● Australia Based · Operating Internationally · OSCE / OSCP Certified
☏ 1300 859 443
Get a Quote
Home / Insights / Cybersecurity News

Weekly Cybersecurity News Roundup: Mid-October 2026, Citrix SAML, a Fax-to-Email Breach and the Edge Devices You Forgot You Own

October 15, 2026 · Steve McLaughlin

Microsoft shipped fixes for more than 1,400 vulnerabilities this week (Tenable counts 1,407). That number will lead most roundups. It shouldn’t lead this one.

Read the Australian advisories side by side and a different pattern comes out. A NetScaler gateway that needed patching twice. A supplier’s fax-to-email platform. Refrigeration controllers on the open internet. A state-linked toolkit still landing exploits from 2014. None of it is the server you patch every month. All of it is the box at the edge that nobody owns.

So the order is: the two ACSC alerts and the Icon Group breach first, then the ASD co-sealed advisory, then the global patches that change what you should test this week. Each story ends with what to do. The patch list is at the bottom, ready to paste into a ticket.

Is your NetScaler still vulnerable after you patched it?

Yes, if it does SAML.

ASD’s ACSC published a critical alert on 28 September covering eight NetScaler ADC and Gateway vulnerabilities, two of which (CVE-2026-88771 and CVE-2026-88772) were exploited before a patch existed. On 30 September it reported that Australian organisations had confirmed exploitation, and told everyone to review for compromise back to at least 4 September. On 9 October it updated the alert again. A new memory overflow, CVE-2026-107406, hits NetScaler configured as a SAML SP or IdP, and in the ACSC’s words, “previous patches for the earlier vulnerabilities listed on this page are insufficient”.

What to do: confirm whether your appliances have SAML configured, apply Citrix’s latest build, and hunt back to 4 September instead of assuming the first patch closed the door. If you can’t say from memory which of your gateways do SAML, that’s your first finding.

How does a cancer care provider get breached through a fax machine?

Through a supplier.

Icon Group’s notice of 12 October says the unauthorised access was to “an externally hosted and managed platform that converts incoming faxes to email”. Icon says its “core clinical and patient management systems were not affected”, that the records “do not comprise complete patient files”, and that it has notified the Australian Federal Police and the relevant regulators. It hasn’t published a count of affected patients.

But let’s face it: when was the last time anyone audited the fax gateway? The platform belongs to the supplier. The breach notice carries Icon’s name.

What to do: list every external service that handles your data on your behalf (fax-to-email, scan-to-email, e-signature, mail relays) and ask each one when it was last tested, and by whom. If nobody can answer, it goes in scope.

Why is a 2026 state-sponsored advisory full of 2014 bugs?

Because they still work.

On 9 October ASD’s ACSC co-sealed joint advisory AA26-281A with CISA, the FBI, NSA and agencies from the UK, Canada, Japan, New Zealand and Spain. It covers actors enabled by China-based Integrity Technology Group, activity publicly tracked as Flax Typhoon. The exploited CVEs it lists include GNU Bash (CVE-2014-6278), ProFTPD (CVE-2015-3306), Pulse Connect Secure (CVE-2019-11510) and GitLab (CVE-2021-22205). It also describes cross-site scripting against web applications and password spraying against Exchange and Office 365 accounts.

The top three mitigations are unglamorous; disable unused services and ports, sanitise user input in web applications, and require MFA on webmail, VPNs and accounts that reach critical systems.

What to do: run the advisory’s CVE list against your external asset register this week. Then ask whether your web applications have ever had their input handling tested by a person, not just a scanner. That second question is what a web application penetration test answers.

Is your refrigeration on the internet?

ASD’s ACSC issued a high alert on 14 October on operational technology, including commercial refrigeration and cooling systems. It’s aware of incidents overseas and says it “has not seen active targeting in Australia”. Its first recommendation is that OT interfaces and edge devices are “not directly exposed to the internet”.

What to do: ask facilities, not IT, what’s connected. Then check your public IP ranges for anything that answers like a building management or OT interface. If it answers you, it answers everyone.

Which global patches change what you test this week?

Four, and only one of them is Microsoft’s.

Windows Shell, CVE-2026-96951. Microsoft’s October release marks it “Exploitation Detected”, CVSS 8.8. It bypasses Mark of the Web, the flag that makes Windows and Office warn you about a downloaded file. CISA added it to the KEV catalogue the same day. That’s a phishing delivery bug. Patch it, and don’t rely on the warning banner until you have.

Ivanti Connect Secure, CVE-2026-104935, authentication bypass that lets a remote, unauthenticated attacker run commands. Ivanti’s advisory confirms exploitation against a limited number of customers. Fixed in 25.1.1.2, 25.1.3.0 and 22.8R2.5; 22.7R2.14 and earlier aren’t affected. CISA added it to KEV on 13 October.

Palo Alto Networks PAN-OS, CVE-2026-0322, authenticated code execution through the firewall’s management interface. Palo Alto’s advisory reports very limited exploitation. If your management interface is reachable from the internet, that’s the bug to fix first. Cisco Secure Email Gateway, CVE-2026-76519 (path traversal). CISA added both on 14 October.

What to do: VPNs, firewalls and mail gateways are your internet-facing kit. If any of these products sits on your perimeter, patch this week, then get the external surface tested by someone who didn’t configure it.

So what goes in the ticket?

This:

Patch and hunt list: week to 14 Oct 2026 (sources: ACSC, Microsoft, CISA KEV)
CVE-2026-107406  Citrix NetScaler ADC/Gateway, SAML SP/IdP  ACSC critical, updated 09-Oct
CVE-2026-88771   Citrix NetScaler ADC/Gateway, RCE          exploited; hunt back to 04-Sep
CVE-2026-88772   Citrix NetScaler ADC/Gateway               exploited; hunt back to 04-Sep
CVE-2026-96951   Windows Shell, Mark of the Web bypass      exploited; KEV 13-Oct
CVE-2026-104935  Ivanti Connect Secure, auth bypass         KEV 13-Oct
CVE-2026-0322    Palo Alto PAN-OS, mgmt-interface RCE       KEV 14-Oct
CVE-2026-76519   Cisco Secure Email Gateway, path traversal KEV 14-Oct
CVE-2019-11510   Pulse/Ivanti Connect Secure (legacy)       AA26-281A, 08/09-Oct
CVE-2021-22205   GitLab                                     AA26-281A
CVE-2014-6278    GNU Bash                                   AA26-281A

And for NetScaler admins, the SAML check:

grep -E "add authentication (samlAction|samlIdPProfile)" /nsconfig/ns.conf

On builds 14.1-73.37 to 73.41 and 13.1-64.23 to 64.28, only a samlIdPProfile hit makes you vulnerable. Earlier builds are vulnerable as a SAML SP or IdP. Fixed in 14.1-73.46 and 13.1-64.29.

There you have it. Ten lines, one grep, and a week to work through them.

If you’d like a senior-led, fully manual test of your perimeter or web applications, or a phishing site impersonating your brand taken down, get in touch.

References