A CVSS 9.0 memory overflow in NetScaler, a US-led takedown of Chinese state-sponsored scanning tools, and 12 critical Cisco NX-OS patches - all landing in the same 24-hour window. Today’s brief covers the patches that need to happen before end of business, the threat infrastructure that just went offline, and a ccTLD hijack campaign that produced valid HTTPS certificates for Google domains.

In the News

Citrix NetScaler SAML RCE - CVE-2026-107406

Citrix disclosed CVE-2026-107406, a CVSS 9.0 memory overflow vulnerability in NetScaler ADC and Gateway. The flaw is specific to SAML-configured deployments - organizations using NetScaler for federated authentication are in the blast radius. Successful exploitation allows unauthenticated remote code execution or denial of service.

This is the second critical NetScaler vulnerability in a month, following CVE-2026-88779. The pattern is clear: NetScaler’s SAML parsing code has become a recurring attack surface. Citrix is urging immediate patching, and given the unauthenticated RCE vector, that urgency is warranted.

What defenders should do: Patch NetScaler ADC and Gateway immediately if SAML is configured. If patching requires a maintenance window, restrict management interface access and place a web application firewall in front of the SAML endpoint as a compensating control. Audit whether any NetScaler instances are internet-facing without the fix applied.

FBI Disrupts Flax Typhoon’s MicroScan and FishHub Tools

The FBI and DOJ announced the seizure of seven domains and the disruption of MicroScan and FishHub - two scanning and intrusion tools operated by Flax Typhoon, a Chinese state-sponsored threat actor linked to Beijing-based Integrity Technology Group. The tools provided third-party access to stolen data from US government agencies, healthcare organizations, and law enforcement entities, with additional victims across Southeast Asia.

This is the second major US-led disruption of Chinese cyber infrastructure in 2026. The operational model is notable: Integrity Technology Group allegedly provided these tools as a service, enabling multiple threat actors to leverage the same scanning and data-exfiltration infrastructure. The takedown removes current access but does not eliminate the underlying capability.

What defenders should do: Organizations in government, healthcare, and critical infrastructure should review network detection logs for scanning patterns associated with Flax Typhoon indicators. DNS-layer security controls and network detection and response platforms are the primary layers for catching infrastructure reconnaissance before exploitation begins. MITRE ATT&CK: T1595 - Active Scanning, T1071 - Application Layer Protocol.

Cisco Patches 12 Critical NX-OS Vulnerabilities

Cisco released fixes for 12 vulnerabilities across NX-OS, with five rated critical. The flaws affect Nexus data center switches - the infrastructure that handles east-west traffic in most enterprise environments. Successful exploitation could allow arbitrary code execution with root privileges on the switch.

For network operations teams, this is a priority patching event. Nexus switches sit in a position of trust within the data center fabric. Root-level compromise of a Nexus switch gives an attacker visibility into and control over inter-VLAN traffic, potentially bypassing application-layer security controls entirely.

What defenders should do: Apply the NX-OS patches. While patching is underway, enforce microsegmentation policies to limit the blast radius of any compromised switch. Restrict management plane access to NX-OS devices via ACLs and out-of-band management networks. Monitor NX-OS management interfaces for anomalous authentication attempts.

ccTLD Hijacks Yield Valid HTTPS Certificates for Google Domains

Attackers hijacked country-code top-level domains for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as), then used domain control to obtain valid HTTPS certificates for several Google-branded domains. The certificates passed standard browser trust checks, making phishing pages indistinguishable from legitimate Google services.

This attack bypasses the “look for the padlock” advice that organizations still give end users. The certificates are real - issued by legitimate certificate authorities that validated domain ownership. The failure is upstream: the ccTLD registries were compromised, and certificate authorities have no mechanism to distinguish a legitimate registrant from an attacker who controls the TLD.

What defenders should do: Implement certificate transparency log monitoring for your organization’s domains. DNS-layer security controls that evaluate domain reputation and age can catch newly issued certificates on hijacked domains. Email security controls should flag inbound links to ccTLD variants of known brands. MITRE ATT&CK: T1584.001 - Compromise Infrastructure: Domains.

Defender Action Items

  • Patch NetScaler ADC/Gateway for CVE-2026-107406 - SAML deployments are vulnerable to unauthenticated RCE (CVSS 9.0)
  • Patch Cisco NX-OS across Nexus switches - five critical flaws allow root-level code execution
  • Isolate AhsayCBS backup instances - CVE-2026-105133 and CVE-2026-105134 are actively exploited with no patch available; segment backup infrastructure and restrict management access
  • Review DNS and certificate transparency monitoring - ccTLD hijacks producing valid HTTPS certs for Google domains bypass browser trust indicators
  • Audit network detection coverage for Flax Typhoon scanning patterns following FBI takedown of MicroScan/FishHub infrastructure

Detection Queries

The following Splunk SPL query detects anomalous authentication attempts against Cisco NX-OS management interfaces, which would be relevant during the patching window for the 12 critical NX-OS vulnerabilities. It flags brute-force or credential-stuffing patterns targeting NX-OS SSH and HTTPS management.

index=network sourcetype="cisco:nxos" ("SSH" OR "HTTPS")
| eval auth_result=if(match(_raw, "authentication failed|login failed"), "failure", "success")
| stats count(eval(auth_result="failure")) as failures count(eval(auth_result="success")) as successes by src_ip, dest_ip, _time span=5m
| where failures > 5
| eval ratio=round(failures/(failures+successes), 2)
| where ratio > 0.8
| sort -failures
| table _time, src_ip, dest_ip, failures, successes, ratio

This query surfaces source IPs with more than 5 failed authentication attempts in a 5-minute window against NX-OS devices, with a failure-to-total ratio above 80%. False positives are low in environments with service accounts that use key-based authentication - any password-based failures against NX-OS management interfaces in those environments warrant investigation.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.