Threat Intelligence Report

1. Executive summary

This week's Check Point bulletin carries four patched vulnerabilities relevant to EMEA financial services, of which one is confirmed exploited in the wild: CVE-2026-88779 in Citrix NetScaler ADC and Gateway (CVSS 8.7 HIGH, CWE-119 memory buffer error, in CISA KEV since 2026-10-04, EPSS 1%), affecting customer-managed appliances configured for SAML authentication. The remaining three are not in CISA KEV and carry EPSS of 0-3%: CVE-2025-64393 in Veeam Backup & Replication (CVSS 9.4 CRITICAL, CWE-502 deserialization), CVE-2026-76455 in Cisco NX-OS (CVSS 9.8 CRITICAL, CWE-284 improper access control), and CVE-2026-21589 in eight self-managed Atlassian Data Center products (CVSS 9.3 CRITICAL, CWE-552 files accessible to external parties). The NetScaler flaw is the priority: it sits on the same appliance class that has been repeatedly used as an initial-access foothold into financial networks, and Citrix has confirmed targeted exploitation. The Atlassian flaw is the second concern for most clients because it is unauthenticated and can yield credentials for connected applications, but no exploitation is confirmed in the source.

2. Regulatory framing

No DORA Art. 17, 18, 19, 24, 29 or 30 trigger and no NIS2 Art. 23 or UK NIS 2018 trigger is engaged by this item as written: the source reports no incident at a named EMEA financial services entity, no confirmed compromise of a client environment, and no major incident to report. If a client's own NetScaler or Atlassian estate is later confirmed compromised, Art. 17, 18 and 19 become engaged at that point.

3. Technical analysis & attack chain

This is a vendor patch roundup covering four CVEs. The confirmed exploitation state, CVSS and EPSS values below are from the verified reference data; the source text is used only for the mechanism and affected-version detail it provides.

Triage table

CVE-2026-88779: Citrix NetScaler ADC and Gateway

Citrix has confirmed targeted exploitation of CVE-2026-88779, a memory buffer overflow rated CVSS 8.7 HIGH and classified CWE-119. The flaw affects customer-managed NetScaler ADC and Gateway appliances configured for SAML authentication, and the source states it can cause denial of service. Security updates are available for affected versions; the source does not name the fixed build numbers. The verified reference data records this CVE in CISA KEV with an addition date of 2026-10-04 and an EPSS of 1%.

The attack chain for this CVE is not described in the source beyond the exploitation confirmation and the denial-of-service outcome. What a defender can act on is the exposure condition: the appliance must be customer-managed and configured for SAML authentication. Appliances not using SAML are outside the stated affected configuration. The source does not describe post-exploitation behaviour, so no claim is made here about web shells, credential theft or lateral movement for this specific CVE. Related NetScaler CVEs from earlier bulletins (CVE-2026-88771 and CVE-2026-88772) were reported to have been used for remote access, web shell deployment, credential theft and internal movement, but those are separate CVEs and the source does not link them to CVE-2026-88779.

CVE-2026-21589: Atlassian Data Center

Atlassian has released patches for CVE-2026-21589, a critical arbitrary file access flaw rated CVSS 9.3 and classified CWE-552. The flaw affects eight self-managed Data Center products, with the source naming Jira, Confluence, Bitbucket and Bamboo. Unauthenticated attackers can access sensitive files and potentially obtain credentials enabling administrative access to connected applications. Check Point IPS provides protection under the signature name "Atlassian Multiple Products Arbitrary File Read (CVE-2026-21589)".

The chain that matters here is file read to credential to administrative access. The source does not name the specific files exposed, the credential type, or the connected applications reached. It also does not state whether exploitation has been observed. Treat the credential-theft step as the source's assessment of potential impact, not as an observed outcome.

CVE-2025-64393: Veeam Backup & Replication

Veeam has released security updates for multiple vulnerabilities in Backup & Replication version 12. CVE-2025-64393 is a critical remote code execution flaw rated CVSS 9.4 and classified CWE-502, deserialization of untrusted data. It allows low-privileged backup users to execute commands on affected servers. Versions before build 12.3.2.4934 are vulnerable. The source does not state whether exploitation has been observed, and the verified reference data records no KEV entry and an EPSS of 0%.

The privilege requirement is the control point: the attacker needs a low-privileged backup account first. Backup servers typically hold credentials for the systems they protect, so a successful deserialization exploit on the backup server is a route to the wider estate. The source does not describe the deserialization sink, the protocol or the payload.

CVE-2026-76455: Cisco NX-OS

Cisco has released security updates for multiple critical vulnerabilities in NX-OS software. CVE-2026-76455 is an improper access control flaw rated CVSS 9.8 and classified CWE-284. Successful exploitation could allow unauthorized access to affected network infrastructure. The source gives no further mechanism, no affected version list, no fixed release and no exploitation status. The verified reference data records no KEV entry and an EPSS of 0%. This is the thinnest entry in the bulletin and the advisory does not add detail the source does not contain.

Unconfirmed attribution and single-sourced claims

The bulletin names several threat groups: Xuanye (ASOS), DataSuckers (ATB), CyberXero (Ukrainian energy and e-commerce), UAC-0099 (Ukrainian transportation, manufacturing and energy), and INC, Lynx and Payload (ransomware affiliates reportedly sold access in the FortiBleed campaign). None of these actors has a MITRE ATT&CK profile in the verified reference data. Attribution for every one of them is unconfirmed and should not be used as a basis for blocking or escalation without independent corroboration.

The FortiBleed item is the one with the widest reach: the FBI and Secret Service warn of continued exploitation affecting more than 86,000 Fortinet FortiGate firewalls and VPN gateways across 194 countries, with attackers using previously compromised credentials for persistent access and reportedly selling that access to ransomware affiliates. This is a single-source summary of a government warning; the underlying government advisory is not in the material provided, so the 86,000 figure and the affiliate names should be treated as reported, not verified. The bulletin does not give the FortiBleed CVE identifiers, the affected FortiOS versions, or the indicators.

The remaining items in the bulletin (Denmark's Central Register of Persons, ASOS, ATB, Osaka Metropolitan University, the ARTEX campaign against South Korean financial institutions, the prompt-injection phishing campaign, the CyberXero profile, the UAC-0099 MATCHBOIL and MATCHWOK activity, and the Taiwanese research phishing campaign) are reported at summary level only. They carry no technical detail sufficient for detection or mitigation and are not covered further here.

4. Mitigation & containment

P1, within 24 hours

• Inventory every customer-managed Citrix NetScaler ADC and Gateway appliance and identify which are configured for SAML authentication. Those are the exposed set for CVE-2026-88779. Apply the Citrix security update to all of them. Where a maintenance window cannot be met inside 24 hours, restrict management and SAML endpoints to known source addresses at the network edge and enable the Check Point IPS protection if the estate runs Check Point.
• Search NetScaler logs for anomalous SAML authentication attempts and for process crashes or restarts on the appliance, which is the observable consequence of a buffer overflow causing denial of service. The source gives no atomic indicators for this CVE, so detection rests on behaviour.
• For CVE-2026-21589, identify all self-managed Atlassian Data Center deployments across Jira, Confluence, Bitbucket and Bamboo, and the other four affected products. Apply the Atlassian patches. Until patched, restrict network access to these instances to trusted ranges and review application logs for unauthenticated file-read attempts against paths outside the web root.
• Rotate credentials stored in or reachable from Atlassian application configuration, including database passwords, SMTP credentials, and any application links or connected-app secrets, on the assumption that CVE-2026-21589 can expose them. Do this after patching, not before, so the new credentials are not exposed by the same flaw.

P2, within 72 hours

• Upgrade Veeam Backup & Replication to build 12.3.2.4934 or later. Audit backup service accounts and remove interactive logon rights from them. Review backup server logs for command execution originating from low-privileged backup accounts.
• Apply the Cisco NX-OS updates for CVE-2026-76455. The source gives no affected version list, so confirm the fixed release against Cisco's advisory before scheduling. Restrict management-plane access to NX-OS devices to a dedicated management network with ACLs, and review AAA logs for unauthorized access attempts.

P3, within 7 days

• Add the four CVEs to the vulnerability management backlog with the KEV status of CVE-2026-88779 recorded, and confirm the SLA applied to it reflects confirmed exploitation rather than the CVSS 8.7 base score alone.
• Review the FortiBleed exposure position: confirm FortiGate firewalls and VPN gateways are patched to the vendor's current release, that credentials for them have been rotated since the campaign was first reported, and that MFA is enforced on all VPN and administrative access. The bulletin gives no CVE or version detail, so this is a hygiene check against the reported campaign rather than a targeted fix.
• Reconcile the NetScaler and Atlassian systems against the ICT third-party register for DORA Art. 28 purposes.

5. Indicators of compromise

No indicators of compromise available in the source material. The bulletin names no hashes, domains, IP addresses, file paths, registry keys or command lines for any of the four CVEs or for the campaigns it summarises.

The source does describe observable behaviours for the NetScaler and Atlassian flaws. These are not atomic indicators and are recorded separately below.

Behavioural indicators

6. Detection

The source material contains no file hashes, command-line flags, mutex names, scheduled-task names, registry keys or ransom-note text for any of the four CVEs. It does contain one usable artefact: the Check Point IPS signature name for the Atlassian flaw. That is a detection signature name rather than a threat artefact, so it is not suitable as a YARA string. There are no log or behavioural indicators specific enough to build a reliable Sigma rule without inventing values.

Insufficient indicators to author detection rules.

CVE assessment

4 referenced CVEs — 1 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

7. Sources

• Check Point Research, "12th October – Threat Intelligence Report", https://research.checkpoint.com/2026/12th-october-threat-intelligence-report/, 2026-10-12.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-88779 as the priority item in this bulletin on the strength of its CISA KEV status and Citrix's confirmation of targeted exploitation, not on its CVSS 8.7 base score, which understates the operational risk of an internet-facing authentication appliance. CVE-2026-21589 is the second priority for clients running self-managed Atlassian Data Center, because unauthenticated file access that can yield administrative credentials is a direct route into connected applications, even though no exploitation is confirmed and EPSS is 3%. The Veeam and Cisco NX-OS flaws are patched-and-move-on items at EPSS 0% with no KEV entry, but both sit on systems that hold privileged access to the wider estate, so they should not be left indefinitely. Client impact is concentrated in two places: the NetScaler estate, where the affected configuration is narrow (customer-managed, SAML-enabled) and therefore quick to scope, and the Atlassian estate, where the affected product list is broad and the credential-rotation step is the one most likely to be skipped. Attribution for every actor named in this bulletin is unconfirmed, as none has a MITRE ATT&CK profile in our reference data, and the FortiBleed figures rest on a single summary of a government warning we have not seen in full. We will pull the underlying Citrix and Atlassian advisories for fixed build numbers and affected version ranges, and we will issue a follow-up if either vendor publishes exploitation detail or indicators that change the detection position.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.