Actively Exploited Cisco, Fortinet, Citrix, and SharePoint Flaws Put Atlanta Businesses on Alert
What You Need to Know About This Week’s Actively Exploited Cisco and Fortinet KEV Additions, the Urgent Citrix NetScaler Zero-Days, and Why Recent SharePoint Exposure Still Deserves Attention
A new wave of actively exploited vulnerabilities is putting network management systems, email gateways, collaboration servers, and remote-access infrastructure under pressure. Cisco, Fortinet, and Microsoft environments are affected, while two fresh Citrix NetScaler zero-days remain urgent concerns for businesses that rely on remote access.
Simply put, a vendor releasing a patch does not mean your Atlanta business is protected. Your systems must be identified, updated, restarted when necessary, checked for signs of compromise, and verified after remediation.
Why are these zero-days urgent for your business?
A zero-day is a vulnerability that attackers are exploiting before many organizations have had time to apply a fix. Once a flaw is added to CISA’s Known Exploited Vulnerabilities Catalog, it becomes a priority because exploitation has been observed in real attacks, not merely demonstrated in a lab.
These headline vulnerabilities are serious, but their severity should be understood per issue rather than as one blanket score. More importantly, they affect systems that often sit at the edge of your business: management consoles, gateways, email security platforms, on-premises SharePoint farms, and remote-access appliances.
Under CISA’s BOD 26-04 risk-based framework, the highest-risk vulnerabilities can require remediation within three calendar days, along with forensic triage. Other cases may receive 14- or 60-day timelines depending on internet exposure, exploit automation, and technical impact. For an internet-facing system under active attack, however, “we will patch it during the next maintenance window” may already be too slow.
What do the Cisco, Fortinet, and Microsoft vulnerabilities do?
Could Cisco Catalyst SD-WAN Manager allow an attacker to become an administrator?
CVE-2026-76504 affects Cisco Catalyst SD-WAN Manager. In plain English, an unauthenticated remote attacker can send a specially crafted HTTP request that takes advantage of improper URI encoding and bypasses an authentication rule.
If successful, the attacker may access the API with administrator privileges. That could expose network configurations or allow unauthorized changes to the systems that control your connectivity between offices, stores, clinics, plants, and cloud services.
Cisco’s remediation guidance recommends collecting diagnostic files before upgrading, applying the vendor-recommended fixed release for your environment, and checking for indicators of compromise afterward. Cisco also states that there is no workaround that fully addresses the issue. Read the Cisco remediation guidance and confirm through Cisco’s advisory that the appropriate fix for your release train has been applied.
How can a FortiMail path traversal flaw become a file-writing attack?
CVE-2026-104286 affects Fortinet FortiMail. This is a path traversal and null-character handling vulnerability that may allow an unauthenticated attacker to write arbitrary files to the underlying system through crafted HTTP or HTTPS requests.
Path traversal is a devious method of escaping the application’s expected directory and reaching locations that should be off limits. Arbitrary file writing matters because attackers may use it to alter configuration, plant malicious content, or establish a foothold for a larger compromise.
CISA’s KEV entry shows a near-term remediation deadline and requires forensic triage under BOD 26-04. If your FortiMail system is internet-facing, treat this as an emergency change rather than a routine update. Review the CISA KEV entry and Fortinet’s vendor guidance before applying mitigations or upgrades.
Why should on-premises SharePoint owners still pay attention?
CVE-2026-58644 is not one of this week’s new KEV additions, but it remains a recent KEV-listed Microsoft SharePoint Server deserialization-of-untrusted-data vulnerability that many businesses may still be exposed to. Deserialization is the process of turning data into an object that an application can use. When that process fails to validate what it receives, an attacker may be able to send specially crafted data that the server processes in an unsafe way.
For a business running on-premises SharePoint, the risk is especially practical. SharePoint may contain client records, legal documents, finance files, patient-related workflows, manufacturing information, or internal operational data. A Microsoft cloud service update does not automatically update your locally hosted SharePoint farm, its application servers, or its connected databases.
Your team should confirm the exact SharePoint versions in use, identify internet exposure, apply the relevant Microsoft update, and verify that every server in the farm received it. Use CISA’s KEV catalog and Microsoft’s security guidance to confirm the current remediation requirements.
Are Citrix NetScaler customers still exposed?
Yes. Two additional zero-days remain fresh:
- CVE-2026-88771 enables unauthenticated attackers to execute arbitrary commands on affected Citrix NetScaler ADC and Gateway deployments. The issue affects default configurations.
- CVE-2026-88772 is a memory overflow vulnerability that may enable remote code execution or denial of service when DTLS is enabled. DTLS is enabled by default on NetScaler Gateway VPN virtual servers.
Citrix has confirmed exploitation of unmitigated deployments and recommends upgrading to fixed releases, including 14.1-73.37 or later and 13.1-64.23 or later, with separate fixed versions for supported FIPS and NDcPP builds. The Citrix security bulletin also recommends checking for indicators of compromise.
This matters to Atlanta law firms, finance teams, healthcare practices, manufacturers, and other businesses that use remote-access gateways. A compromised gateway can become the weapon of choice for reaching internal systems without first persuading an employee to click a suspicious link.
Why does “the vendor patched it” not mean your business is patched?
A vendor patch closes a vulnerability in the software release. It does not automatically prove that your specific environment is safe.
Your business may still have:
- An overlooked appliance or secondary server
- A clustered node that missed the update
- A failed patch job that reported success incorrectly
- A device running an unsupported release
- A cloud-managed system with a different update process
- A firewall rule exposing a management interface unnecessarily
- Credentials or sessions that should be reset after possible exploitation
- Logs that were never preserved before the upgrade
This is why effective remediation has three stages: identify, remediate, and verify. You need an accurate asset inventory, emergency patching or mitigation, and a post-change check confirming the running version and service status. If the vulnerability was actively exploited, you also need log review and forensic triage, not just a green checkmark in a patch-management console.
What is hiding below the iceberg?
The visible zero-day is only the tip. Below the iceberg are the conditions that determine whether an exploit becomes a business interruption:
- Unknown assets: Are all firewalls, gateways, servers, and management consoles documented?
- Unverified backups: Could you restore critical files if ransomware followed an intrusion?
- Flat networks: Could an attacker move from a compromised gateway to POS systems, medical systems, or finance workstations?
- Weak administrative access: Are management interfaces restricted to trusted networks and protected with strong authentication?
- Missing logs: Can you determine whether suspicious requests occurred before patching?
- Operational dependencies: Can you patch a retail, healthcare, or manufacturing system without disrupting the business?
- Compliance exposure: Would the incident affect HIPAA, PCI, contractual, or legal obligations?
These risks are checked through asset discovery, version validation, firewall and segmentation reviews, backup restoration testing, log analysis, privileged-access reviews, and documented remediation evidence. That work is precisely what turns “we installed the update” into a defensible security outcome.
How should a proactive managed IT provider respond?
A proactive provider should monitor vendor and CISA alerts, match new CVEs against your actual environment, and prioritize systems based on exposure and business impact. When necessary, the response includes emergency patching, temporary access restrictions, network segmentation, credential review, and incident triage.
Afterward, the provider should verify the running software version, confirm that services are functioning, inspect relevant logs, and document what changed. For Cisco Catalyst SD-WAN Manager, for example, Cisco recommends collecting diagnostic information before upgrading and checking for indicators afterward. That sequence helps preserve evidence instead of accidentally erasing it during a rushed change.
At 1080 Titan Technologies, our managed IT services combine proactive monitoring, security updates, vendor coordination, and flat-rate support. Our security services also address network security, endpoint protection, email security, monitoring, and compliance-minded planning.
What should Atlanta businesses do today?
Start with these five actions:
- Ask whether you use any affected technologies. Check for Cisco Catalyst SD-WAN Manager, FortiMail, Citrix NetScaler ADC, Citrix NetScaler Gateway, and any on-premises SharePoint environment that may still need remediation review.
- Confirm internet exposure. Management consoles and remote-access gateways deserve immediate attention.
- Check exact versions, not product names. Fixed releases vary by branch, appliance, and deployment model.
- Preserve logs before making major changes. This can support compromise checks and incident response.
- Verify the patch afterward. Confirm the running version, reboot status, service health, and security-control effectiveness.
Managed IT services for small businesses typically range from $100–$250 per user per month, with $125–$200 per user per month being a common planning range. The right cost depends on your users, infrastructure, security requirements, compliance obligations, and the level of proactive coverage you need.
Is your Atlanta business ready for the next emergency patch?
The exploit window often closes in days, not months. If you are unsure whether a vendor patch reached every system, or whether an internet-facing gateway has already been targeted, now is the time to verify rather than assume.
7 spots available this month for Tech Check. A Tech Check can help identify exposed systems, unverified updates, remote-access risks, backup gaps, and the practical next steps for your business. Talk with 1080 Titan Technologies or explore the AI & Cybersecurity Readiness Initiative to start with the facts and build a practical sequence forward.