Security Digest: November 13, 2026 - 22 Critical Vulnerabilities

Today’s patch load is unusually high-risk. The most dangerous issues include a Rails/Active Storage flaw that can expose secrets and potentially lead to remote code execution, an authentication bypass in Rucio that can let unauthenticated attackers impersonate accounts, and multiple Citrix NetScaler memory corruption bugs that can crash or destabilize edge appliances.

· 14 min read

Urgent Security Alert: 22 Critical Vulnerabilities Demand Immediate Action

Today’s patch load is unusually high-risk. The most dangerous issues include a Rails/Active Storage flaw that can expose secrets and potentially lead to remote code execution, an authentication bypass in Rucio that can let unauthenticated attackers impersonate accounts, and multiple Citrix NetScaler memory corruption bugs that can crash or destabilize edge appliances. Several additional flaws affect widely used imaging, parsing, and serialization libraries, meaning exposed web apps and file-processing services should be treated as priority targets now.

Action required today: patch internet-facing systems first, disable or restrict risky file-processing paths where possible, and review any application that accepts untrusted uploads or deserializes untrusted data.

Critical Vulnerabilities

  • CVE-2026-100397: Rucio SSH challenge token authentication bypass
    • Impact: Unauthenticated attackers can obtain a valid SSH challenge token for any account and reuse it as an auth bearer token, including administrative accounts.
    • Affected Systems: pip rucio deployments using the vulnerable authentication flow.
    • Immediate Action: Block unauthenticated access to auth endpoints, rotate exposed tokens, and force reauthentication for all users.
    • Mitigation: Upgrade to a fixed Rucio release as soon as available; treat all recently issued tokens as suspect.
  • CVE-2026-122006: Rails Active Storage / ImageMagick file write and secret exposure
    • Impact: Crafted uploads can write arbitrary files and, with Disk storage, read sensitive files such as secret_key_base, credentials, and service tokens; this can lead to RCE or lateral movement.
    • Affected Systems: activestorage < 8.0.5.2 and activestorage >= 8.1, < 8.1.4.1 using MiniMagick/ImageMagick with untrusted uploads.
    • Immediate Action: Stop accepting untrusted image uploads if possible, patch Rails immediately, and assume secrets are exposed if Disk storage was used.
    • Mitigation: Upgrade activestorage; ensure mini_magick >= 5.1; apply the ImageMagick policy that blocks MSL, Ghostscript coders, and gs.
  • CVE-2026-107412: Citrix NetScaler ADC/Gateway memory overflow
    • Impact: Remote attackers may trigger unpredictable behavior or denial of service.
    • Affected Systems: Citrix NetScaler ADC and Citrix NetScaler Gateway.
    • Immediate Action: Prioritize patching all internet-facing appliances and prepare for failover if service instability appears.
    • Mitigation: Apply the vendor-fixed build for your branch; restrict management and monitor for crashes.
  • CVE-2026-107410: Citrix NetScaler Push memory overflow
    • Impact: Potential denial of service on NetScaler ADC/Gateway.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch immediately on exposed appliances.
    • Mitigation: Install the corrected Citrix release.
  • CVE-2026-120868: Citrix NetScaler packet processing memory overflow
    • Impact: Remote denial of service or unstable behavior.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Move this to the top of your edge-device patch queue.
    • Mitigation: Update to the vendor-fixed version and verify appliance health after reboot.
  • CVE-2026-127275: Linksys EA8100 missing authentication in JNAP API
    • Impact: Remote attackers can bypass authentication and manipulate router settings; public exploit code exists.
    • Affected Systems: Linksys EA8100 1.0.3.216940.
    • Immediate Action: Remove exposed devices from the internet, change admin credentials, and replace or isolate affected hardware if patching is unavailable.
    • Mitigation: Apply vendor firmware if released; otherwise segment and restrict access immediately.
  • CVE-2026-107407: Citrix NetScaler SMPP traffic memory overflow
    • Impact: Denial of service or unstable appliance behavior.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch and monitor SMS/SMPP-related services closely.
    • Mitigation: Upgrade to the fixed Citrix build.
  • CVE-2026-107408: Citrix NetScaler DNS/DoH memory corruption
    • Impact: Remote denial of service through DNS or DoH handling.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Treat DNS-facing appliances as high priority and patch first.
    • Mitigation: Install the vendor patch and validate DNS service continuity.
  • CVE-2026-127277: Linksys EA8100 SMB service improper initialization
    • Impact: Remote attackers can trigger improper initialization via ANON_ACCESS; public exploit code exists.
    • Affected Systems: Linksys EA8100 1.0.3.216940.
    • Immediate Action: Restrict WAN access and replace exposed devices if no fix is available.
    • Mitigation: Apply firmware updates or isolate the device from untrusted networks.
  • CVE-2026-107409: Citrix NetScaler DoH memory corruption
    • Impact: Denial of service in NetScaler ADC/Gateway.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch immediately and watch for resolver instability.
    • Mitigation: Update to the fixed Citrix release.
  • CVE-2026-107415: Citrix NetScaler Email OTP authentication overflow
    • Impact: Authentication services may crash or behave unpredictably.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch before exposing login flows to users.
    • Mitigation: Apply the vendor update.
  • CVE-2026-111340: Citrix NetScaler KBA authentication overflow
    • Impact: Denial of service in knowledge-based authentication.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch and verify authentication availability.
    • Mitigation: Install the fixed build.
  • CVE-2026-128066: Pillow TIFF/EXIF metadata memory exhaustion
    • Impact: Small crafted images can drive memory use to exhaustion and crash workers.
    • Affected Systems: Pillow versions before 13.0.0.
    • Immediate Action: Block untrusted image uploads or route them through a size-limited worker now.
    • Mitigation: Upgrade to Pillow 13.0.0; add upload and processing limits.
  • CVE-2026-107414: Citrix NetScaler WebAuth memory overflow
    • Impact: Remote denial of service or unstable behavior.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch edge appliances immediately.
    • Mitigation: Apply the corrected Citrix release.
  • CVE-2026-111341: Citrix NetScaler client-certificate authentication overflow
    • Impact: Authentication path can crash or misbehave.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Prioritize if you use certificate-based login.
    • Mitigation: Upgrade to the fixed version.
  • CVE-2026-107413: Citrix NetScaler SAML authentication overflow
    • Impact: SAML login flows can be destabilized or denied.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch before peak authentication traffic.
    • Mitigation: Install the vendor patch.
  • CVE-2026-111342: Citrix NetScaler LDAP authentication overflow
    • Impact: LDAP-backed authentication may fail or crash.
    • Affected Systems: Citrix NetScaler ADC and Gateway.
    • Immediate Action: Patch and test directory authentication immediately after.
    • Mitigation: Update to the fixed Citrix release.
  • CVE-2026-128067: Pillow libtiff image save memory corruption
    • Impact: Crafted metadata can leak heap memory, crash the process, or corrupt memory during TIFF encoding.
    • Affected Systems: Pillow versions before 13.0.0, especially apps saving TIFF with libtiff.
    • Immediate Action: Disable untrusted TIFF export paths and patch the library.
    • Mitigation: Upgrade to Pillow 13.0.0; restrict attacker-controlled geometry tags.
  • CVE-2026-126982: MongoDB C# Driver BSON type allow-list bypass
    • Impact: Attackers who can plant BSON/JSON may instantiate unintended .NET types and, in some apps, reach code execution.
    • Affected Systems: Applications using the vulnerable MongoDB C# Driver BSON serialization path.
    • Immediate Action: Stop deserializing untrusted data into loosely typed members until patched.
    • Mitigation: Upgrade the MongoDB C# Driver and review deserialization allow-lists.
  • CVE-2026-126190: Soup Sieve descendant-combinator CPU exhaustion
    • Impact: Small nested documents can pin a CPU for seconds to minutes during selector matching.
    • Affected Systems: pip soupsieve used on untrusted HTML/XML.
    • Immediate Action: Limit document size/depth and avoid descendant-heavy selectors on untrusted input.
    • Mitigation: Upgrade to Soup Sieve 4.0 or later.
  • CVE-2026-126081: Rails ActionController::Parameters each_key mass-assignment bypass
    • Impact: Certain apps can accidentally pass unpermitted parameters into mass assignment, allowing unauthorized attribute changes.
    • Affected Systems: actionpack < 8.0.5.2 and actionpack >= 8.1, < 8.1.4.1.
    • Immediate Action: Search for uses of each_key whose return value feeds new, update, or assign_attributes.
    • Mitigation: Upgrade Rails; do not rely on each_key return values.
  • CVE-2026-126366: JRuby MessagePack oversized allocation
    • Impact: Short crafted MessagePack input can trigger huge allocations and exhaust JVM heap.
    • Affected Systems: msgpack for JRuby before 1.8.7.
    • Immediate Action: Block untrusted MessagePack input or process it in a memory-limited worker.
    • Mitigation: Upgrade to MessagePack 1.8.7.

What to Do Now

  1. Patch edge devices first: Citrix NetScaler appliances, then exposed Linksys devices, then web apps using Rails, Pillow, Rucio, Soup Sieve, MongoDB C# Driver, or MessagePack.
  2. Assume exposure where uploads or deserialization are involved: If untrusted users can upload files or supply serialized data, treat those services as active attack targets.
  3. Rotate secrets if Active Storage Disk service was exposed: Change secret_key_base, master keys, database and storage credentials, and third-party tokens.
  4. Verify versions now: Confirm Rails/Active Storage, ActionPack, Pillow, Soup Sieve, and MessagePack are on fixed releases; confirm Citrix appliances are on vendor-fixed builds.
  5. Review logs for abuse: Look for unusual auth token requests, repeated image uploads, suspicious TIFF/EXIF files, and spikes in appliance errors or restarts.

Monitoring recommendations: Alert on authentication anomalies, worker crashes, memory spikes, unexpected file writes, and repeated 4xx/5xx errors on upload and login endpoints. Add temporary rate limits and upload restrictions where feasible.

Related Resources

  • Internal: Add an internal incident note or patch-status blog post for today’s critical vulnerability response.
  • Official vendor advisories: Citrix security bulletins, Rails security advisories, ImageMagick security policy, Pillow release notes, MongoDB C# Driver release notes, and MessagePack for Ruby release notes.

Keep reading