Three Perimeter Vendors, One Week: Citrix, F5 and Check Point All Land on CISA's Exploited List

Week of 28 September 2026 | Compiled by Team Paringa

Every organisation's front door — VPN gateway, load balancer, firewall management console — became this week's most contested ground, as three tier-one security vendors disclosed actively exploited zero-days within days of each other.

What Happened This Week

🔴 Citrix confirms unauthenticated RCE zero-days exploited before patches existed

Citrix disclosed on 26-27 September that two critical vulnerabilities in NetScaler ADC and NetScaler Gateway — CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5 — were being exploited in the wild against unmitigated appliances, with no interim workaround available. CVE-2026-88771 is an improper input validation flaw letting an unauthenticated attacker run arbitrary commands on the default configuration; CVE-2026-88772 is a memory overflow affecting DTLS-enabled deployments, the default for VPN configurations. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on 27 September, and BleepingComputer reported the Dutch NCSC observed exploitation at multiple Citrix customers worldwide before public disclosure.

Security research firm watchTowr, which said its Rapid Reaction platform identified affected instances among clients before the CVEs were even assigned, noted no public attribution exists yet but that "historically, NetScaler vulnerabilities have been exploited by both state-sponsored groups and ransomware operators" — a reference to the CitrixBleed lineage that has repeatedly turned NetScaler appliances into initial-access footholds for major ransomware campaigns. Affected versions span NetScaler 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, including FIPS variants. Citrix's only guidance for organisations that cannot patch immediately is to reduce internet exposure — there is no mitigating configuration change.

Sources: BleepingComputer | watchTowr | CISA KEV Catalog

Clients running NetScaler as a VPN or ADC front door need to treat this as a today problem, not a this-sprint problem — there is no config workaround, only patch or pull it offline. This is the same appliance family that produced CitrixBleed and CitrixBleed 2; ransomware crews watch this CVE class specifically because it has repeatedly delivered domain-wide access. Any client still running unpatched NetScaler into next week should assume compromise, not just exposure, and start hunting for webshells and anomalous session activity now.

🟡 F5 and Check Point join Citrix on the exploited-in-the-wild list, same week

Within days of the Citrix disclosure, two more perimeter-security vendors confirmed active exploitation of their own critical flaws. F5 patched CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager affecting systems configured as an OAuth authorization server, on 23 September; CERT-EU rated it CVSS 9.8 and stated F5 had "confirmed active exploitation in the wild," recommending organisations preserve forensic evidence and check for repeated OAuth authentication failures as a compromise indicator. The Register reported CISA gave federal agencies until that Friday to patch. Separately, Check Point disclosed CVE-2026-93616 (unauthenticated script execution against Security Management servers) and CVE-2026-85102 (improper certificate validation), both CVSS 9.8, with CISA adding both to KEV on 22 September after confirming targeted exploitation.

Three vendors whose products exist specifically to sit at the network edge and enforce security policy all shipped exploited-in-the-wild critical flaws in the same seven-day window — a pattern that should worry anyone treating perimeter appliances as a "set and forget" control layer.

Sources: CERT-EU | The Register | SecurityWeek

The edge is the new endpoint. If a client's patch cadence for firewalls, load balancers and VPN gateways is measured in weeks rather than days, that gap is now the most likely initial-access vector into their estate — ahead of phishing, ahead of credential stuffing. We'd advise any client running F5, Check Point or Citrix at the perimeter to confirm patch status against these four CVEs this week, not at the next change window.

🟡 Anthropic discloses largely autonomous, multi-agent AI attack campaigns

Anthropic's September threat intelligence report identified multiple state and criminal groups running AI-driven attack operations against dozens of organisations at a time with minimal human direction. One group, tracked as GTG-50014 and linked to ShinyHunters, used Claude to download and scan 1.8 million Android APKs for hardcoded secrets across roughly 50 target organisations. A separate Russian-linked operation (GTG-50020) ran reconnaissance and exploitation against roughly 30 AI vendors in a four-day window, while a China-based group (GTG-10007) targeted roughly 50 organisations spanning education, energy, healthcare, finance and government. Anthropic characterised the most advanced cases as "multi-agent frameworks conducting reconnaissance, exploitation, and theft against multiple victims, in parallel, for hours or days" with limited human oversight — a step change from AI-as-assistant to AI-as-operator.

Sources: Anthropic | The Hacker News

This is vendor-reported (Anthropic disclosing misuse of its own product) but corroborated by the specificity of the named threat-group activity and independent pickup from The Hacker News and Recorded Future's The Record. The practical implication for SOC teams: attack timelines that used to unfold over days of human reconnaissance can now compress into hours of unattended multi-agent execution. Detection and response playbooks tuned to human attacker pacing need re-testing against this faster tempo.

What CISOs Are Dealing With

The pattern beneath this week's headlines is a shift in where breaches start. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation overtook credential abuse as the leading breach vector for the first time — roughly 31% of breaches versus 13% for credential abuse — even as 62% of all breaches still involved a human element somewhere in the chain. Perimeter appliances (VPN gateways, load balancers, firewall management planes) are the concentrated expression of that shift: they are internet-facing by design, run vendor code CISOs can't audit, and — as this week showed with Citrix, F5 and Check Point simultaneously — increasingly get discovered and weaponised by attackers before defenders even have a CVE number to search for.

Layered onto that is the agentic AI dimension: Anthropic's disclosure shows attackers are no longer bottlenecked by human analyst time once initial access is achieved. For SOC and MDR/XDR operations, that means the assumption that "dwell time gives us a detection window" is eroding for the subset of intrusions now running on autonomous multi-agent tooling.

Three Things Worth Watching Next Week

1. Citrix patch adoption rates — Expect follow-on reporting on how many NetScaler instances remain unpatched a week after disclosure, and likely ransomware-affiliate activity riding the same access.

2. Further KEV additions to the same edge-appliance class — WSO2, Adobe Commerce/Magento, MikroTik RouterOS and WordPress Core all joined KEV in the same week (24-25 September); watch for a consolidated advisory tying these together as one exploitation wave.

3. Other AI labs' misuse disclosures — With Anthropic setting a public-disclosure precedent, watch for OpenAI, Google DeepMind or Microsoft to publish comparable agentic-misuse threat reports, which would confirm this is an industry-wide pattern rather than a Claude-specific one.

Could not verify: Direct CISA.gov alert pages (cisa.gov/news-events/alerts/...) returned 403 errors on every fetch attempt; all KEV-catalog claims in this brief were instead verified against the CISA KEV JSON mirror (github.com/cisagov/kev-data), which is treated as equivalent Tier 1 data per standing guidance. No source provided a numeric count of internet-exposed/compromised NetScaler, F5, or Check Point instances — treat any such figure circulating elsewhere as unconfirmed.

Questions? hello@paringa.ai

Paringa's cyber practice exists for exactly this week: when three perimeter vendors land on the exploited list in seven days, the question isn't whether you're patched — it's whether your SOC would know within the hour if you weren't. | 28 September 2026 | © Paringa Ltd