This brief covers September 25–27, 2026. Each item was checked against its primary source (CISA’s KEV alert, the vendor advisory, or the original research), with reputable outlets linked for context. Two things lead this window: a warning of unpatched Citrix NetScaler zero-days under active exploitation, and a CISA KEV update covering Microsoft SharePoint and MikroTik RouterOS.
Two unpatched Citrix NetScaler RCE zero-days reported exploited in the wild
watchTowr · September 26, 2026
On September 26, watchTowr said two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway were exploited before any fix existed, and that the exploitation was found during forensic investigations. As of Sunday morning Citrix had published no bulletin, CVE IDs, CVSS scores, workarounds, or IOCs, and no CVE is in KEV. watchTowr expects Citrix communications and patches early in the week of September 28. These are separate from the August authentication bypass CVE-2026-19490. Some administrators have taken appliances offline. Because the exploitation came before any patch, installing the fix will not show whether a device was already compromised. Citrix’s existing guidance for suspected compromise (preserve evidence, isolate the appliance, rotate secrets and certificates) is the relevant playbook until then.
“While details are scarce, the information is credible.” (watchTowr, via X)
Source: The Hacker News · Citrix compromise guidance (CTX694799)
CISA adds exploited SharePoint code injection and MikroTik RouterOS flaws to KEV
CISA / Microsoft MSRC · September 25, 2026
CISA added two entries to the KEV catalog. CVE-2026-65660 (CVSS 8.8) is a code injection flaw in SharePoint Server 2016, 2019, and Subscription Edition. It lets an authenticated low-privilege attacker execute code over the network. Microsoft patched it in August and first classified it as spoofing, then reclassified it as RCE. Previdian saw exploitation attempts starting September 24, after Viettel Security published technical details. CVE-2026-67279 (CVSS 6.9) is a RouterOS flaw that lets an unauthenticated client open a session channel and send an exec request. Chained with CVE-2026-86060 (already in KEV) in the “MikroTrick” exploit, it gives unauthenticated administrative control of exposed routers, according to CERT Polska. Both have fixes available, and the SharePoint deadline for federal agencies is September 28.
“As of 9/25/2026, Microsoft had reliable evidence of observed attacks against exploitation of this vulnerability.” (Microsoft MSRC advisory)
Source: CISA alert · MSRC CVE-2026-65660 · SecurityWeek · The Hacker News
ShinyHunters resumes mass exploitation of Oracle PeopleSoft with a one-character WAF bypass
Mandiant / Google Threat Intelligence Group · September 25, 2026
Mandiant and GTIG report a new wave of attacks by UNC6240 (ShinyHunters) exploiting CVE-2026-35273 (CVSS 9.8), an unauthenticated Java deserialization RCE in PeopleSoft’s Environment Management Hub (PSEMHUB). Oracle patched it in June. The attackers request /%50SEMHUB/ instead of /PSEMHUB/, which slips past WAF rules that match the literal path before URL decoding. They are targeting organizations that deployed WAF rules but never patched. Web shells (x.jsp, u.jsp) were found on dozens of systems in higher education, technology, healthcare, government, and other sectors, along with the SIDEEYE backdoor, Neo-reGeorg tunnels, and MeshAgent. Mandiant’s advice: apply Oracle’s patch, disable or remove EMHub, and enforce blocking on the normalized path.
“WAF rules and path-based blocking are not a substitute for patching.” (Mandiant)
Source: Google Cloud Threat Intelligence · Oracle Security Alert · BleepingComputer
Kiteworks tells customers to shut down servers after a law-enforcement warning of an imminent attack
Kiteworks · September 25, 2026
Kiteworks, the secure file-sharing vendor formerly known as Accellion, told customers worldwide to take their systems offline for a six-hour window on Saturday, September 26. The company said federal authorities had warned that a threat actor might target Kiteworks systems. Kiteworks says it knows of no compromise and that all known vulnerabilities are fixed in version 9.5.1. It has not confirmed a zero-day, and no CVE has been assigned. Managed file transfer platforms have a long history as targets for data-theft extortion.
“We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach.” (Kiteworks statement to BleepingComputer)
Source: BleepingComputer · The Hacker News
Compromised Mini Shai-Hulud GitHub Actions came back online still serving malware
Socket · September 25, 2026
Socket found that two GitHub Actions compromised in the May 2026 Mini Shai-Hulud supply-chain campaign, actions-cool/issues-helper and actions-cool/maintain-one-comment, became accessible again on September 16. Their release tags still pointed to the malicious commits, so any workflow that referenced them by tag ran the payload again. GitHub has disabled both repositories a second time. Teams that use either action should audit recent workflow runs, rotate any CI secrets those runs could reach, and pin actions to full commit SHAs.
“On September 16, 2026, both repositories became accessible again.” (Karlo Zanki, Socket)
Source: The Hacker News · BleepingComputer
This brief covers the trailing ~48 hours (September 25–27, 2026).
Primary sources:
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Sept. 25, 2026)
- Microsoft MSRC: CVE-2026-65660
- Mandiant / GTIG: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
- Oracle Security Alert: CVE-2026-35273
- Citrix: Steps to take if NetScaler ADC is suspected to be compromised
- CISA Known Exploited Vulnerabilities Catalog