Search: CVE-2026-104935

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

CVE-2026-102764 is a critical authentication bypass vulnerability in BeyondTrust Remote Support versions 26.2.3 and earlier. It enables unauthenticated remote attackers to perform arbitrary file operations without user interaction. Exploitation in the wild has been confirmed, involving deployment of web shells and tunneling tools, root privilege escalation, credential vault extraction attempts, persistence mechanisms, and log deletion. The threat actor ARMORY CASTLE, linked to PRC-nexus espionage, is attributed to these attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities list. Emergency patching and thorough compromise investigations are required, as patching alone does not remove attacker persistence.

In October 2026, Citrix NetScaler ADC appliances running affected 14.1 builds were compromised through a chain of two vulnerabilities: CVE-2026-88771 and CVE-2026-88779. Attackers achieved root code execution by exploiting a pre-authentication log-poisoning/RCE vulnerability and a SAML-parsing crash. The intrusion involved deploying PHP web shells, modifying system shells, creating cron jobs, and establishing boot hooks for persistence. Additional tools included TCP session managers, HTTP tunnels, and reverse agents for command-and-control. Attackers used a Go-based reconnaissance tool to map internal infrastructure and synchronized implants across appliance pairs to maintain persistence. The campaign exfiltrated NetScaler configurations, historical data, and key material, evolving from initial access to a persistent internal reconnaissance platform.