Warnings and recommendations from national cyber security agencies, newest first. Each brief is at most 120 words, bottom line first, and links to the publication it was written from.
CERT-EU · Advisory ·
2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and Gateway have critical vulnerabilities.
CVE-2026-19489 and CVE-2026-19490 affect NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21. These vulnerabilities can lead to Denial of Service or authentication bypass. CERT-EU recommends updating affected devices.
Recommended by the publisher: CERT-EU recommends updating affected devices as soon as possible.
CVE-2026-65609, CVE-2026-65610, CVE-2026-65611 and CVE-2026-65612 affect nnn software version 5.2. An attacker can exploit these to corrupt memory or execute shell commands. The maintainer of nnn was notified.
Recommended by the publisher: CERT Polska recommends checking with the maintainer for patched versions.
Carbone software vulnerability affects versions before 3.8.2.
Carbone software is vulnerable to Denial of Service due to improper handling of highly compressed data. An attacker can supply a malicious .docx file containing a zip bomb. The issue was fixed in versions 3.8.2, 4.26.3 and 5.4.4.
Recommended by the publisher: Update to a fixed version.
Vulnerability in OutSystems Service Center software
OutSystems Service Center has XSS vulnerability.
OutSystems Service Center versions before 11.41.2 are vulnerable to DOM-based Cross-Site Scripting. A low-privileged attacker can exploit this via a malicious filename. The issue was fixed in version 11.41.2.
Recommended by the publisher: Update to OutSystems Service Center version 11.41.2.
Defending Against an Active Threat to Siemens S7 Series PLCs
CISA warns of active threat to Siemens S7 Series PLCs.
The threat concerns Siemens S7 Series PLCs, including S7-200, S7-300, S7-400, S7-1200, and S7-1500 Series. Threat actors are using AI-generated exploitation scripts to target these devices. Exploitation could lead to disruption of critical industrial processes.
Recommended by the publisher: CISA recommends applying critical security patches and strengthening access controls.