Citrix NetScaler ADC and Gateway hit by four vulnerabilities

🕵️ RESEARCH & DEEP DIVES

• Citrix NetScaler ADC and Gateway hit by four vulnerabilities, CVE-2026-88775 through 88778 CVE-2026-88775 CVE-2026-88776 CVE-2026-88777 CVE-2026-88778
  Citrix has disclosed four vulnerabilities in NetScaler ADC and NetScaler Gateway, fixed in new builds.
  • Applies to Citrix NetScaler ADC and NetScaler Gateway deployments, including FIPS and NDcPP builds.
  • Three memory overflow flaws (CVE-2026-88775, -88776, -88777) can cause unpredictable behavior or denial of service; CVE-2026-88778 is a TCP ISN prediction flaw (CWE-342).
  • All four are network-exploitable without privileges, rated HIGH 8.8 CVSS.
  • Affected versions: ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, before 13.1.37.279 FIPS/NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23.
  • Researcher Kevin Beaumont notes exploitation activity began weeks before disclosure and suggests hunting SIEM logs for base64 strings after the User-Agent field and loglines matching pitbossIFS or pitbossb64decode.
  Sources 📎 Coverage: support.citrix.com · 👁 via CVE ThreatInt, @GossiTheDog@cyberplace.social (+3)

📋 ADVISORIES

• Regular Labs fixes content-author security holes in Modules Anywhere 10.0.0 and Tabs & Accordions 3.2.0
  Regular Labs released security updates for Joomla extensions Modules Anywhere and Tabs & Accordions fixing content-author privilege issues.
  • Affects Joomla 4, 5 and 6 sites running Modules Anywhere 9.x or earlier and Tabs & Accordions 3.0.0–3.1.x; no Joomla 3 fix exists (Modules Anywhere's Joomla 3 branch ended at 7.18.0)
  • Tabs & Accordions before 3.2.0 allowed stored XSS (CWE-79) via data-rlta-url attributes accepting javascript: URLs that ran in visitors' browsers
  • Modules Anywhere before 10.0.0 let content authors change settings of any module they embedded, including a feed module's URL; 10.0.0 now accepts overrides only from trusted sources
  • 87% of monitored Tabs & Accordions installs are on 3.1.0, which does not include this fix; Modules Anywhere 10.0.0 is a breaking change moving settings into a new Process Tags section
  • Listed CVE identifiers (CVE-2026-97164/97165) were retracted pending clarification by the Joomla CNA
  Sources 📎 Coverage: mysites.guru · 👁 via mysites.guru (discovered)

🔓 CVEs & KEV

• CVE-2026-101045 — fleetdm fleet — CVSS 8.9 — Fleet Homebrew Cask OS Command Injection via MetadataFleet-maintained app ins...

• CVE-2026-101043 — pnpm — CVSS 8.3 — pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settin...

• CVE-2026-101042 — parse-community parse-server — CVSS 7.4 — Parse Server 9.0.0 Authentication Bypass via Unverified Provider IdentityPars...

• CVE-2026-101044 — pnpm — CVSS 7.1 — pacquet before 12.0.0-alpha.5 Path Traversal via lockfile aliaspacquet, the R...

• CVE-2026-101056 — cloudreve — CVSS 6.9 — Cloudreve before 4.16.1 Authentication Bypass via Cached Context HintCloudrev...

• CVE-2026-101047 — fleetdm fleet — CVSS 6.9 — Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLsFlee...