Security Engineer: 2026-09-28

1. Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

   CERT-EU, 2026-09-27. Read, 3 min.

   Citrix published a bulletin on September 27 for eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway and confirmed exploitation in the wild of two critical unauthenticated remote code execution flaws: CVE-2026-88771, which affects all deployments, and CVE-2026-88772, which affects deployments where DTLS is enabled, the default on VPN virtual servers. The fixed builds are 14.1-73.37 and 13.1-64.23, with 14.1-73.37 FIPS and, for 13.1 FIPS and NDcPP, 13.1-37.279.

   Why it matters for this role: Pair the NetScaler build update with enabling Enhanced ISN Generation wherever a TCP configuration is enabled, because CERT-EU recommends both.

2. ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

   Google Cloud (Mandiant and Google Threat Intelligence Group), 2026-09-25. Read, 14 min.

   Mandiant and Google Threat Intelligence Group report renewed mass exploitation of the Oracle PeopleSoft vulnerability CVE-2026-35273 by UNC6240 (ShinyHunters), which modified its exploit to bypass WAF rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint, and say their analysis indicates web shells were deployed on dozens of systems globally, in sectors including higher education, healthcare, and government. Oracle released a Security Alert for the flaw on June 10, 2026, and the post says the campaign targets organizations that implemented WAF rules but did not patch.

   Why it matters for this role: Test that any PSEMHUB block you keep matches the normalized path, since Mandiant says rules that match the literal path before URL decoding let the actor reach the endpoint.

Security Engineer