Node1 Security logo

PUBLIC::WEATHER

Cyber Weather Report

What attackers actually did over the last seven days, observed directly on live decoy sensors and written up in plain English. No jargon, no login.

WEEK 41 :: 28 SEP – 05 OCT 2026
Edge appliances
Stormy
Remote access / VPN
Front moving in
Web / CMS / app servers
Clear
Other services
Clear
Storm :: active exploitation

Vulnerability Exploited (CVE-2026-88771): widespread exploitation attempts against Citrix NetScaler

Sensors recorded 1,396 events matching Vulnerability Exploited (CVE-2026-88771) this week, arriving from 25 distinct source networks — the distributed pattern that usually means a technique is circulating widely rather than one actor probing. Activity concentrated on Citrix NetScaler. Volume is new this week. If you operate affected systems, prioritise patching and review logs from 28 Sep onward.

events 1,396unique sources 25sensor types 1trend new this week
Vulnerability Exploited (CVE-2026-88771)Citrix NetScaler
Front :: emerging pattern

Vulnerability Exploited (CVE-2025-5777): emerging activity against Citrix NetScaler

Watch Vulnerability Exploited (CVE-2025-5777): 4,806 events from 8 source networks this week, concentrated on Citrix NetScaler (+14464% w/w). The volume is modest but the direction is up. Worth confirming patch levels on the affected products before this develops further.

events 4,806unique sources 8sensor types 1trend +14464% w/w
Vulnerability Exploited (CVE-2025-5777)Citrix NetScaler
Front :: sustained activity

MAB login POST: sustained pressure on Check Point Mobile Access SSL VPN

Steady traffic matching MAB login POST — 64,003 events, 75 sources, aimed at Check Point Mobile Access SSL VPN (-47% w/w). No spike, no decline: this is the constant hum of automated exploitation. Systems exposed to it should be patched as a matter of routine, not response.

events 64,003unique sources 75sensor types 1trend -47% w/w
MAB login POSTCheck Point Mobile Access SSL VPN
Front :: sustained activity

WebVPN login: sustained pressure on Cisco ASA

Steady traffic matching WebVPN login — 23,329 events, 196 sources, aimed at Cisco ASA (+38% w/w). No spike, no decline: this is the constant hum of automated exploitation. Systems exposed to it should be patched as a matter of routine, not response.

events 23,329unique sources 196sensor types 1trend +38% w/w
WebVPN loginCisco ASA

This is the digest. The dashboard has the live feed - every event, every source, every payload.

Sign in to the dashboard