Watchdog Insights: Citrix, F5 and Check Point Active Exploits for Small Businesses, September 28, 2026
Some weeks, the security list is mostly routine maintenance. This is not one of those weeks.
Multiple products sitting directly at the edge of business networks are being actively exploited. Citrix NetScaler, F5 BIG-IP, Check Point gateways, WordPress and Adobe Commerce all need attention. Several of these flaws allow an attacker to get in without a password.
The order matters. Start with anything exposed to the internet, especially VPNs, gateways and authentication systems.
September 14, 2026 • Under 10 minute read • Gabriel Guastella
The 60-Second Version
- Citrix NetScaler: Two critical remote-code vulnerabilities are being exploited. One affects default configurations. Install the September 27 builds immediately and check for compromise.
- F5 BIG-IP APM: An exploited vulnerability can provide full system access when APM and an OAuth profile share a virtual server. Apply the appropriate engineering hotfix.
- Check Point: Attackers are targeting both VPN gateways and management servers. Patch both sides and review logs for follow-up internal scanning.
- WordPress: A core path-traversal flaw is being exploited. Update to the patched release for your branch, not merely the latest plugin versions.
- Plesk, cPanel and WP Toolkit: Several newly disclosed flaws can give an authenticated hosting customer root access or access to other accounts.
- Adobe Commerce and Magento: An August vulnerability received new urgency when CISA added it to the Known Exploited Vulnerabilities catalog on September 24.
01
Citrix NetScaler has two actively exploited remote-code vulnerabilities
Citrix published an unusually full NetScaler security bulletin on September 27. Eight vulnerabilities were addressed, but two deserve immediate attention.
CVE-2026-88771 allows an unauthenticated attacker to execute commands on affected NetScaler ADC and Gateway appliances. It applies to all deployments running vulnerable builds, including default configurations.
CVE-2026-88772 can lead to remote code execution or denial of service when DTLS is enabled. DTLS is enabled by default on VPN virtual servers. Citrix says exploitation of both vulnerabilities has been observed. CISA added them to its Known Exploited Vulnerabilities catalog the same day. support.citrix.com
Why this matters
NetScaler appliances often handle VPN access, authentication and traffic headed toward internal applications. An attacker running commands there is already standing in a very useful place. That is the polite version.
Installing the update closes the vulnerability, but it does not prove that the appliance was clean beforehand.
What IT teams should do
- Update NetScaler ADC and Gateway 14.1 to 14.1-73.37 or later.
- Update version 13.1 to 13.1-64.23 or later.
- Update 14.1-FIPS to 14.1-73.37 FIPS or later.
- Update 13.1-FIPS and 13.1-NDcPP to 13.1-37.279 or later.
- Include customer-managed NetScaler instances used with Secure Private Access hybrid deployments.
- Run Citrix's indicator-of-compromise scan through NetScaler Console. Contact Citrix Support if the console is unavailable.
- Send NetScaler logs to external storage or a SIEM. Logs kept only on a compromised appliance are not much of an investigation plan.
- If the appliance shows suspicious changes, web shells or unexplained administrative activity, move into incident-response mode. Do not stop at patching.
Citrix also warns that 13.1-64.23 can enter a reboot cycle in certain configurations with NetScaler variables. Administrators should check the vendor guidance and consider 13.1-64.24 where that condition applies.
Authoritative sources: Citrix security bulletin and Citrix investigation guidance.
02
F5 BIG-IP APM exploitation is targeting a specific OAuth configuration
F5 disclosed CVE-2026-94127 on September 22 and confirmed that attackers are exploiting it.
The vulnerability affects BIG-IP Access Policy Manager when an APM access policy and an OAuth profile are configured on the same virtual server. Malicious traffic can trigger a heap buffer overflow and allow an unauthenticated attacker to run code on the device, potentially taking full control. CISA added the vulnerability to its exploited-vulnerability catalog on September 22. Canadian Centre for Cyber Security
Why this matters
BIG-IP frequently sits in front of important applications and identity workflows. A successful attack is not limited to knocking the box offline. It can give an attacker a trusted position from which to watch traffic, modify configurations and reach deeper systems.
The vulnerable configuration is specific, but it is common enough that guessing is not an acceptable inventory method.
What IT teams should do
Identify BIG-IP virtual servers that have both an APM access policy and an OAuth profile, then apply the appropriate F5 hotfix:
- BIG-IP 17.1: Hotfix-BIGIP-17.1.3.5.0.41.14-ENG
- BIG-IP 17.5: Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
- BIG-IP 21.1: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
Also:
- Contact F5 Support for the vendor-provided protective iRule.
- Look for bursts or unusually high volumes of failed OAuth authentication.
- Review administrative accounts and access policies for unexpected changes.
- Restrict management interfaces to trusted administrative networks.
- Follow F5's post-update validation guidance.
Authoritative sources: F5 advisory K000162605 and the Canadian Centre for Cyber Security alert.
03
Check Point VPN and management servers are both under attack
Check Point reported active exploitation of two separate critical vulnerabilities on September 22.
CVE-2026-85102 is a pre-authentication remote-code vulnerability in VPN certificate handling. It affects Security Gateway and Spark Firewall installations across several R81 and R82 releases. Check Point says exploitation attempts against Spark customers began September 12.
CVE-2026-93616 is a pre-authentication path-traversal vulnerability in the Security Management web service. It can allow script execution from an arbitrary path and loading of an arbitrary Java class. Check Point described exploitation as limited and targeted, but confirmed that it occurred.
Both vulnerabilities were added to CISA's Known Exploited Vulnerabilities catalog. Check Point Blog
Why this matters
The first vulnerability targets the gateway employees use to reach internal systems. The second targets the system used to manage those gateways.
That combination deserves more than a green check mark from a vulnerability scanner. An attacker who successfully compromises the gateway may immediately start surveying internal services. Check Point specifically recommends looking for that follow-up activity.
What IT teams should do
- Apply the applicable fixes from Check Point advisories sk1000117 and sk1000171.
- Patch both gateways and Security Management servers.
- Do not assume Check Point LivePatch Take 28 or 29 covers CVE-2026-93616. The vendor says it does not.
- Review Mobile Access logs for unusual certificate-based logins.
- Do not limit searches to the certificate subjects published by Check Point. Those are examples, not a complete blocklist.
- Look for internal port scans and service discovery originating from suspicious VPN users.
- Replace end-of-support R80, R81 and R81.10 installations instead of building a permanent workaround around them.
Authoritative sources: Check Point's active-exploitation advisory and the Cyber Centre update.
04
WordPress core needs an update, not another plugin audit
WordPress published fixes for CVE-2026-87902 on September 22. By September 25, CISA had added the vulnerability to its exploited-vulnerability catalog.
The flaw allows an unauthenticated attacker to manipulate WordPress page-template resolution and include a readable PHP file outside the active theme directories. Remote code execution is possible when additional server and theme conditions are present.
Those conditions include a theme containing a top-level directory beginning with page- and an appropriate readable PHP file on the server. The WordPress advisory specifically notes that some popular themes meet the directory condition. It also says default cPanel configurations running PHP earlier than 8.5 may provide a usable PHP execution path. GitHub
Why this matters
The exploit is conditional, but attackers are already using it. Conditional does not mean harmless. It means administrators need to understand their environment instead of waiting for a generic scanner to make the decision for them.
This is also a WordPress core vulnerability. Updating themes and plugins while leaving core behind will not fix it.
What IT teams should do
- Update WordPress to the patched version for its release branch.
- Current patched releases include 7.1.2, 7.0.6, 6.9.9 and 6.8.10. WordPress also backported the fix to older branches going back to 4.7.
- Verify the installed version on every managed site. Do not assume automatic updates completed successfully.
- Review active parent and child themes for top-level directories beginning with
page-. - Review PHP configuration, especially on cPanel systems using PHP earlier than 8.5.
- Check for newly created PHP files, unfamiliar administrators, modified scheduled tasks and unexplained changes under the web root.
- If compromise is suspected, treat the web server as compromised. Reinstall clean code, rotate credentials and WordPress salts, and investigate persistence.
Authoritative sources: WordPress security advisory and the Cyber Centre exploitation update.
05
Plesk, cPanel and WP Toolkit received important hosting security fixes
Several hosting-control-panel vulnerabilities were disclosed this week. The official advisories do not report confirmed exploitation, so these rank below the issues already being attacked. The potential impact is still serious.
Plesk's RESTful API extension vulnerability, CVE-2026-68492, allows a remote authenticated user to execute code as root. The extension is installed by default and hidden from the normal Plesk interface, so a server can be affected even when nobody remembers installing it.
A second Plesk issue, CVE-2026-87898, allows a customer without elevated privileges to inject commands through Site Import and execute them as root.
On cPanel, CVE-2026-87899 allows an authenticated account holder to reach root through CalDAV/CardDAV. CVE-2026-87900 allows a WP Toolkit user to modify databases belonging to other accounts. Plesk
Why this matters
Shared hosting platforms depend on strong separation between customers. If one ordinary account can become root, every subscription on the server may be exposed.
Control panels also hold databases, email settings, DNS records, backups and credentials. They are less of a control panel and more of a key ring with a web interface.
What IT teams should do
For Plesk:
- Update Plesk 18.0.80 to 18.0.80.8 or later.
- Update Plesk 18.0.81 to 18.0.81.1 or later.
- Verify the RESTful API extension is 2.4.7 or later.
- Update the Site Import extension to 1.12.2 or later.
For cPanel and WP Toolkit:
- Update cPanel to 11.134.0.57, 11.136.0.41, 11.138.0.8, WP2 11.138.1.11, or a later supported release.
- Update WP Toolkit to 6.11.3 or later.
- Review recent control-panel logins, extension changes, database operations and privilege changes.
- Prioritize multi-tenant servers and systems where customers can create their own cPanel or Plesk accounts.
Authoritative sources: Plesk REST API advisory, Plesk Site Import advisory, cPanel CalDAV/CardDAV advisory and WP Toolkit advisory.
06
An older Adobe Commerce patch has new urgency
Adobe fixed CVE-2026-71362 in its August security release for Adobe Commerce and Magento Open Source. At the time, Adobe said it was not aware of exploitation.
That status changed on September 24 when CISA added the vulnerability to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
The flaw is an incorrect-authorization issue that allows remote privilege escalation without authentication or user interaction. Adobe rates it critical at 9.1. helpx.adobe.com
Why this matters
This is not a newly released patch. It is a new reason to stop postponing an existing one.
Commerce systems hold customer accounts, order information and integrations with payment, inventory and fulfillment services. Unauthorized privilege escalation can quickly become a larger business incident.
What IT teams should do
- Update Adobe Commerce branches 2.4.4 through 2.4.9 to their corresponding 2026-aug security release or later.
- Update Magento Open Source 2.4.6 through 2.4.9 to the corresponding 2026-aug release or later.
- Include Adobe Commerce B2B installations in the review.
- Check customer and administrator activity for unexplained privilege changes, session anomalies and unauthorized access to protected records.
- Review third-party modules and integrations after updating, then verify that the installed security patch level actually changed.
Authoritative sources: Adobe bulletin APSB26-92 and CISA's September 24 KEV update.
Your order of operations
This week’s priority queue
Handle today
- Patch and investigate internet-facing Citrix NetScaler appliances.
- Identify and remediate affected F5 BIG-IP APM configurations.
- Patch Check Point gateways and management servers, then review VPN and management logs.
- Update exposed WordPress installations and check for signs of compromise.
Handle within 24 hours
- Apply the Adobe Commerce or Magento August security release.
- Update Plesk, cPanel and WP Toolkit on managed hosting servers.
Finish this week
- Confirm that edge-device and hosting logs are leaving the device and reaching protected storage.
- Restrict every management interface that does not need to be reachable from the public internet.
- Document the versions checked, the versions installed and the evidence reviewed.
For actively exploited systems, “patched” is not the same as “done.” The useful status is “patched, validated and checked for compromise.”
The Watchdog takeaway
Management tools deserve more protection, not less.
If a platform can reach every endpoint, server, firewall, or customer environment you manage, it belongs at the front of the patching, monitoring, and incident-response queue.