Today, attackers are targeting vulnerabilities in ONLYOFFICE Docs, ProFTPD, Citrix NetScaler, and Zammad. Small businesses should review their systems for these risks.
ONLYOFFICE Docs (CVE-2021-3199)
ONLYOFFICE Docs is a document collaboration service. An attacker can exploit this vulnerability to upload malicious images, potentially leading to remote code execution. Businesses should update ONLYOFFICE to the latest version and review their image upload settings.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
ProFTPD ProFTPD (CVE-2015-3306)
ProFTPD is a file transfer service. Attackers can use this vulnerability to read and write to arbitrary files, including sensitive data. Businesses should ensure ProFTPD is up-to-date and restrict FTP access as needed.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Citrix NetScaler (CVE-2026-88779)
Citrix NetScaler is a network load balancer. This vulnerability can cause a denial of service. Businesses should monitor their Citrix NetScaler for unusual activity and consider patching if they are using older versions.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Zammad GmbH Zammad (CVE-2026-102490)
Zammad is a customer support software. This vulnerability allows local users to escalate privileges, potentially leading to unauthorized access. Businesses should update Zammad to the latest version and review their user and permission settings.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Turn on automatic updates
Most of the attacks in this list work only on software that has not been updated. Let your phone, computer and browser update themselves, and restart when they ask.
Doing it once, properly
Cheaper is usually more expensive in the long run: a rushed or bargain setup is often done again from the start, and you pay twice, plus whatever the breach in between cost.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2021-3199 on the National Vulnerability Database
- CVE-2015-3306 on the National Vulnerability Database
- CVE-2026-88779 on the National Vulnerability Database
- CVE-2026-102490 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.