Zero‑Day RCE in Citrix NetScaler ADC and Auth‑Bypass in FortiMail Actively Exploited
What Happened — Researchers disclosed two zero‑day flaws that are already being weaponised: CVE‑2026‑XXXX in Citrix NetScaler ADC enables unauthenticated remote code execution, and CVE‑2026‑YYYY in FortiMail permits authentication bypass. Both affect core network and email‑security appliances used by enterprises worldwide.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring and rapid patch deployment are core controls that generate defensible audit evidence.
- Demonstrating timely remediation satisfies the “patch‑management” control objective that maps to many frameworks (e.g., NIST CSF Identify → Asset Management, Protect → Maintenance).
- A control‑mapping platform can automatically collect and retain patch‑deployment artifacts, turning remediation into verifiable trust evidence.
Who Is Affected – Financial services, healthcare, SaaS providers, and any organization that runs Citrix NetScaler ADC or FortiMail for network or email security.
Recommended Actions – Ingest the CVE details into your vulnerability‑management tool, prioritize patching, capture patch‑deployment logs as audit evidence, and verify that configurations are hardened post‑patch.
Technical Notes – Both flaws are exploitable over the network without authentication; CVSS 9.8 for NetScaler and 9.3 for FortiMail. No data exfiltration has been reported yet. Source: The Hacker News