NetScaler SAML Flaw Hits CISA's KEV List as Denmark Reports 8.8 Million Citizen Records Accessed

Citrix NetScaler is under attack again: a third exploited flaw in about a week now targets appliances configured for SAML single sign-on, and federal agencies must remediate by Wednesday. Atlassian has patched a critical unauthenticated file-access bug across eight self-hosted products. On the human side, Denmark says misused third-party access exposed the national ID numbers, names and addresses of 8.8 million people, and a ransomware group has claimed data from the University of Illinois Chicago's medical school.

Priority at a glance

The NetScaler flaw is under confirmed active exploitation with a federal deadline two days out. Atlassian's bug is not yet reported exploited but is severe and trivial to weaponize once a target file path is known. Denmark and UIC are both access-and-theft incidents rather than live software exploitation.

1. Citrix NetScaler: SAML memory overflow exploited (CVE-2026-88779)

What happened. Citrix published bulletin CTX697174 on October 3 for CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway (CVSS v4 8.7, CWE-119). Citrix reports targeted attacks on unmitigated appliances that cause denial of service. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 4, with a federal due date of October 7 and a forensic triage requirement.

Who is affected. Only appliances configured as a SAML service provider or SAML identity provider are affected. Vulnerable builds are 14.1 before 14.1-73.41, 13.1 before 13.1-64.28, 14.1 FIPS before 14.1-73.41 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.282.

Analysis. CISA added two other NetScaler flaws, CVE-2026-88771 and CVE-2026-88772, to KEV on September 27 — about a week before this one. watchTowr researchers suspect attackers crash appliances deliberately to speed exploitation of CVE-2026-88771, and administrators report patched appliances rebooting unexpectedly. September's fixes alone do not close this exposure: a platform producing a third exploited flaw in roughly a week turns patching into a moving target.

What to do. — click a step to check it off, click any code snippet to copy it

1. Identify NetScaler instances using SAML SP or IdP and upgrade them to a fixed build now; confirm the CVE-2026-88771/88772 fixes too.
2. Treat unexplained crashes since late September as possible compromise. Check authentication logs for odd username input and look for web shells.
3. If compromise is suspected, rotate credentials and session secrets the appliance handles.

2. Denmark: national register data for 8.8 million people accessed through a company's account

What happened. Denmark's Ministry of Research, Education and Digitalisation announced on October 5 that unauthorized parties misused a Danish company's lawful access to the Central Person Register (CPR). During September they extracted the names, addresses and CPR numbers of about 8.8 million registered people, including emigrants and deceased persons. People with name and address protection were not included. The activity was detected on October 2.

Who is affected. The company's access has been revoked. The ministry has notified Datatilsynet, the Danish data protection authority, and police are investigating. A security review of the whole CPR system is under way.

Why it matters. A CPR number is a lifelong identifier used across banking, health care and public services. The immediate risk for those affected is convincing fraud from callers who already know their details. The government has extended its cyber hotline to 8 a.m. to midnight.

What to do. — click a step to check it off

1. Do not accept a CPR number, or any national ID number, as proof of identity in call centers or account recovery.
2. Review third-party access to bulk personal-data systems and alert on query volumes beyond business need.
3. Individuals should never share passwords, MitID approvals or other sensitive details by phone or email, even when the caller knows personal details.

3. Atlassian: critical unauthenticated file read across eight Data Center products (CVE-2026-21589)

What happened. Atlassian disclosed CVE-2026-21589 on October 5. The path traversal flaw (CVSS 9.3) lets an unauthenticated attacker read specific files within the web application root. The attacker must know the file's exact name and path; the flaw does not allow directory listing.

Who is affected. All versions of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo and Crowd Data Center, Crucible and Fisheye are affected. Atlassian Cloud is already patched with no evidence of exploitation; the advisory does not report exploitation of self-hosted instances either. Configuration files can hold credentials, so exposure matters even without directory listing.

What to do. — click a step to check it off

1. Upgrade to the fixed releases listed for each product (for example, Confluence 9.2.26 or 10.2.19).
2. If you cannot patch immediately, restrict internet access to the instance and apply Atlassian's WAF, reverse-proxy or Tomcat rewrite rules — Atlassian says these are not a substitute for patching.
3. Review access logs for encoded "../" sequences in request URLs.

4. University of Illinois Chicago: ransomware and data theft at the College of Medicine

What happened. UIC says a ransomware attack temporarily disabled some College of Medicine systems, now restored, and that attackers obtained some data from college servers. UIC is still determining whether personal, research or academic information was involved. The main UIC network and UI Health patient care were not affected.

Unconfirmed claim. A group calling itself Booba has claimed the attack and theft of 344 GB, according to The Record; UIC has not confirmed the claim or what data types are involved. UIC says it will notify everyone affected once its forensic review is complete.

What to do. — click a step to check it off

1. Verify segmentation between academic and clinical networks — it appears to have limited impact in this incident.
2. Inventory research data sets holding participant or health data so scope can be set quickly if asked.
3. UIC community members should watch for incident-themed phishing and direct questions to security@uic.edu.

Compliance and personal data

This section is general information, not legal advice.

Also notable

Touchpoint's Take

Today's stories share a theme: trusted access turned against its owners. NetScaler sits in front of identity flows, Denmark's register was drained through an authorized company, and the FBI's exposure traces to a contractor's missed patch. The weak point was a sanctioned system nobody watched closely enough.

Behind the 8.8 million Danish records are people whose lifelong ID number is not easily replaced. Protecting them now depends on organizations refusing to treat that number as proof of identity.

What we would change in a security program:

1. Treat edge devices as critical identity infrastructure. Patch them first, and assume compromise when they misbehave — a platform producing three exploited flaws in a week has stopped being a one-time patch item.
2. Put third-party access back at the center of governance. Who can query what, at what volume, and who would notice? The Denmark breach went undetected for weeks because the access itself was legitimate.
3. Treat a de-identification claim as only as good as the re-identification test behind it. The IQVIA decision shows regulators will test the claim, not the label.

If you would like help assessing your exposure to these issues or your breach-response readiness, the Touchpoint Security team is available to talk.

Sources

• Citrix Security Bulletin CTX697174 for CVE-2026-88779
• CISA Known Exploited Vulnerabilities catalog (official data feed)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (Oct. 4, 2026)
• SecurityWeek: Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
• The Record: US, Australia warn of latest Citrix vulnerability
• Ministry of Research, Education and Digitalisation: Omfattende uautoriseret adgang til borgeres CPR-oplysninger
• The Record: Data breach at Denmark's national population register exposes 8.8 million people
• Atlassian: CVE-2026-21589 Arbitrary File Access Vulnerability Impacts Multiple Products
• The Hacker News: Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
• UIC Today: College of Medicine systems compromised
• The Record: University of Illinois Chicago affected by ransomware attack on medical school
• Garante per la protezione dei dati personali: IQVIA decision announcement
• Sen. Mark Warner: Senate Passes Warner Legislation to Strengthen Cybersecurity in Health Care
• The HIPAA Journal: Senate Unanimously Passes the Health Care Cybersecurity and Resiliency Act
• BleepingComputer: IQVIA fined $7.8 million for failing to properly anonymize health data
• MSRC Security Update Guide: CVE-2026-96940
• Microsoft Exchange Team: Released: September 2026 V2 Exchange Server Security Updates
• NVD: CVE-2026-61500
• Rejetto HFS v3.2.1 release
• VulnCheck advisory: Rejetto HFS session forgery via predictable signing key
• SecurityWeek: Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct. 2, 2026)
• Nikkei: notice on Microsoft 365 account compromise (Oct. 4, 2026)
• Nikkei: notice on Google Workspace account compromise
• BleepingComputer: Nikkei discloses breaches of employees' Microsoft, Google email accounts
• The Hacker News: FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
• Wikimedia Foundation: OpenAI rogue agent activities found on Wikimedia projects
• The Record: Wikimedia Foundation: OpenAI agents tried to edit pages and compromise notes tool