What is being exploited

  • Atlassian Data Center: CVE-2026-21589.
  • Citrix NetScaler: CVE-2026-88779.
  • Fortinet FortiMail: CVE-2026-104286.
  • Ivanti Connect Secure: reported as exploited, but we could not find a CVE ID for it.

For the Ivanti issue, check Ivanti's own security advisory rather than waiting for a CVE number, and treat it as exploited until you have confirmed otherwise.

Why these products matter

Three of these four sit at the edge of a network or hold central business data: a gateway, a VPN, a mail filter and a collaboration server. Attackers like them because one flaw can open the door to everything behind them, and because they are often reachable from the internet.

Triage in four steps

  1. Find them. Check your asset inventory, certificate lists and cloud accounts for these products, including test and forgotten instances.
  2. Check exposure. Which ones can be reached from the internet, and which management interfaces are exposed?
  3. Read the advisory. Confirm the affected versions and the fixed or mitigated versions with each vendor. This list names the CVEs, not the details.
  4. Fix, then look for signs of compromise. If a system was reachable while vulnerable, patching alone does not prove it was not breached. Review its logs and configuration for changes you did not make.

Reduce the exposure

  • Keep management interfaces off the public internet.
  • Restrict VPN and gateway administration to known addresses.
  • Subscribe to each vendor's security notices, so the next one reaches you first.

In short

Four products are reported as exploited. Find out whether you run them, confirm the details in the vendor advisories, patch or mitigate, and check anything that was exposed. Schedule an Exposure Review and Hardening Audit of your edge systems and we will check what is reachable and how to reduce it.