Sécurité IT 2026-09-27

Niveau Tendu — 77/100 — 2026-09-27

Journée « Tendu » : 11 sujets classés, 2 des 10 premiers signalés comme activement exploités, 2 failles ajoutées au catalogue des vulnérabilités exploitées de la CISA. En tête : Citrix NetScaler Improper Input Validation Vulnerability (85/100).

1. Citrix NetScaler Improper Input Validation Vulnerability — 85/100 (CVE-2026-88771)
2. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability — 85/100 (CVE-2026-88772)
3. CVE-2026-88773 — Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetS… — 36/100 (CVE-2026-88773)
4. CVE-2026-88775 — Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88775)
5. CVE-2026-88776 — Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88776)
6. CVE-2026-88777 — Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. — 34/100 (CVE-2026-88777)
7. CVE-2026-97163 — Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6… — 30/100 (CVE-2026-97163)
8. CVE-2026-94130 — Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An S… — 28/100 (CVE-2026-94130)
9. CVE-2026-100833 — Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect a… — 26/100 (CVE-2026-100833)
10. CVE-2026-97162 — Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 — 25/100 (CVE-2026-97162)