When Gateways and Mail Appliances Are Open: An October 2026 UK SME Threat Briefing

The fortnight spanning late September and early October 2026 has a clear theme for UK SMEs: the appliances that terminate remote access and email are being treated as primary targets again. Three items belong on this month's list. Citrix NetScaler ADC and NetScaler Gateway have two critical flaws under confirmed exploitation, with the NCSC publishing a UK alert on 28 September. Fortinet FortiMail has an unauthenticated path-traversal arbitrary file write (CVSS 9.8) that Fortinet and CISA both treat as exploited in the wild. An on-premises SharePoint code-injection flaw shipped in the August Patch Tuesday cycle and added to CISA's Known Exploited Vulnerabilities catalog on 25 September is still sitting unapplied on farms that deferred it as "only spoofing".

This is a briefing. Skip to the sections that apply to your stack.

1. Citrix NetScaler: NCSC alert, two exploited RCEs, patch then hunt

On 27 September 2026 Citrix published CTX697096, covering eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway. Two of them, CVE-2026-88771 and CVE-2026-88772, are confirmed as actively exploited. CISA added both to the Known Exploited Vulnerabilities catalog the same day. On 28 September the NCSC urged UK organisations to mitigate promptly.

The priority pair

The other six CVEs in the bulletin (HTTP request smuggling, feature-policy bypass and several memory-overflow issues) still need the same fixed builds. Treat the whole bulletin as one upgrade, not a pick-and-mix.

Patch to at least

Secure Private Access Hybrid deployments that use customer-managed NetScaler instances are in scope. Citrix-managed cloud services are outside this bulletin. If you run SAML authentication on NetScaler, also review Citrix's follow-on bulletin for CVE-2026-88779 (published 3 October): the fixed builds for that issue are higher (14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282). Prefer those later builds where available so you close both the September RCE pair and the SAML-related follow-on in one change window.

NCSC priority actions (summarised)

Hunt and integrity checks

Citrix surfaces Indicators of Compromise detection through NetScaler Console (Security Advisory workflow). File Integrity Monitoring on managed instances helps catch unexpected file changes. Citrix itself warns that IoC logic does not cover every technique, so a clean scan is not proof of cleanliness. If the appliance was internet-reachable on an affected build, preserve logs and configuration snapshots before the upgrade where you can, then rotate credentials tied to the Gateway and linked identity systems if compromise is indicated.

There is no workaround for CVE-2026-88771 or CVE-2026-88772. Upgrading is the fix.

2. Fortinet FortiMail CVE-2026-104286: unauthenticated file write, exploited

On 1 October 2026 Fortinet published FG-IR-26-175 for CVE-2026-104286, a critical path-traversal and NULL-byte flaw in the FortiMail GUI (CVSS 9.8). An unauthenticated attacker can write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. Fortinet states the issue has been reported as exploited in the wild. CISA added it to KEV on 1 October.

Affected / fixed

Fortinet remediated FortiMail Cloud on 5 October 2026 (firmware moved to 7.6.7 GA or 8.0.2 GA). Cloud customers need no upgrade action from their side. On-premises and self-managed virtual appliances do.

Containment if you cannot upgrade in hours

Hunt before you declare clean

Fortinet published IoCs with the advisory. Look for outbound connections toward 79.141.169[.]187 and 45.129.0[.]192, unexpected archive-account configuration (Fortinet's sample shows an account such as 'archive234' pointing at a remote IP under '/uploads') and encryption/IBE log anomalies including Base64 decode failures and failed internal-user logins. Patching alone does not prove the appliance was never reached while unpatched. Treat internet-exposed FortiMail the same way you treat an unpatched VPN: upgrade, then verify.

3. SharePoint CVE-2026-65660: the August patch that became a September KEV item

CVE-2026-65660 is a code-injection flaw in on-premises Microsoft SharePoint Server. Microsoft shipped the fix on 11 August 2026. On 25 September CISA added it to KEV as a Microsoft SharePoint Code Injection Vulnerability, based on evidence of active exploitation. Public technical detail and proof-of-concept material circulated from around 22 September, which is the usual cue for opportunistic scanning.

Why this is still an October problem for many SMEs: early public description framed the issue closer to spoofing at a lower severity, so some teams deferred the August cumulative update. CISA's listing and subsequent analysis treat it as authenticated remote code execution (low privileges, no user interaction, CVSS 8.8 in current records). Reporting also notes that chaining with a previously patched authentication bypass can remove the need for a valid account on farms that still allow anonymous page access and missed earlier fixes. Do not triage by the first headline severity. Triage by whether the product is internet-facing and whether CISA has added it to KEV.

Confirm you are at least on

SharePoint Online is not affected by this CVE. SharePoint Server 2016 and 2019 reached end of mainstream support earlier in 2026; if you are still on those lines, the August security update is a stopgap while you plan a supported path, not a long-term posture.

If the farm was reachable while unpatched, apply the August update, review recent web-shell and unusual process activity and rotate ASP.NET machine keys so any forged ViewState or related persistence is invalidated. Restrict any remaining internet-facing SharePoint behind authenticated access.

The pattern behind October

None of these needed a novel technique aimed at your line of business. They needed a public management or VPN surface, a deferred emergency build or a severity label that looked comfortable in August. The NCSC's 8 October joint advisory on China-linked activity enabled by Integrity Technology Group (including AI-assisted scanning alongside botnets and hands-on exploitation) is the strategic frame: opportunistic edge compromise at scale, then data theft. Your job this month is the boring half of that fight. Shrink the exposed surface and close the KEV items.

What UK SMEs should do this month

Pick the items relevant to your stack and put a date next to each:

How fractional teams help

We inventory what is actually internet-reachable, move NetScaler and FortiMail onto the fixed builds, run the published compromise checks, take management and webmail interfaces off public IP space, close the August SharePoint gap on farms that deferred it and put a KEV-triggered patch rhythm into monthly operations so an edge flaw disclosed at the end of one week is not your incident at the start of the next. If your MSP owns the kit, we help you ask the right questions and validate the answers.

Further reading