Threat
alerts

Citrix’s September 2026 security bulletin (CTX697096) resolves eight distinct vulnerabilities impacting NetScaler ADC and Gateway appliances, with severity scores ranging from CVSS 7.0 to 9.5. The bulletin is headlined by two actively exploited, maximum-severity zero-days. Because these edge devices manage remote access and hold highly sensitive cryptographic material in active memory, threat actors are leveraging these flaws to bypass authentication, harvest session tokens, and establish deep persistence within corporate networks.

BambooToken is a sophisticated, cross-platform malware framework that leverages the Message Queuing Telemetry Transport (MQTT) protocol to maintain stealthy command and control over compromised systems. Active and evolving over a three-year span the framework primarily targets mobile application backends, software supply chains, and enterprise networks.

"OVERPASS" is a maximum-severity (CVSS 10.0) memory corruption vulnerability located within the SAP Extended Passport (EPP) processing library. Because EPP is a shared core component used for system tracing, this flaw impacts a massive array of SAP systems. It allows unauthenticated remote attackers to completely bypass standard identity defenses and gain full administrative control over the underlying operating system and SAP business applications.

In late August 2026, threat actors launched a zero-click, pre-authentication remote code execution (RCE) campaign against PaperCut NG and MF by seamlessly chaining an authentication bypass (CVE-2026-81578) with an unsafe dynamic class-loading flaw (CVE-2026-82078). This exploit chain grants attackers maximum privileges on the underlying application server.

NovaCookies has emerged as a high-volume Adversary-in-the-Middle (AiTM) Phishing-as-a-Service (PhaaS) platform engineered to bypass multi-factor authentication (MFA) and capture Microsoft 365 session tokens. Operating as a modernised, centralised evolution of the legacy "Sneaky 2FA" framework, the platform offers expanded identity provider targeting while managing proxy infrastructure centrally for threat actor affiliates.

On August 12, 2026, Nightmare Eclipse shared an exploit that allows a local standard user to elevate execution integrity to NT AUTHORITY\SYSTEM. Although initially characterised by the researcher as a direct patch bypass for the RoguePlanet vulnerability (CVE-2026-50656), technical analysis demonstrates that ShieldBreak utilises a distinct vulnerability mechanism.

As secure email gateways (SEGs) and automated identity filters have increased in sophistication, advanced threat actors have adapted by migrating initial access operations directly into cloud-native Software-as-a-Service (SaaS) collaboration environments. Microsoft Teams has emerged as a primary target for social engineering, voice phishing (vishing), and administrative helpdesk impersonation campaigns.

On July 29, 2026, Broadcom published security advisory VMSA-2026-0006, documenting vulnerabilities spanning across multiple structural layers of the vSphere ecosystem, divided primarily between centralised management daemons running on vCenter Server and kernel-level device emulation drivers executing within the ESXi hypervisor.

Within hours of Microsoft releasing its monthly security updates on July 15, 2026, a critical zero-day vulnerability dubbed "LegacyHive" was publicly disclosed. The exploit takes advantage of a logic flaw in the Windows User Profile Service (profsvc), enabling a low-privileged standard user to deceive the SYSTEM-level service into mounting another user's registry hive with read privileges.