ConnectWise Breach, NetScaler RCE, and the MSP Trust Problem

On 15 October 2026, a threat actor authenticated to Microsoft Graph API using a compromised ConnectWise Cloud Backup vendor credential, gaining automated access to hundreds of customer Microsoft 365 tenants. Meanwhile, CVE-2026-88771, a critical remote code execution vulnerability in NetScaler Application Delivery Controller and Gateway, continues to be actively exploited with web shell deployment documented in the wild. This episode examines both incidents through the lens of supply-chain risk in managed service provider relationships. Mauven walks through the structural security implications of vendor-level service principals, the exploitation mechanics of the NetScaler vulnerability, and the practical steps UK small businesses should take to audit third-party access to their environments. Also covered: F5’s out-of-band patches for critical NGINX vulnerabilities. This is not theoretical exposure. These are active incidents requiring immediate response from businesses that rely on MSP-managed infrastructure.

Chapters

• Intro Mauven opens the 19 October 2026 briefing with an urgent note for businesses using MSP relationships or Citrix VPN infrastructure. Two active, documented incidents require immediate attention.
• ConnectWise Supply-Chain Breach Hits M365 Tenants On 15 October, an attacker used a compromised ConnectWise Cloud Backup vendor credential to traverse hundreds of Microsoft 365 customer tenants via automated GUID-sorted enumeration. The incident exposes the structural risk of vendor-level service principals. Mauven details the authentication mechanics, the scope of exposure, and four actionable steps: confirm product use with your MSP, audit enterprise applications in Azure AD, check audit logs for IP 144.172.64.128, and demand written answers on credential rotation processes.
• CTA Follow the show and share this episode with anyone managing an MSP relationship or making patching decisions.
• NetScaler RCE CVE-2026-88771 Under Active Exploitation CVE-2026-88771, disclosed 27 September 2026, is a CVSS 9.8 remote code execution vulnerability in NetScaler ADC and Gateway. CISA has added it to the Known Exploited Vulnerabilities catalogue. Attackers are deploying web shells for persistent access. Mauven outlines patching priorities, the importance of pre-patch compromise review, and the need for written confirmation from MSPs managing NetScaler infrastructure.
• Critical NGINX Vulnerabilities Patched Out-of-Band F5 has released out-of-band patches for multiple critical NGINX vulnerabilities, including three enabling remote code execution. Businesses using managed hosting should confirm with providers that patches have been applied.
• The Pattern All three incidents share a common thread: the products and vendors between your business and the internet are part of your attack surface. NCSC guidance on supply-chain risk and third-party access controls exists but is inconsistently applied across the MSP industry.
• Outro Mauven closes with two priority questions for MSPs: what is connected to our Microsoft 365 tenancy and what permissions does it have, and have our NetScaler appliances been patched and reviewed for compromise. Written answers required.

Links

• https://www.huntress.com/blog/connectwise-cloud-backup-breach
• https://www.ncsc.gov.uk/collection/supply-chain-security
• https://support.citrix.com/article/CTX626634
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.zscaler.com/blogs/security-research/netscaler-cve-2026-88771-exploitation-analysis
• https://www.f5.com/company/blog/security/nginx-out-of-band-security-patches
• https://www.bleepingcomputer.com/news/security/f5-nginx-vulnerabilities-patched-out-of-band/