The Lyceum: Cybersecurity Daily — Mar 24, 2026

Your VPN edge is leaking memory, your patch management appliance is the thing that needs patching, and the Trivy supply chain compromise just jumped to a second security vendor's CI/CD pipeline. Today is a day of compounding trust failures — the tools built to protect infrastructure are the ones with holes in them, and the window between "advisory published" and "exploit in the wild" keeps shrinking toward zero.

• CVE-2026-21262 — SQL Server: publicly disclosed zero-day patched in Microsoft's March 2026 Patch Tuesday, CVSS 8.8 elevation of privilege. No in-the-wild exploitation confirmed yet.
• CVE-2026-26127 — .NET: publicly disclosed zero-day patched in March 2026 Patch Tuesday, CVSS 7.5 denial of service. No active exploitation or PoC reported.
• CVE-2026-29058 — Metasploit module — AVideo Encoder getImage.php unauthenticated command injection: already weaponized in Metasploit as of March 20. Unauthenticated RCE against self-hosted video platforms.

Citrix shipped emergency patches today for two vulnerabilities in NetScaler ADC and Gateway — the appliances that sit at the perimeter of thousands of enterprise networks handling VPN, load balancing, and single sign-on. The headline flaw is CVE-2026-3055 (CVSS 9.3), an input validation failure that lets an attacker force the device to disclose portions of its working memory without authenticating. Session tokens, cryptographic keys, credentials mid-transit — all potentially readable by anyone who can reach the appliance.

Security firms are already drawing explicit comparisons to "CitrixBleed," the 2023 memory-leak vulnerability that powered months of mass exploitation. The comparison isn't hyperbole: when NetScaler is configured as a SAML Identity Provider — a common setup for SSO — the exploit path becomes fully unauthenticated, which is exactly the configuration most large enterprises run. A second flaw, CVE-2026-4368, is a session race condition that can corrupt or mix user sessions, compounding the risk.

If this succeeds as an attack vector, expect mass scanning within hours of someone reverse-engineering today's patch diff. The observable signal: GreyNoise or Shadowserver reporting scan spikes against NetScaler ports. If you run NetScaler on your perimeter, patch per CTX696300 today, not tomorrow. Monitor for anomalous session behavior and unexpected token reuse. The second-order risk: stolen session tokens from this window could enable persistent access even after patching.

CISA's federally mandated remediation deadline for CVE-2026-22719 in VMware Aria Operations — the monitoring platform many enterprises use to manage their virtual infrastructure — was set to expire March 24. This is a command injection vulnerability that lets an unauthenticated attacker execute arbitrary commands on Aria Operations nodes, particularly during support-assisted product migration. Broadcom patched it February 24 and provided a workaround script ("aria-ops-rce-workaround.sh"), but acknowledged reports of active exploitation while hedging that it "cannot independently confirm their validity."

CISA doesn't add vulnerabilities to the Known Exploited Vulnerabilities catalog on speculation. If you're a federal civilian agency, you will be overdue if not remediated. If you're anyone else, the KEV catalog is the closest thing to a smoke alarm that only triggers on confirmed fire — treat it accordingly.

What failure looks like here is straightforward: an attacker with RCE on your monitoring infrastructure can see everything that infrastructure monitors, pivot laterally, and potentially manipulate the data your operations team trusts for decision-making. The signal to watch: if Broadcom drops its hedge and confirms exploitation directly, expect the scope of affected organizations to be larger than current reporting suggests.

The supply chain compromise that hit Trivy on March 19 didn't stop there. Sysdig reported today that an identical credential stealer appeared in Checkmarx GitHub Actions workflows — specifically checkmarx/ast-github-action and checkmarx/kics-github-action — approximately four days after the Trivy breach. The compromise is tracked as CVE-2026-33634 (CVSS 9.4), and Sysdig's assessment is that credentials stolen during the Trivy incident were used to poison these additional workflows.

This is supply chain attack mechanics operating exactly as designed: compromise one trusted security tool, harvest its credentials, then use those credentials to reach everything that trusted it. Checkmarx's GitHub Actions are used by development teams to scan code for vulnerabilities in CI/CD pipelines — the automated systems that build and deploy software. The attacker group, tracked as TeamPCP, is still active.

If your development pipeline uses either Checkmarx Action, audit workflow logs for unusual credential usage or unexpected environment variable access since March 19. Rotate any secrets exposed in those environments. The non-obvious consequence: if TeamPCP's stealer appears in a third security toolchain this week, this stops being an isolated incident and becomes a coordinated campaign targeting the security tooling ecosystem itself — the tools defenders trust to find problems becoming the vector for new ones.

Arctic Wolf observed threat actors exploiting CVE-2025-32975 — a maximum-severity authentication bypass in Quest KACE Systems Management Appliance — starting the week of March 9 in customer environments. KACE SMA is the tool organizations use to centrally manage and push updates to their endpoints. The irony writes itself: the patch management appliance is the unpatched thing.

Quest released a fix in May 2025, meaning vulnerable organizations have had ten months of exposure. The flaw lets attackers impersonate legitimate users without valid credentials, and in observed attacks, threat actors seized administrative accounts and executed remote commands to drop Base64-encoded payloads. Arctic Wolf hasn't disclosed the end goal yet, but an attacker with admin access to your patch management tool can push arbitrary software to every managed endpoint in your organization.

The second-order risk is what makes this especially dangerous: KACE SMA with admin access is a ransomware operator's dream staging ground — one compromised appliance, one malicious "update," and every endpoint it manages is owned simultaneously. The signal to watch: if Arctic Wolf or Quest publish IOCs showing ransomware pre-positioning, the blast radius of this campaign could be enormous. If KACE SMA is in your environment and you haven't applied the May 2025 update, this is the most urgent item on your list today.

Xakep.ru reports the Linux Foundation is implementing new policies to shield open-source maintainers from the growing flood of AI-generated pull requests and issue reports — machine-produced submissions that waste maintainer time reviewing nonsensical or subtly broken code. The measures include automated detection of AI-generated contributions and new contributor verification requirements. This matters amid maintainer burnout, which is already a critical vulnerability in the open-source supply chain, and AI slop is accelerating it. Source: Xakep.ru — Russian. No English-language coverage confirmed at time of publication.

CERT-UA Advisory #19542 documents UAC-0001 (APT28, Russia's GRU-linked threat group) conducting cyberattacks against Ukraine and EU member states using an exploit for CVE-2026-21509. The advisory describes active targeting of government and defense-sector organizations with this specific vulnerability as an initial access vector. For organizations in EU member states, this is a direct signal to verify patching status for this CVE and monitor for APT28 TTPs in your environment. Source: CERT-UA Advisory #19542 — Ukrainian. No English-language coverage confirmed at time of publication.

Xakep.ru published a technical breakdown of the Trivy vulnerability scanner compromise, providing additional Russian-language detail on how the supply chain attack propagated and what credentials were harvested. The analysis complements English-language reporting from Sysdig and adds context about the attacker group's operational patterns. Source: Xakep.ru — Russian. No English-language coverage confirmed at time of publication.

A VPN appliance bleeding its secrets to anyone who asks, a patch management tool that's the one thing in your environment that hasn't been patched, and a vulnerability scanner whose compromise is now infecting the other vulnerability scanners — it's turtles all the way down, and every turtle has an RCE.

Somewhere a diving instructor is reading about Citrix's legal team scrambling to issue patches and thinking, "At least they didn't call a lawyer."

Watch your edges. Patch your patchers.

If someone you know runs NetScaler, mailcow, or a motionEye box they forgot about — forward this before the scanners find it first.