erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: June 30, 2026

2 editorial briefs and 4 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE. Owners of customer-managed NetScaler ADC or Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or using SAML, on builds older than 14.1-72.61 or 13.1-63.18.
  • Check exposure: ColdFusion CVE-2026-48282: Exploited RDS Path Traversal. Anyone running ColdFusion 2025 Update 9 or 2023 Update 20 and earlier, most urgently servers where Remote Development Services (RDS) is enabled, unauthenticated, and reachable from untrusted networks.
  • Go: 4 critical advisories (github.com/fission/fission). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-8452

NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE

Any NetScaler configured as a Gateway or AAA server that is still below the June 30 builds needs patching today and a check for web shells; the bug the vendor called DoS is a public pre-auth RCE under attack.

Must act: Owners of customer-managed NetScaler ADC or Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or using SAML, on builds older than 14.1-72.61 or 13.1-63.18.

Can relax: Appliances already on 14.1-72.61, 13.1-63.18, 13.1-37.272 FIPS/NDcPP or later (including the September 2026 builds), appliances used only for load balancing, and Citrix-managed cloud services.

  1. Run show ns version on every NetScaler and list those configured as Gateway or AAA (add vpn vserver / add authentication vserver in ns.conf).
  2. Upgrade to 14.1-72.61, 13.1-63.18 or 13.1-37.272 FIPS/NDcPP or later; the September 2026 builds 14.1-73.41 and 13.1-64.28 also fix CVE-2026-88771/88772.
  3. Move any appliance on a release line the bulletin does not list to a supported, fixed build.

Read the brief →

Check exposure

· Vulnerability · CVE-2026-48282, CVE-2026-48313

ColdFusion CVE-2026-48282: Exploited RDS Path Traversal

Every ColdFusion 2023/2025 server should already be on the June updates; if RDS was enabled without authentication and reachable, assume the box may be compromised and hunt.

Must act: Anyone running ColdFusion 2025 Update 9 or 2023 Update 20 and earlier, most urgently servers where Remote Development Services (RDS) is enabled, unauthenticated, and reachable from untrusted networks.

Can relax: Teams that do not run ColdFusion, and ColdFusion servers that are already on 2025 Update 10 or 2023 Update 21 with RDS disabled, which is not the exploited configuration.

  1. Install ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 (Adobe Priority 1) on every instance, including staging and internal servers.
  2. Confirm RDS is disabled on production servers; if a developer workflow truly needs it, require RDS authentication and keep it off untrusted networks.
  3. Block /CFIDE/main/ide.cfm at the reverse proxy or WAF for all external traffic.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 4

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 4

Check: govulncheck ./...