Cyber Centre Daily Advisory Digest — 2026-08-17 (7 advisories)

What Happened

A government cyber agency published a daily roundup of 7 security advisories from major technology vendors. The most urgent items are vulnerabilities in Citrix NetScaler networking equipment, Apple macOS computers, and SAP business software that attackers are already exploiting in the real world. Microsoft Edge, IBM enterprise products, Tenable security software, and Dell hardware also have vulnerabilities that need patching. Organizations running any of these products should check the vendor advisories and apply updates as soon as possible, prioritizing the systems where active exploitation has been confirmed.

Key Takeaways

• Four CVEs across three vendors are confirmed exploited in the wild: CVE-2026-8451 and CVE-2026-8452 (Citrix NetScaler ADC/Gateway), CVE-2026-65400 (Apple macOS), and CVE-2026-58231 (SAP NetWeaver/ABAP).
• Citrix NetScaler ADC and Gateway versions prior to 14.1-72.61 and 13.1-63.18 are vulnerable to six CVEs total, two of which are actively exploited.
• Apple macOS Tahoe (<26.6.1), Sequoia (<15.7.9), and Sonoma (<14.8.9) are affected by CVE-2026-65400 which is exploited in the wild.
• Microsoft Edge (Chromium-based) prior to 151.0.4129.86 is affected by CVE-2026-72970, a remote code execution vulnerability.
• Additional advisories cover vulnerabilities in IBM enterprise products, Tenable Security Center, Dell PowerFlex and BIOS, and multiple SAP product lines.

Affected Systems

• Citrix NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-72.61
• Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-63.18
• Citrix NetScaler ADC FIPS versions before 14.1-72.61 FIPS
• Citrix NetScaler ADC FIPS and NDcPP versions before 13.1-37.272
• Apple macOS Tahoe prior to 26.6.1
• Apple macOS Sequoia prior to 15.7.9
• Apple macOS Sonoma prior to 14.8.9
• Microsoft Edge (Chromium-based) prior to 151.0.4129.86
• SAP NetWeaver and ABAP Platform (multiple kernel versions 7.22 through 9.19)
• SAP Commerce Cloud versions COM_CLOUD 2211 and 2211-JDK21
• SAP Manufacturing Integration and Intelligence versions MII 15.4 and 15.5
• SAP BusinessObjects Business Intelligence Platform (Central Management Server)
• IBM AIX prior to or equal to 7.2 and 7.3
• IBM PowerVM VIOS prior to or equal to 4.1
• IBM App Connect Enterprise Certified Containers Operands
• IBM Tivoli Monitoring prior to or equal to 6.3.0.7 Service Pack 23
• Tenable Security Center prior to 6.9.0
• Dell PowerFlex appliance prior to 51.391.02 and 51.384.02
• Dell PowerFlex Rack prior to 3.9.1.2 and 3.8.4.2
• Dell VPlex prior to 6.2.2.1

Vulnerabilities (CVEs)

Attack Chain

1. Reconnaissance: Attackers identify unpatched Citrix NetScaler ADC/Gateway, Apple macOS, or SAP NetWeaver/ABAP systems exposed to the internet or internal network.
2. Initial Access: Known CVEs (CVE-2026-8451, CVE-2026-8452, CVE-2026-65400, CVE-2026-58231) are exploited to gain access to target systems.
3. Execution: Exploitation of CVE-2026-72970 in Microsoft Edge enables remote code execution on client systems via malicious web content.
4. Persistence: Post-exploitation access on compromised NetScaler, macOS, or SAP systems may allow attackers to maintain footholds.
5. Patching Gap: Systems not updated to the fixed versions remain vulnerable to ongoing active exploitation.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules or queries are provided in this advisory digest. The advisories direct users to vendor security bulletins for patch information.

Detection Engineering Assessment

Required Log Sources

• NetScaler ADC/Gateway syslog and audit logs
• NetScaler ns.log for configuration changes and session activity
• macOS unified logging system (uls)
• SAP application logs and security audit log (SM20)
• Edge browser crash and security event logs
• Web application firewall logs for NetScaler gateway traffic

Hunting Hypotheses

Control Gaps

• Network IDS/IPS signatures for the exploited CVEs may not yet be available from vendors.
• NetScaler internal management interface traffic may not be monitored by network security tools.
• macOS endpoints without EDR agents will have limited visibility into exploitation of CVE-2026-65400.
• SAP application-layer exploitation may bypass traditional network security controls.
• Vulnerability scanners may not detect unpatched NetScaler firmware versions if scanning coverage is incomplete.

Key Behavioral Indicators

• Unexpected administrative sessions on NetScaler ADC/Gateway from non-corporate IP ranges
• Configuration changes on NetScaler appliances outside of change management windows
• msedge.exe spawning unexpected child processes such as cmd.exe, powershell.exe, or other interpreters
• Unexpected process execution with elevated privileges on macOS systems
• Unauthorized ABAP transport requests or code injections in SAP NetWeaver systems
• Anomalous HTTP requests targeting NetScaler Gateway virtual server endpoints

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether NetScaler ADC/Gateway management interfaces are exposed to the internet and consider moving them behind VPN or bastion host access.
• Consider implementing network segmentation to isolate SAP NetWeaver application servers from untrusted network zones.
• Review and update vulnerability scanning schedules to ensure coverage of network appliances (NetScaler), macOS endpoints, and SAP application servers.
• Consider evaluating whether Dell PowerFlex, IBM AIX, and Tenable Security Center systems in your environment are running vulnerable versions and schedule patching accordingly.

User Protection

• Consider deploying Microsoft Edge version 151.0.4129.86 or later to all endpoints via your patch management tooling.
• If your organization manages macOS devices via MDM, consider pushing macOS updates (Tahoe 26.6.1, Sequoia 15.7.9, Sonoma 14.8.9) as soon as testing permits.
• Consider verifying that endpoint protection agents are active and up to date on all macOS systems, particularly those that cannot be immediately patched.

Security Awareness

• Consider informing users about the importance of restarting their browsers and systems after updates are deployed, particularly for Microsoft Edge.
• If applicable to your awareness program, consider reminding users to report unexpected browser crashes or unusual system behavior, which may indicate exploitation attempts.

MITRE ATT&CK Mapping