Weekly Security Watch
This week’s developments converge on two control failures: trusted access infrastructure exposed to rapid exploitation, and human behavior that weakens identity and information safeguards.
Important Developments
Dutch research highlights gaps in employee cyber behavior
On October 1st, the NCSC published the results of its study on employee behavior. As per the report, many employees remain overconfident about secure cyber behavior and make insufficient use of two-factor authentication. A safe reporting culture increases the likelihood that employees disclose mistakes, while approximately half of employees share personal documents with AI tools, according to the organization.
Delayed reporting can extend attacker dwell time, while weak adoption of two-factor authentication raises account-takeover risk. And it goes without saying that sharing documents containing sensitive data with external AI services may create GDPR, confidentiality, records-management, and supplier-risk concerns.
Recommended actions: Make phishing and data-loss reporting nonpunitive and measurable; require phishing-resistant multifactor authentication for privileged and high-risk accounts; define approved AI services and prohibited data classes; monitor uploads to unsanctioned AI services; brief managers on responding constructively to employee mistakes.
Sources:
https://feeds.ncsc.nl/
Critical Vulnerabilities
Actively exploited Zammad zero-days require compromise assessment
The NCSC warned on September 30 that two Zammad zero-day vulnerabilities, CVE-2026-102489 and CVE-2026-102490, have been actively exploited since at least September 21. Both are rated 9.4 under CVSS v4. CVE-2026-102489 permits unauthenticated remote code execution in Zammad versions 6.3.0 through 6.5.4. CVE-2026-102490 allows a low-privileged attacker to obtain root privileges and remained unpatched when the NCSC advisory was published.
Zammad handles customer-service communications and may contain customer data, attachments, account information, and internal operational details. Root-level compromise can turn a service desk into a route for data theft and further attacks.
Impact: Attackers may execute code, take full control of the host, alter or delete data, and use the system for lateral movement. Affected organizations should assess personal-data exposure and whether NIS2, Dutch Cybersecurity Act, GDPR, or contractual notification duties apply.
Recommended actions: Preserve application and network logs before changes; apply the available fix for CVE-2026-102489 immediately; contact the supplier regarding CVE-2026-102490; restrict external access and isolate exposed systems where feasible; examine activity from September 21 onward; rotate credentials and tokens accessible to the application if compromise is suspected.
Sources:
https://www.ncsc.nl/alerts/actief-misbruik-van-zeroday-kwetsbaarheden-in-zammad-update-nu
https://advisories.ncsc.nl/2026/ncsc-2026-0396.html
https://csirt.divd.nl/DIVD-2026-00015
Actively exploited Citrix NetScaler flaws expose remote-access gateways
Two critical Citrix NetScaler ADC and NetScaler Gateway vulnerabilities are already being exploited, warned the NCSC. CVE-2026-88771, rated 9.5, can allow an unauthenticated remote attacker to execute arbitrary commands across affected deployments. CVE-2026-88772, also rated 9.5, can lead to remote code execution or denial of service when DTLS is enabled, which Citrix states is the default on a VPN virtual server. Citrix released updates, and the NCSC expanded its guidance with indicators of compromise and a scanning script on September 30.
NetScaler devices often provide remote access and sit directly in front of internal applications. Successful exploitation can bypass the normal identity boundary and give an attacker control over a trusted gateway.
Impact: Compromise may provide access toward internal networks or interrupt VPN, gateway, and load-balancing services, affecting remote work and application availability. Covered entities should record exposure, remediation, forensic findings, and notification decisions under NIS2, the Dutch Cybersecurity Act, DORA, and GDPR as applicable.
Recommended actions: Update affected versions immediately; use the NCSC-provided indicators and scanning guidance; review historical appliance and authentication logs; restrict management access; verify configuration integrity; rotate secrets reachable from the appliance; treat evidence of exploitation as an incident rather than a patch-only event.
Sources:
https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu
https://advisories.ncsc.nl/2026/ncsc-2026-0394.html
Takeaways
This week’s developments converge on two control failures: trusted access infrastructure that is exposed to rapid exploitation, and human behavior that weakens identity and information safeguards. Zammad and NetScaler show why patching cannot be separated from compromise assessment. The findings from the Dutch workforce report show the same principle at the user layer: prevention alone is insufficient when mistakes are not reported quickly or sensitive data is moved into unapproved AI services.
This overview was generated with AI assistance and has been verified and edited by a human editor. If you have spotted a factual error, please let us know in the comments.
The information contained in this security watch is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. CISO Community and CISO Platform Nederland assume no legal liability or responsibility for any damage resulting from either the use or inability to use the information included. This includes damage resulting from the inaccuracy or incompleteness of the information contained in the briefing.
