Microsoft has released alternative mitigation techniques for Exchange Server customers who are not able to immediately apply updates that address vulnerabilities disclosed on March 2, 2021.
Citrix confirms that attackers are exploiting two critical NetScaler remote-code-execution zero-days, CVE-2026-88771 and CVE-2026-88772, and releases fixes for affected appliances. One flaw permits unauthenticated command execution across NetScaler ADC and Gateway deployments, while the other can cause remote code execution or denial of service when DTLS is enabled. The update also fixes six additional vulnerabilities, and Citrix advises customers to upgrade to patched builds; organizations unable to patch immediately should reduce internet exposure where possible.
CISA says hackers have targeted more than 100 internet-exposed systems in the U.S. water and wastewater sector. The attacks largely focus on programmable logic controllers made by companies including Rockwell, Schneider Electric, and Siemens; some intrusions disable shutdown processes and alarms. Water supplies have seen little impact, but investigations have caused outages and disruption.
