Weekly Report
Period: Week 41, 2026 (2026-09-28 β 2026-10-05)
Summary
Internationally, the week was dominated by active exploitation of perimeter infrastructure, with CISA adding Citrix NetScaler (CVE-2026-88771, CVE-2026-88772) [9], Fortinet FortiMail (CVE-2026-104286) [10], and an Apple vulnerability (CVE-2026-86950) [7] to its Known Exploited Vulnerabilities catalog. The UK's NCSC on 2026-09-28 urged immediate mitigation of the NetScaler flaws [4]. Ransomware activity continued against European targets, with Thegentlemen claiming Lisbon-based Defencebit [2] and M3RX claiming Polish firm Intense.pl [5], alongside a confirmed breach of OpenInfra Europe's Artifactory environment [3]. Hitachi Energy also disclosed critical (CVSS 9.1) vulnerabilities in end-of-life RTU500 CMU firmware, based on Dragos research [6].
Patterns and Trends
The dominant pattern this week was the near-simultaneous exploitation of perimeter network products β Citrix, Fortinet, and Apple β all confirmed via KEV additions within days of each other [4][7][9][10], consistent with prior weeks' focus on edge-device exploitation but intensified in volume and vendor breadth. Ransomware reporting continued to target IT service and security providers directly (Defencebit, Intense.pl) rather than end-user organizations [2][5], a continuation of the pattern seen in recent weeks of supply-chain-adjacent targeting. Unlike previous reporting periods, no domestic Swedish incident was identifiable in the source material, representing a gap in direct national reporting rather than an absence of underlying risk, given Sweden's exposure to the same globally affected products. The reappearance of legacy/end-of-life industrial control system vulnerabilities (Hitachi Energy RTU500) [6] signals continued attacker interest in long-unpatched operational technology alongside modern perimeter software.
Domestic (K1)
No domestic events reported this period. The provided source material consists almost entirely of global vulnerability advisories (CISA Known Exploited Vulnerabilities catalog additions, Citrix advisory AV26-965, Fortinet advisory AV26-989), a general industry commentary piece on insecure coding practices, a crypto-theft recap, and an EU-level monthly threat brief from ENISA-affiliated CERT-EU [1]. None of these articles name a Swedish victim organization, describe an incident that physically occurred in Sweden, or reference a decision issued by a Swedish authority. The EU Cyber Brief [1] covers European-level trends (including ransomware group Akira and APT29 activity) but does not attribute any specific incident to a Swedish target.
Assessment
Given the absence of reported domestic incidents this period, no causal chain specific to Sweden can be established from the available sources. The high volume of generic vulnerability advisories (CISA KEV, Citrix, Fortinet) circulating globally means that, consistent with historical patterns, it is likely (60-90%) that Swedish public-sector or critical-infrastructure entities using affected products will be indirectly exposed to related exploitation attempts in coming weeks β however, no source material confirms this has already occurred domestically, and this assessment should not be read as evidence of an actual domestic event.
International (K2/K3)
The week was characterized by active exploitation of critical network infrastructure at several major vendors, alongside continued ransomware activity targeting European and Polish operations. The most acute threat involved Citrix NetScaler ADC and NetScaler Gateway, where NCSC in the United Kingdom on 2026-09-28 urged organizations to immediately mitigate vulnerabilities being actively exploited [4]. According to Canadian cyber.gc.ca, the U.S. agency CISA on 2026-09-27 added two vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to its catalog of Known Exploited Vulnerabilities (KEV), affecting NetScaler ADC and Gateway in versions 14.1 prior to 14.1-73.37 and 13.1 prior to 13.1-63. Fortinet faced similar issues: on 2026-10-01, Fortinet confirmed that CVE-2026-104286 is being exploited in the wild in FortiMail versions prior to 8.0.2, 7.6.7, and 7.4.9 respectively, leading CISA to add the vulnerability to its KEV catalog on the same day [10], A2. CISA also expanded its catalog on 2026-09-29 with an additional vulnerability, an Apple product with an out-of-bounds write flaw (CVE-2026-86950), which according to the agency represents a frequent attack vector against federal systems [7], A2 β confirmed information based on observed active exploitation.
In the ransomware sector, ransomware.live reported on 2026-09-30 that the group Thegentlemen published a new victim, the Lisbon-based security firm Defencebit, which according to its own description offers offensive security services and is a spinoff from the Angolan state-aligned integrator Bullray-CIT [2], B2 β generally reliable source, likely true information but not independently verified. On the same day, undercodenews.com reported that ransomware group M3RX claimed responsibility for an attack against Polish IT consulting firm Intense.pl, linked to NTENSE Group, with alleged operational disruption as a result; the information has not yet been independently verified according to the source [5], C2 β reasonably reliable source, possibly true information. Additional supply chain concerns arose surrounding an alleged data breach at the regional council in Centre-Val de Loire in France and a confirmed security breach in OpenInfra Europe's self-hosted JFrog Artifactory environment, reported on 2026-10-01 [3], C2.
At the industrial control systems level, Hitachi Energy published on 2026-09-30 a security advisory regarding critical vulnerabilities (CVSS 9.1) in RTU500 CMU firmware, based on findings reported by Dragos and concerning legacy firmware version 9. Hacker News summarized the week in its review and noted among other things a cryptocurrency theft of 387 million dollars and continued exploitation of Citrix vulnerabilities as part of a broader pattern of weak service accounts, old bugs, and exposed systems being exploited by attackers [11], B2.
Assessment
The fact that CISA within the same week added vulnerabilities in Citrix, Fortinet, and Apple products to its KEV catalog, all with confirmed active exploitation, indicates that attackers are systematically targeting perimeter equipment at government agencies and enterprises [4][7][9][10]. Given that the NetScaler and FortiMail vulnerabilities affect widely used infrastructure in the public sector and critical operations, it is highly likely (>90%) that more organizations in Europe will report intrusion attempts linked to these specific CVEs in coming weeks, based on historical patterns for similar KEV additions. The parallel ransomware activity targeting Polish and Portuguese actors [2][5], combined with supply chain incidents in France [3], points to sustained high tempo of targeted attacks against IT service providers in Europe, which is likely (60-90%) to continue given the insufficiently verified but recurring reporting from multiple independent sources.
Follow-up Items
- CISA KEV catalog entries CVE-2026-88771 and CVE-2026-88772 (Citrix NetScaler ADC/Gateway) β remediation deadline and patch status for versions prior to 14.1-73.37 and 13.1-63.
- CISA KEV entry CVE-2026-104286 (Fortinet FortiMail) β confirm patch adoption rate for versions prior to 8.0.2, 7.6.7, and 7.4.9 following 2026-10-01 catalog addition [10].
- Hitachi Energy advisory on RTU500 CMU firmware (CVSS 9.1, legacy 9.x branch, end-of-life) β monitor for vendor-issued compensating controls given no further firmware updates are planned [6].
- Unverified claim by ransomware group M3RX against Intense.pl (NTENSE Group) β independent confirmation of operational impact outstanding [5].
- Alleged data breach at the regional council in Centre-Val de Loire, France β verification status and scope of affected data remain unconfirmed [3].
Note: Claims flagged for review: 15. See "To verify" below. Automatically removed (low confidence): 4.
Generated 2026-10-05 04:40 UTC from 11 priority articles (10 cited).
[1] cert.europa.eu β https://cert.europa.eu/publications/threat-intelligence/cb26-10/
[2] ransomware.live β https://www.ransomware.live/id/RGVmZW5jZWJpdEB0aGVnZW50bGVtZW4=
[3] undercodenews.com β https://undercodenews.com/alleged-centre-val-de-loire-data-leak-and-openinfra-europe-jfrog-breach-raise-fresh-supply-chain-concerns-video/
[4] ncsc.gov.uk β https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway
[5] undercodenews.com β https://undercodenews.com/m3rx-ransomware-group-claims-attack-on-polands-intensepl-disrupting-ntense-group-operations-video/
[6] ncsc.fi β https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch
[7] us-cert.gov β https://www.cisa.gov/news-events/alerts/2026/09/29/cisa-adds-one-known-exploited-vulnerability-catalog
[9] cyber.gc.ca β https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965
[10] cyber.gc.ca β https://cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-989
[11] thehackernews.com β https://thehackernews.com/2026/09/weekly-recap-387m-crypto-hack-citrix.html
To verify
- [2][5] "pl) rather than end-us
[... Report truncated. View full report at link above.]
