Spain CCN-CERT alt

CCN-CERT AV 02/26 Critical Vulnerabilities in Citrix NetScaler ADC and Gateway

CCN-CERT issued alert AV 02/26 warning of two actively exploited critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products. CVE-2026-3055 allows memory exfiltration via SAML IDP profiles; CVE-2026-4368 enables session hijacking via race condition on VPN and AAA configurations. Affected versions span NetScaler ADC and Gateway 13.1 before 13.1-62.23 and 14.1 before 14.1-66.59. CCN-CERT recommends immediate patching, network access restrictions, and session termination following updates.

CCN-CERT AV 04/25 Critical Security Updates for Fortinet Products

CCN-CERT issued critical security advisories for two vulnerabilities (CVE-2025-59718 and CVE-2025-59719) affecting Fortinet products FortiOS (versions 7.0.0-7.6.3), FortiProxy (7.0.0-7.6.3), FortiSwitchManager (7.0.0-7.2.6), and FortiWeb (7.4.0-8.0.0). The vulnerabilities could allow attackers to bypass FortiCloud single sign-on (SSO) authentication via a manipulated SAML message when the feature is enabled on the device. Affected organizations are recommended to apply patches immediately and temporarily disable the FortiCloud login function until devices are updated.

CCN-CERT AV 01/26 Zero-Day Vulnerabilities in Ivanti Endpoint Manager Mobile

The CCN-CERT published a critical alert on January 30, 2026 warning of two zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) affecting multiple versions of Ivanti Endpoint Manager Mobile (EPMM), a widely deployed enterprise mobility management platform. The vulnerabilities allow unauthenticated remote code execution. Affected versions include 12.5.0.0 and earlier, 12.6.0.0 and earlier, and 12.7.0.0 and earlier. Ivanti has released version-specific RPM patch scripts, with a full version 12.8.0.0 update expected by the end of Q1 2026.