Vulnerability Management Analyst: 2026-09-28
28 minutes in total
Canadian Centre for Cyber Security, 2026-09-27. Read, 5 min.
The Cyber Centre warns of two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, and says reports indicate they are being exploited across multiple Citrix customer environments worldwide, although the full extent of the activity remains unknown. It asks organizations to review Citrix's September 27 bulletin, prioritize Internet-facing systems, and investigate for signs of compromise.
Why it matters for this role: Mark Internet-facing NetScaler appliances as the Cyber Centre's remediation priority, and add an evidence-capture step ahead of each patch where feasible.
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
Google Cloud (Mandiant and Google Threat Intelligence Group), 2026-09-25. Read, 14 min.
Mandiant and Google Threat Intelligence Group report renewed mass exploitation of the Oracle PeopleSoft vulnerability CVE-2026-35273 by UNC6240 (ShinyHunters), which modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and say their analysis indicates web shells were deployed on dozens of systems globally, in sectors including higher education, healthcare, and government. Oracle released a Security Alert for the flaw on June 10, 2026, and the post says the campaign targets organizations that implemented WAF rules but did not patch.
Why it matters for this role: Reopen any CVE-2026-35273 finding that was closed on the strength of a WAF rule, because the renewed campaign reaches the PSEMHUB endpoint past string-based WAF rules.
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
Patchstack, 2026-09-25. Read, 9 min.
Patchstack disclosed a cross-site request forgery vulnerability in the Elementor Website Builder plugin for WordPress, in which one link opened by a logged-in user makes that user carry out any REST API action their account is permitted to perform, so that on a stock installation an administrator clicking the link creates a second administrator account for the attacker. Elementor fixed it in version 4.3.2, released September 24, 2026.
Why it matters for this role: Filter your WordPress inventory for Elementor 4.3.0 and 4.3.1 only, because Patchstack says earlier releases do not ship the affected code and 4.3.2 fixes it.
Sign in to take it.