In the past week, three pieces of software that small businesses actually run got added to the “attackers are using this right now” pile.
CISA added a Citrix NetScaler flaw, CVE-2026-88779, to its Known Exploited Vulnerabilities catalog on October 4 (CISA). Two days earlier it added two bugs in Zammad, the open-source help desk ticketing system, one of which lets an attacker ride an existing user’s session and one of which hands out privileges the account should not have (CISA). And Microsoft warned that attackers have been exploiting a critical Zimbra mail server flaw, CVE-2026-73570, to drop web shells, grab credentials, and package up mailboxes for export (Ars Technica).
Different vendors, same story. All three are things you host yourself, all three sit where the internet can reach them, and in a lot of small companies nobody can tell you the last time any of them were patched. That is the actual vulnerability. Here is the checklist.
1. Write down everything of yours that answers from the internet
Not a feeling. A list. Your firewall or VPN appliance, your mail server if you still run one, your help desk or ticketing portal, your remote desktop gateway, your phone system admin page, that old web app a developer stood up in 2019. Pull your public IP addresses and your DNS records and go line by line. You cannot patch what nobody remembers owning.
2. If you run Citrix NetScaler, patch it today
CVE-2026-88779 is a memory corruption bug in a box that sits at your front door and brokers remote access. It is on the KEV list because it is being exploited, not because it might be. NetScaler appliances have a long history of being the thing a ransomware crew walks in through, which is the same pattern we wrote about when ransomware gangs started hitting SonicWall remote access. Apply the vendor update, then reboot and confirm the version actually changed.
3. If you run Zimbra, patch and assume mail was read
The Zimbra patch came out in July. The attacks started days later. Microsoft saw scanning tools confirming the exploit worked, then operators installing web shells, escalating privileges, and creating mail archives to haul off. The flaw only bites when the optional zimbra-snmp package is installed and SNMP notifications are turned on, so check that first, turn SNMP notifications off if you do not need them, then patch anyway. After that, treat credentials as burned: force password resets, revoke active sessions, and look for mailbox rules and forwarders you did not create.
4. If you run Zammad, patch it and log everyone out
Session fixation plus a privilege management bug is a nasty pair. One lets an attacker end up inside somebody else’s logged-in session, the other lets that session do more than it should. A help desk system is a soft target that people forget is sensitive, and it is full of password reset requests, employee names, and internal notes. Update it, then invalidate every active session so anything an attacker is sitting on dies.
5. Give patching a name and a day
Most small businesses do not have a patching problem, they have an ownership problem. Pick a person. Pick a recurring day. Write down which systems are in scope and what the deadline is for a critical fix: 72 hours for anything internet-facing is a reasonable bar, same-day if it is on the KEV list. Server and appliance patching is a big part of what we do under managed IT precisely because it is the thing that slips when everyone is busy.
6. Read the KEV catalog once a week
It is free, it is public, and most weeks it is one to three entries. Five minutes on a Monday tells you whether anything you own is currently being attacked in the wild. That is a better signal than any vendor newsletter you are subscribed to.
7. After you patch, go look backward
CISA’s own directive now tells federal agencies to check whether attackers got in before the patch landed, and that logic applies to you too. A patch closes the door. It does not evict anyone already inside. Check for new local accounts, scheduled tasks, unexpected files in web directories, and outbound connections to places you do not recognize. If you have endpoint detection in place, that review takes an afternoon. If you do not, you are guessing, which is why we deploy monitored endpoint detection on every server and workstation we manage.
The honest summary
None of these three products are exotic. Mail, remote access, and a ticket queue are about as ordinary as business software gets. The attackers are not finding clever new things. They are scanning for ordinary things that went six months without an update, and small businesses supply those in volume.
If you are not sure what of yours is exposed, or when it was last patched, that is a short conversation and a worthwhile one. Book a free 15-minute consult.