Today’s Field Note

Edge boxes are the story again, because they always are. Citrix is urging immediate patching of CVE-2026-107406, a memory overflow in NetScaler ADC and Gateway that can reach RCE or DoS under certain SAML configurations. Meanwhile, two unpatched AhsayCBS backup flaws (CVE-2026-105133, an auth bypass, and CVE-2026-105134, OS command injection) are already being exploited in the wild, which is the exact combination that turns a backup server into an attacker’s foothold. Add Cisco’s batch of critical NX-OS bugs allowing root-level code execution on Nexus switches, and the pattern is clear: the perimeter and the fabric behind it are both in play this week. Patch availability is not the same as patch applied, and attackers know the gap.

Today’s Action

  • Inventory all internet-facing NetScaler ADC and Gateway instances, confirm SAML usage, and apply the CVE-2026-107406 fix now. Rotate sessions and check for post-exploit persistence given NetScaler’s history.
  • Treat AhsayCBS as compromised until proven otherwise. No vendor patch exists for CVE-2026-105133/105134, so restrict management access to trusted IPs and hunt for anomalous OS commands and new accounts.
  • Prioritize the Cisco NX-OS critical advisories on your Nexus switches; schedule emergency maintenance for anything reachable from untrusted segments.
  • Pull external exposure reports for all three product families and confirm what is actually listening, not what you think is listening.
  • Verify backup integrity and isolation specifically, since AhsayCBS sits directly in the recovery path.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

You patched the firewall; the backup server let them in anyway.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.