Exploited this week: Atlassian, Citrix, Fortinet and Ivanti

Four products are reported as exploited right now. Three of them sit at the edge of a network or hold central business data, which makes them a favourite target. The list below names the CVEs; the details belong in each vendor's own advisory.

What is being exploited

• Atlassian Data Center: CVE-2026-21589.
• Citrix NetScaler: CVE-2026-88779.
• Fortinet FortiMail: CVE-2026-104286.
• Ivanti Connect Secure: reported as exploited, but we could not find a CVE ID for it.

For the Ivanti issue, check Ivanti's own security advisory rather than waiting for a CVE number, and treat it as exploited until you have confirmed otherwise.

Why these products matter

Three of these four sit at the edge of a network or hold central business data: a gateway, a VPN, a mail filter and a collaboration server. Attackers like them because one flaw can open the door to everything behind them, and because they are often reachable from the internet. The speed matters too: a VPN flaw was exploited within 48 hours of disclosure earlier this month.

Triage in four steps

1. Find them. Check your asset inventory, certificate lists and cloud accounts for these products, including test and forgotten instances.
2. Check exposure. Which ones can be reached from the internet, and which management interfaces are exposed?
3. Read the advisory. Confirm the affected versions and the fixed or mitigated versions with each vendor.
4. Fix, then look for signs of compromise. If a system was reachable while vulnerable, patching alone does not prove it was not breached. Review its logs and configuration for changes you did not make.

Reduce the exposure

• Keep management interfaces off the public internet.
• Restrict VPN and gateway administration to known addresses.
• Subscribe to each vendor's security notices, so the next one reaches you first.

The bottom line

Find out whether you run these four products, confirm the details in the vendor advisories, patch or mitigate, and check anything that was exposed. The same habit helped in the HTTP/2 rapid reset variants that still knock over unpatched edges: know what faces the internet before an attacker does.