Picture someone in finance opening a file that arrived in a chat message. There is no yellow bar, no "this file came from the internet" prompt and no SmartScreen warning. If something runs next, nothing on the screen tells them, and nothing tells you either. Microsoft released CVE-2026-96951 on 13 October 2026 as a Windows Shell Security Feature Bypass Vulnerability, marked Exploited: Yes and Publicly disclosed: No. CISA added it to the Known Exploited Vulnerabilities catalog

Picture a Connect Secure box, fully patched at the time, passing a clean Integrity Checker run after its AD service account has been used to search for LAPS passwords and BitLocker recovery keys. Based on what Volexity found on the device it investigated, that outcome is realistic on this chain. Volexity reported on 13 October 2026 that a previously unknown actor it tracks as UTA0576 chained three bugs in Ivanti Connect Secure to get unauthenticated root. Two are tracked as C

Chinese state-linked hackers are disguising VPN backdoors as legitimate Windows processes. Here is how to hunt for them in your environment.

CVE-2026-21589 lets unauthenticated attackers read files from eight Atlassian Data Center products. Patch now, block with the WAF regex, and hunt your access logs for the two-dot pattern.

Rejetto HFS CVE-2026-61500 lets attackers forge an admin cookie from a weak Math.random() signing key, then reach remote code execution. Versions 3.0.0 through 3.2.0 are affected; 3.2.1 fixes it. Four hunts to find the activity in your logs.

Zammad CVE-2026-102489 and CVE-2026-102490 chain a session hijack into root. CISA's deadline is today. Recheck the patch status, then run these four hunts.

FortiMail CVE-2026-104286 lets an unauthenticated attacker write files onto the appliance. Fortinet shipped the fixes on Oct 5. Patch now, then run these four hunts.

CVE-2026-76504 lets an unauthenticated attacker reach the Cisco SD-WAN Manager admin API with a single encoded request. Here is how the bypass works, how to mitigate it, and four hunts (Splunk, Kibana, Falcon, KQL) to find encoded logins in your logs.

CVE-2026-73570 turns a crafted SMTP message into command execution on a Zimbra mail server, through the optional zimbra-snmp notification path. CVSS 8.9, on CISA KEV, and Shadowserver counts 270-plus compromised instances. The fix landed three weeks before disclosure, so start your lookback at the patch date.

Microsoft shipped CVE-2026-65660 in August as a moderate spoofing bug at CVSS 6.5. The record now reads remote code execution at 8.8, and CISA added it to KEV on 25 September with forensic triage required. If your farm deferred the August patch because the advisory said spoofing, here is what to hunt.

Citrix CTX697096 names two exploited NetScaler zero-days at CVSS 9.5. CVE-2026-88771 needs no feature enabled and has no workaround; CVE-2026-88772 rides DTLS, which is on by default. Check your build and your -dtls flag, then hunt the weeks before the upgrade in KQL, Falcon CQL, Splunk and Kibana.

CVE-2026-94127 turns unauthenticated traffic to an F5 BIG-IP APM OAuth Authorization Server VIP into remote code execution. CVSS 9.8, exploited, on CISA KEV with a forensic triage requirement. Here is the vendor hunt triad in KQL, Falcon CQL, Splunk and Kibana.

Citrix NetScaler Gateway after a quiet nsppe crash. Hunt PHP under /var/vpn/theme. You have seen this ticket. VPN died, VPN came back, someone closed it as a blip. Citrix sold CVE-2026-8452 as a crash. CISA put it on KEV Monday. The federal clock is Saturday, 29 August. Builds with a fix: 13.1-63.21 or later, 14.1-73.32 or later. 12.1 and 13.0 have no fix. Patch is not the hunt. A patched box that already had a quiet respawn still needs the directory check. The hunt is not th