Skip to content

Design prototype. Figures, officials, and events are illustrative placeholders, not live data.

DDD
Critical Infrastructure

Communications and Cyber

CISA logged dozens of newly exploited software flaws this month, including Citrix NetScaler zero-days, and urged rapid patching.
Strained
Updated

Why this is rated strained

CISA added 42 vulnerabilities to its Known Exploited Vulnerabilities catalog in the 30 days to 2026-09-28, above the 25 threshold for 'strained' and up from 27 the prior month. Additions include Citrix NetScaler zero-days flagged on Sep 27. No telecom-outage figure could be verified because FCC pages returned access-denied errors this run.

Strained: Meaningful stress or a near-term risk of disruption. Some functions may be degraded. Methodology

About this area

Tracks significant cyber incidents, CISA advisories, and telecommunications outages.

Indicators

Latest readings. Changes are shown without judgment of whether up or down is better.

IndicatorLatest

Exploited vulnerabilities added (30-day)

Count of CVEs added to CISA's KEV catalog via alerts dated Aug 29–Sep 28, 2026.

Sources: Cybersecurity and Infrastructure Security Agency, Cybersecurity and Infrastructure Security Agency		42CVEs

Joint advisories issued (30-day)

Cybersecurity Advisory AA26-251A released Sep 8, 2026 within the window.

Source: Cybersecurity and Infrastructure Security Agency		1advisories

Timeline of developments

  1. CISA flags Citrix NetScaler zero-days as actively exploited (opens original release)

    CISA added two Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) to its KEV catalog and issued an alert on critical zero-day flaws exploited in NetScaler ADC and Gateway.

    Sources: Cybersecurity and Infrastructure Security Agency, Cybersecurity and Infrastructure Security Agency

  2. Joint advisory on China-based AI distillation campaigns (opens original release)

    CISA released AA26-251A describing industrial-scale data-distillation campaigns by China-based AI companies against U.S. AI firms.

    Source: Cybersecurity and Infrastructure Security Agency

Sources and citations

  1. 1.
    Known Exploited Vulnerabilities Catalog

    Cybersecurity and Infrastructure Security Agency. Accessed Sep 27, 2026.

  2. 2.
    Cybersecurity advisories

    Cybersecurity and Infrastructure Security Agency. Accessed Sep 27, 2026.

See something that looks wrong? Report an inaccuracy