پارتیان ابتکار پایدار

OT Refrigeration Control Systems Attack

What is the Attack?	November 2, 2026 Update: A new wave of suspected cyberattacks has affected supermarket refrigeration systems across several European countries, including Sweden, Belgium, Luxembourg, Ireland, and Estonia. Reported incidents involved attackers manipulating refrigeration controls and triggering defrost cycles or raising temperatures, with some equipment reportedly reaching 50°C. Affected retailers include ICA, Coop, Carrefour, Delhaize, Colruyt, and SuperValu. Sweden's National Cyber Security Centre (NCSC-SE) confirmed it was responding to incidents involving ICA and Coop stores. However, authorities have not established whether these incidents are connected to the October attacks in France or share the same threat actors or infrastructure. No threat group has claimed responsibility, and no new malware or indicators of compromise have been publicly confirmed. On October 11–12, 2026, attackers compromised refrigeration control systems at supermarkets across France, remotely manipulating refrigeration settings and triggering defrost cycles. The attacks caused temperatures in some refrigeration units to rise to as high as 50°C, resulting in food spoilage and operational disruption. Affected retailers reportedly included Intermarché, Netto, Carrefour, Coopérative U, Monoprix, and E.Leclerc. France's national cybersecurity agency, CERT-FR, reported compromises involving Danfoss AK-SM and AK-SC controllers, as well as Copeland and Dixell XWEB systems. These systems monitor and manage commercial refrigeration and related building operations. Their compromise can allow unauthorized changes to operating parameters, potentially disrupting temperature control and damaging perishable goods. Separate research by Claroty Team82 identified vulnerabilities affecting Danfoss AK-SM 8xxA controllers, including: CVE-2025-41450, an authentication bypass CVE-2025-41451, an OS command injection vulnerability that can lead to remote code execution CVE-2025-41452, a web server configuration vulnerability that can lead to denial of service Danfoss released fixes for the above vulnerabilities, and organizations should update affected devices to the applicable patched firmware. Additional research by Claroty Team82 and CISA documented vulnerabilities affecting Copeland XWEB Pro controllers, including: CVE-2026-25085, an authentication bypass CVE-2026-21718, an authentication bypass that can enable pre-authentication code execution CVE-2026-24663, an unauthenticated OS command injection vulnerability The affected Copeland models include XWEB300D PRO, XWEB500D PRO, and XWEB500B PRO running firmware version 1.12.1 or earlier. Organizations should consult the vendor's remediation guidance and apply the appropriate firmware updates.
What is the recommended Mitigation?	On October 12, France's national cybersecurity response team, CERT-FR, issued alert CERTFR-2026-ALE-012 warning of numerous compromises involving remote refrigeration controllers. Organizations should immediately remove direct internet exposure from refrigeration controllers and restrict remote administration to secure VPN connections or protected management networks. Review controller configurations, particularly temperature settings and defrost schedules, and apply available firmware updates and vendor-recommended security settings. Change default credentials and replace unsupported, end-of-life devices where necessary. If compromise is suspected, isolate affected equipment and follow vendor and CERT-FR recovery guidance before restoring operations. A factory reset alone is insufficient if the device remains vulnerable and exposed. Organizations should also segment OT networks from corporate IT environments, restrict access to authorized personnel, and monitor for unexpected changes to refrigeration settings. Danfoss identifies firmware R4.2 as the fix for CVE-2025-41450 and R4.3.1 as the fix for CVE-2025-41451 and CVE-2025-41452. Verify the correct release against the specific device model.
What FortiGuard Coverage is available?	• FortiGuard Operational Technology Security Service (OTSS) – Provides OT asset discovery, device identification, protocol-aware monitoring, and security visibility to help identify and assess refrigeration controllers and other OT assets within industrial environments. IoT Device Detection \| FortiGuard Labs IoT Device Detection \| FortiGuard Labs • FortiGate / FortiOS – Enforces network segmentation, access-control policies, and controlled connectivity between enterprise, DMZ, and OT networks, helping prevent unauthorized internet access to refrigeration management systems. • FortiGuard OT Vulnerability Protection – Detects and blocks network-based attacks targeting industrial services and protocols covered by available OT signatures. OT Vulnerability Protection \| FortiGuard Labs OT Vulnerability Protection \| FortiGuard Labs OT Vulnerability Protection \| FortiGuard Labs • FortiPAM – Provides privileged access management for administrative access to critical systems, helping enforce controlled access and stronger authentication for authorized personnel and remote maintenance. • FortiGuard Network Detection and Response (NDR) – Provides network visibility and behavioral detection to help identify anomalous communications and suspicious activity across OT and IT environments. • FortiGuard Incident Response – Supports investigation, containment, and recovery following suspected compromise of refrigeration controllers or other OT infrastructure.

Linux Kernel Remote Code Execution

What is the Attack?	FortiGuard Labs is monitoring CVE-2026-98432, a critical use-after-free vulnerability in the Linux kernel's IPv4 networking subsystem that could allow an unauthenticated remote attacker to execute arbitrary code with kernel-level privileges. The vulnerability stems from improper memory management during TCP connection request processing. Under specific conditions, concurrent operations may access socket-option memory after it has been freed, resulting in a use-after-free condition. An attacker can potentially trigger this flaw by sending specially crafted IPv4 TCP packets containing IP options to a vulnerable system. Exploitation requires precise timing but does not require authentication or user interaction. Successful exploitation could result in kernel memory corruption, information disclosure, denial of service, or potentially remote code execution with kernel-level privileges.
What is the recommended Mitigation?	The vulnerability was introduced in Linux kernel 4.4. The upstream Linux kernel CVE team has published fixes for multiple supported kernel branches. Ubuntu confirmed on November 2 that fixes for Ubuntu 22.04 and newer were available in its proposed repository while undergoing qualification testing. Ubuntu 26.10 already includes the fix. Organizations running potentially affected Linux systems should: 1. Apply security updates: Install the latest kernel security updates provided by the respective Linux distribution. 2. Reboot affected systems: Restart systems after installing the updated kernel to ensure the patched kernel is running. 3. Restrict network exposure: Limit unnecessary inbound TCP connections from untrusted networks. 4. Filter IPv4 packets containing IP options: Red Hat provides an interim nftables rule to reduce exposure to the vulnerable code path.
What FortiGuard Coverage is available?	• FortiGuard Labs continues to monitor CVE-2026-98432, including developments in exploitation research, vendor security updates, and the availability of security patches across affected Linux distributions. • FortiGuard Labs will provide additional updates as new intelligence and protections become available. • FortiGate Intrusion Prevention System (IPS): Provides network-level intrusion prevention and detection against known exploitation attempts targeting CVE-2026-98432. Intrusion Prevention \| FortiGuard Labs • FortiGuard Labs has released a Virtual Patch signature (10010015) to protect vulnerable systems against exploitation of CVE-2026-98432. The signature provides protection at the network layer, helping prevent exploitation attempts without requiring immediate changes to the underlying Linux kernel. FortiGuard Virtual Patching Service \| FortiGuard Labs • FortiGuard Labs has released Endpoint Vulnerability signatures to identify vulnerable Linux kernel components across your network, helping organizations detect potentially affected systems and prioritize remediation. FortiGuard Labs • FortiGuard Incident Response supports investigation, containment, and recovery following suspected compromise of Linux distributions.

Ivanti Connect Secure Zero-Day Exploitation

What is the Attack?	FortiGuard Labs is monitoring active exploitation of multiple zero-day vulnerabilities affecting Ivanti Connect Secure (ICS), an enterprise remote access VPN solution. Threat actors have chained three vulnerabilities (CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527) to achieve unauthenticated root-level code execution on vulnerable appliances. According to security researchers, the attacks have been observed since at least October 1, 2026. The activity was initially attributed to a previously unidentified threat actor tracked by Volexity as UTA0576. The attack chain begins with CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without authentication. Attackers then leverage CVE-2026-111357 to escalate privileges and CVE-2026-118527 to upload attacker-controlled files to predetermined locations on the appliance. Once access is obtained, observed post-exploitation activities include credential theft, Active Directory reconnaissance, data exfiltration, and network scanning. Researchers also reported attempts to retrieve Windows Local Administrator Password Solution (LAPS) credentials and BitLocker recovery keys. Notably, the attackers reportedly deployed no malware or web shells. Instead, they re-exploited the appliance to execute individual commands and manipulated system logs to conceal their activity and evade Ivanti's Integrity Checker Tool. Ivanti confirmed that exploitation affected a limited number of customers before disclosure. CISA has now added all three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
What is the recommended Mitigation?	Ivanti Connect Secure appliances running the following versions are affected: - Version 25.1.1.2 and earlier. - Version 25.1.2.2 and earlier. - Version 22.8R2.5 and earlier. Organizations using Ivanti Connect Secure should immediately apply the latest available security updates. Recommended actions: - Upgrade Ivanti Connect Secure to a fixed release. Versions 25.1.1.3 and 22.8R2.6 address the two additional vulnerabilities. Organizations should follow Ivanti's current upgrade guidance for their specific release branch. Do not assume that installing the earlier October update for CVE-2026-104935 provides complete protection. The subsequent vulnerabilities require additional updates. - Conduct network and memory forensics to identify potential signs of compromise. Ivanti's Integrity Checker Tool alone may not identify all exploitation activity. - If compromise is suspected, follow Ivanti's recovery procedures, including factory resetting affected appliances, rebuilding virtual instances where applicable, and upgrading to a fixed release. - Reset potentially exposed administrator, domain, and local account passwords. Revoke and reissue stored certificates and reset API keys and other stored credentials.
What FortiGuard Coverage is available?	FortiGuard Labs continues to monitor exploitation attempts involving Ivanti Connect Secure and the associated attack techniques. FortiGuard customers should use multiple layers of defense to help identify and mitigate suspicious activity associated with the exploitation chain: • FortiGate Intrusion Prevention System (IPS): Provides network-level intrusion prevention and detection against known exploitation attempts targeting CVE-2026-104935. https://www.fortiguard.com/encyclopedia/ips/62610 • FortiEDR: Behavioral detection capabilities can help identify suspicious command execution, credential theft, and other post-exploitation activity on monitored endpoints. • FortiGuard Incident Response: Organizations suspecting compromise can engage FortiGuard Incident Response for investigation, containment, and remediation.

Node.js Brotli Remote Code Execution (Node2Shell)

What is the Vulnerability?	CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web communications and is bundled with Node.js through its `zlib` module. Brotli is an open-source project developed and maintained by Google for lossless data compression. It shrinks files so they can be transmitted faster without affecting the original data. The vulnerability occurs when the decoder processes specially crafted Brotli-compressed input. An attacker who can supply malicious compressed data to a vulnerable application may corrupt adjacent memory, potentially leading to information disclosure, denial of service, or remote code execution. The root cause is an error in the decoder's handling of malformed block-switch commands. Under certain conditions, the streaming decoder incorrectly treats an invalid block switch as a request for additional input rather than a format error. This can cause data to be written beyond the bounds of an internal eight-byte buffer, corrupting adjacent process memory. The vulnerability affects Google Brotli versions 1.0.3 through 1.2.0. Fixed versions include 1.0.10, 1.1.1, and 1.2.1, depending on the release branch. The Node.js project has also released patched versions for affected release lines. On October 22, 2026, Imperva published research demonstrating remote code execution against a vulnerable Node.js build. Public proof-of-concept references are also listed in Red Hat's vulnerability bulletin, increasing the risk to unpatched deployments.
What is the recommended Mitigation?	Organizations should prioritize updating vulnerable Node.js deployments and Brotli libraries to fixed versions. Because the vulnerability can lead to remote code execution, systems that process untrusted compressed content should receive particular attention. Recommended actions: 1. Apply security updates: Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1, as appropriate, or a later fixed release. Update standalone Brotli packages to the applicable fixed version. 2. Review application exposure: Identify services that decompress untrusted Brotli data, including applications using node:zlib, HTTP clients processing compressed responses, and middleware that decompresses incoming request bodies. 3. Apply temporary restrictions where feasible: Until updates are deployed, limit untrusted Brotli-compressed traffic on affected application paths where operationally practical. Test any restrictions to avoid disrupting legitimate traffic. 4. Investigate suspicious activity: Review application and process logs for unexpected crashes or decompression errors. Correlate anomalies with incoming traffic and runtime versions; these symptoms alone do not confirm exploitation. 5. Rebuild and redeploy affected containers: Ensure production images and bundled dependencies include the patched runtime or library rather than relying solely on host-level updates.
What FortiGuard Coverage is available?	• FortiGuard Labs is monitoring CVE-2026-111497 and will update this Threat Signal as new threat intelligence and protection information become available. Organizations should prioritize patching affected Node.js deployments and Brotli libraries, particularly where applications process untrusted compressed data. • FortiGuard Labs has available IPS signatures to detect and protect against attacks targeting CVE-2026-111497. https://www.fortiguard.com/encyclopedia/ips/62703 • FortiGuard Antivirus & Behavior Detection detects and blocks malicious files, web shells, and other payloads that may be delivered following successful exploitation. • FortiGuard Web Filtering blocks access to known malicious domains, command-and-control infrastructure, and payload-hosting locations associated with post-exploitation activity. • FortiGuard Indicators of Compromise (IOC) Service can help identify known indicators associated with compromise and malicious infrastructure. • FortiEDR provides endpoint detection and response capabilities for suspicious post-exploitation activity on systems that may be affected following compromise. • FortiGuard Incident Response – Supports investigation, containment, and recovery following suspected compromise of PLCs or OT infrastructure.

PHP2Shell Remote Code Execution Vulnerabilities

What is the Vulnerability?	The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP's internal request-processing and memory-management behavior that can be triggered when handling malicious requests. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). • CVE-2026-109618 - RCE via out-of-memory corruption: An out-of-memory condition can interrupt PHP while internal request data is only partially initialized. Subsequent request-cleanup operations may incorrectly process this invalid data, potentially enabling remote code execution. • CVE-2026-109619 - RCE via stale global state: Internal request state can persist after its associated memory has been freed. A later request handled by the same worker may access this stale state before normal initialization resets it, potentially enabling remote code execution. Successful exploitation could compromise the PHP application process and potentially provide access to sensitive server resources, application data, or databases, depending on the permissions of the affected process and the surrounding environment. PHP announced emergency security updates for October 21, 2026, following reports that details of the vulnerabilities had leaked ahead of the planned disclosure. Subsequent reports highlighted ongoing exploit research and potential attack activity, underscoring the urgency of applying the available patches. However, widespread exploitation of either vulnerability has not been independently confirmed.
What is the recommended Mitigation?	The vulnerabilities affect PHP installations that process web requests, including deployments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP identifies Apache deployments using mod_php as particularly at risk because a demonstrated exploit can trigger before application code runs. Organizations should prioritize patching internet-facing PHP servers and other exposed deployments immediately. 1. Apply the security updates. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, as appropriate. Organizations using vendor-maintained packages should apply the corresponding security updates from their distributions or service providers. 2. Reduce exposure until patching is complete. Where immediate remediation is not possible, isolate affected systems from untrusted networks or temporarily disable exposed services when operationally feasible. 3. Review request-processing limits. Apply appropriate web-server or reverse-proxy limits for request sizes, input fields, multipart sections, headers, and nesting depth. These controls can reduce exposure but are not a substitute for patching. 4. Review potentially vulnerable systems. Investigate suspicious web requests, unexpected PHP worker behavior, unexplained process execution, and unusual access to application files or databases. Prioritize internet-facing systems and investigate potential compromise before returning affected services to production. PHP 8.1 and older are no longer supported by the PHP project and do not receive its standard security updates. Organizations using these versions should check whether their operating-system vendor provides backported fixes or migrate to a supported release.
What FortiGuard Coverage is available?	• FortiGuard Labs recommends a defense-in-depth approach to reduce exposure to attacks targeting vulnerable PHP deployments and is currently monitoring the situation and will provide updates as new information becomes available and additional protections are released. • FortiGuard Labs has released IPS signatures to detect and protect against attacks CVE-2026-109619, CVE-2026-109618 & CVE-2026-115560. [IPS version 37.317] Intrusion Protection \| FortiGuard Labs Intrusion Prevention \| FortiGuard Labs • FortiGuard Labs has virtual patches available for the vulnerabilities ( CVE-2026-109619 & CVE-2026-109618 ) released in version 37.316. https://www.fortiguard.com/encyclopedia/otips/10009977 https://www.fortiguard.com/encyclopedia/otips/10009978 • FortiCNAPP Vulnerability Management Service: Detects CVE-2026-109618 and CVE-2026-109619 in PHP packages installed from Linux distribution repositories. Ubuntu, Debian, and Alpine Linux 3.24 have published fixes. RHEL and its rebuilds, Amazon Linux, and SUSE have not yet published fixes; accordingly, findings for these distributions may not include a fixed version until the respective vendors release updates. Technical Tip: How does FortiCNAPP Protect from CVE-2026-109618 & CVE-2026-109619, PHP Remote Code Execution Vulnerabilities \| Community • FortiGuard Web Application Firewall (FortiWeb): Where applicable, review web application protection policies and request inspection controls to help identify or block malicious HTTP requests. These controls should not be considered a replacement for the PHP security updates. FortiWeb: Version 0.00438 https://www.fortiguard.com/encyclopedia/fwb/1090502648 • FortiGuard Antivirus and Behavior Detection: Use available malware detection and behavioral protections to help identify suspicious payloads or post-exploitation activity associated with a compromised web server. • FortiGuard Incident Response: If exploitation is suspected, investigate the affected server, identify potential persistence mechanisms, determine whether sensitive data or credentials were accessed, and contain any confirmed compromise. • For information on Fortinet products affected by this vulnerability, please refer to the Fortinet PSIRT Advisory (FG-IR-26-186). PSIRT \| FortiGuard Labs • Please refer to the Outbreak Alert report for full analysis of solutions available and comprehensive information on the range of FortiGuard services available for detection and protection. PHP2Shell Remote Code Execution Vulnerabilities \| Outbreak Alert \| FortiGuard Labs

Trimble Cityworks Remote Code Execution Attack

What is the Attack?

Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services (IIS) web server, potentially resulting in downtime and potential loss of service.

According to Trimble Cityworks website, it provides a Geographic Information System (GIS)-centric solution for local governments, utilities, airports, and public works agencies to manage and maintain infrastructure across the full lifecycle.

Trimble has investigated customer reports of hackers exploiting the vulnerability to gain unauthorized access to networks, confirming that active exploitation is occurring. CISA has added CVE-2025-0994 to its Known Exploited Vulnerabilities Catalog on February 7, 2025, based on the evidence of active exploitation.

What is the recommended Mitigation?

• The CVE-2025-0994 flaw impacts Cityworks versions prior to 15.8.9 and Cityworks with office companion versions before 23.10.
• Trimble has released updates addressing this deserialization flaw. Ensure these updates are applied to your systems.

What FortiGuard Coverage is available?

• FortiGuard Labs recommends users to apply the fix when provided by the vendor and follow any instructions as mentioned on the vendor?s advisory.
• FortiGuard Labs has blocked all the known malware and related Indicators of Compromise (IOCs) noted on the campaign.
• The FortiGuard Incident Response team can be engaged to help with any suspected compromise.

Atlassian Arbitrary File Access Vulnerability

What is the Attack?	CVE-2026-21589 is a critical arbitrary file access vulnerability affecting multiple Atlassian Data Center and Server products. It allows an unauthenticated remote attacker to access specific files within an affected application's web root, provided the attacker knows the exact file path and name. The vulnerability stems from improper restrictions on access to files within the web application root. Successful exploitation could expose sensitive files and potentially provide information useful for further attacks, depending on the affected application's configuration and the files accessible. The vulnerability requires no authentication or user interaction, making internet-facing deployments a priority for remediation.
What is the recommended Mitigation?	Atlassian published its security advisory on October 5, 2026, and recommends immediate remediation for affected installations. Atlassian recommends that you patch each of your affected installations to fixed versions or the latest version.
What FortiGuard Coverage is available?	• FortiGuard Labs continues to monitor CVE-2026-21589 and associated attack activity. We will provide updates as new intelligence, detections, and protections become available. • FortiGuard Labs has released an IPS signature to detect and protect against attack attempts targeting CVE-2026-21589 affecting multiple Atlassian Data Center and Server products. • FortiGuard Labs recommends applying the security updates provided by Atlassian to affected products. • FortiGuard Antivirus & Behavior Detection detects and blocks malicious files, web shells, and other payloads that may be delivered following successful exploitation. • FortiGuard Web Filtering blocks access to known malicious domains, command-and-control infrastructure, and payload-hosting locations associated with post-exploitation activity. • FortiGuard IoC Service helps identify known indicators of compromise and malicious infrastructure associated with related threats. • FortiEDR provides endpoint detection and response capabilities to help identify suspicious post-exploitation activity on potentially compromised systems.

Citrix NetScaler RCE zero-day Vulnerabilities

What is the Attack?	Threat actors are actively exploiting two critical remote code execution vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting Citrix NetScaler ADC and NetScaler Gateway appliances. Citrix confirmed that both vulnerabilities were exploited in the wild before security updates were available. CISA has subsequently added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and reported that threat intelligence confirms exploitation globally. CVE-2026-88771 is an improper input validation vulnerability that can allow an unauthenticated remote attacker to execute arbitrary commands. It affects NetScaler deployments without requiring an additional feature to be enabled. CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial-of-service conditions. It affects appliances with DTLS enabled, which is enabled by default for VPN virtual servers. Both vulnerabilities have a CVSS v4 score of 9.5.
What is the recommended Mitigation?	Organizations should immediately identify exposed NetScaler ADC and Gateway appliances and apply the security updates provided by Citrix. Fixed releases include NetScaler ADC/Gateway 14.1-73.37 and later and 13.1-64.23 and later, with corresponding updates for FIPS and NDcPP builds. Because both vulnerabilities were exploited as zero-days before patches were available, patching alone should not be treated as confirmation that an appliance was not compromised. Organizations should review NetScaler and supporting security logs for suspicious activity, preserve forensic evidence where compromise is suspected, and investigate the appliance before making changes that could destroy evidence. If compromise is suspected, organizations should isolate the affected appliance, review administrative and outbound connections, investigate for persistence, and consider resetting credentials, invalidating sessions, and replacing potentially exposed certificates or keys.
What FortiGuard Coverage is available?	• FortiGuard Labs continues to monitor this vulnerability and associated attack activity. We will provide updates as new intelligence, detections, and protections become available. • FortiGuard Labs has released an IPS signature to detect and protect against attack attempts targeting CVE-2026-88771 vulnerability. Intrusion Prevention \| FortiGuard Labs • FortiGuard Labs has released an IPS signature to detect and protect against attack attempts targeting CVE-2026-88772 vulnerability. Intrusion Prevention \| FortiGuard Labs • FortiGuard Antivirus & Behavior Detection detects and blocks malicious files, web shells, and other payloads that may be delivered following successful exploitation. • FortiGuard Web Filtering blocks access to known malicious domains, command-and-control infrastructure, and payload-hosting locations associated with post-exploitation activity. • FortiGuard IoC Service can help identify known indicators associated with compromise and malicious infrastructure. • FortiEDR provides endpoint detection and response capabilities for suspicious post-exploitation activity on systems that may be affected following compromise.

Citrix NetScaler ADC and NetScaler Gateway RCE

What is the Vulnerability?	FortiGuard Labs has observed active network telemetry relating to CVE-2025-7775, a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that enables remote code execution (RCE) and denial of service (DoS) under certain pre-conditions. Exploitation on unpatched appliances has been confirmed, and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog. Citrix advisories also address: CVE-2025-7776 – a memory overflow issue causing DoS when NetScaler is configured as a Gateway (PCoIP). CVE-2025-8424 – an improper access control flaw affecting the management interface. Recent industry reporting highlights that adversaries increasingly leverage AI-driven exploit development frameworks such as Hexstrike-AI, which integrate large language models (LLMs) with fuzzing and orchestration. These toolchains reduce the time from disclosure to weaponized zero-day exploitation, increasing the urgency for patching.
What is the recommended Mitigation?	The organizations using Citrix NetScaler ADC and NetScaler Gateway appliances are strongly recommended to: - Review and follow the official Citrix security bulletins. - Apply all relevant patches and updates as soon as possible. - Monitor for any suspicious activity, such as dropped web shells or abnormal memory behavior.
What FortiGuard Coverage is available?	Intrusion Prevention System (IPS): FortiGuard IPS Service is available to detect and block exploit attempts targeting CVE-2025-7775. Intrusion Prevention \| FortiGuard Labs Web Application Security: FortiGuard Web Security Service is available to detect and block exploit activity. Web Application Security \| FortiGuard Labs Incident Response Service: The FortiGuard Incident Response team is available to assist with any suspected compromise.

GitLab Path Traversal vulnerability

What is the Vulnerability?	FortiGuard Labs has observed attack activity targeting CVE-2026-85706, a critical path traversal vulnerability in GitLab Community Edition and Enterprise Edition. The vulnerability affects the repository commits API and can allow an unauthenticated remote attacker to read arbitrary files from a vulnerable GitLab server due to improper path confinement and missing authentication enforcement. The vulnerability carries a CVSS score of 10.0 and requires no privileges or user interaction. FortiGuard telemetry observed over the last 7 days shows attack activity targeting CVE-2026-85706 across multiple countries and industries. The most targeted countries include Belarus, South Korea, Germany, the People’s Republic of China, and Thailand, while the most targeted industries include Education, Technology, Telco/Carrier, Media/Communications, and Banking/Finance/Insurance.
What is the recommended Mitigation?	Affected versions include: GitLab 18.7 to before 19.1.8 GitLab 19.2 to before 19.2.6 GitLab 19.3 to before 19.3.2 • Upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or later, as applicable. • Prioritize externally exposed GitLab instances for remediation. • Restrict unnecessary Internet exposure of GitLab services. • Review GitLab and web-server logs for unexpected requests to repository/API endpoints. • Investigate potentially exposed credentials, configuration files, tokens, and other sensitive information if exploitation is suspected. • Rotate credentials or secrets that may have been accessible from the GitLab server.
What FortiGuard Coverage is available?	• FortiGuard IPS Service: FortiGuard IPS signature 62167 detects and blocks network-based exploitation attempts targeting CVE-2026-85706. Intrusion Prevention \| FortiGuard Labs • FortiGate: Offers IPS protection to help prevent exploitation attempts against vulnerable GitLab deployments. • FortiGuard Vulnerability Management: Helps identify vulnerable assets and prioritize remediation based on exposure and risk. • FortiEDR: Offers additional endpoint detection and response capabilities if exploitation leads to suspicious activity on the underlying GitLab server. • FortiGuard Incident Response Service: Assists organizations in investigating potential compromise, determining the scope of attacker activity, and supporting containment, remediation, and recovery efforts following exploitation.

FortiGuard Labs | FortiGuard Center - Threat Signal Report