's OpenInfra Foundation, warned that attackers compromised its self-hosted JFrog Artifactory instance by exploiting authentication-bypass flaw CVE-2026-82329, which was added to CISA's KEV catalog on September 2. The compromise occurred around August 31 but was only discovered September 15, after a legitimate user was denied access. OpenInfra Europe told anyone who downloaded artifacts from its Nordix registry between August 28 and September 15 to stop using them and treat the packages as potentially compromised while the investigation continues. (Help Net Security)

Lumen Names Kim Keever Chief Security Officer

Lumen Technologies has appointed Kim Keever as Chief Security Officer to oversee the company's physical, digital and operational security strategy as the telecom provider adapts its infrastructure for an increasingly AI-driven environment. Keever previously served as CISO at Cox Communications and sits on the National Security Telecommunications Advisory Committee, which advises the US government on telecommunications resilience. Lumen says her mandate spans traditional cybersecurity along with protecting networks, facilities and operational technology, supported by threat intelligence from the company's Black Lotus Labs research unit. (Pulse 2.0)