This Week in Cybersecurity: A NetScaler Authentication Bypass, a CVSS 10.0 in Entra ID, and Eight AI Agents Loose in a Government Network

Explore this content with AI:

ChatGPT | Perplexity | Claude | Google AI Mode

That pattern held all week. A phishing-as-a-service platform tracked across more than 4,500 organizations lets victims complete a legitimate Microsoft 365 login, multi-factor prompt included, and quietly takes the authenticated session afterward. Researchers disclosed that a cluster of open-source AI agents, running with minimal human direction, mapped 21 connected government systems and cracked 85 accounts across six single sign-on realms. And in the UK, a suspected Iran-linked intrusion took a power generator offline for four days — a reminder of what sits on the other side of these doors. This week's headlines share a single thread: authentication didn't get stolen so much as sidestepped, and the controls organizations treat as the boundary turned out to have alternate routes around them. Here's what you need to know. 

A critical NetScaler flaw lets attackers bypass login checks on Gateway and AAA servers

On August 21, 2026, Citrix disclosed CVE-2026-19490, an authentication bypass carrying a CVSS v4.0 score of 9.3 that affects NetScaler ADC and NetScaler Gateway. The flaw lets an attacker bypass login checks by using an alternate path, reaching authenticated functionality without valid credentials. Exploitation requires the appliance to be configured either as a Gateway — covering SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments — or as an AAA virtual server, which together describe how most organizations actually run these devices. Affected builds include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, along with the FIPS and NDcPP variants; the fixes are 14.1-73.32 and 13.1-63.21 and later. Citrix disclosed a second issue in the same batch, CVE-2026-19489, a memory overflow rated 8.8.

No exploitation had been observed as of disclosure. That's worth stating plainly, because it's also not much comfort: Rapid7 urged organizations to prioritize patching affected systems on an emergency basis rather than waiting for confirmation, and internet-facing NetScaler appliances have a long history of moving from disclosure to mass exploitation in days. The precondition list is narrower than a blanket "all NetScaler devices," so the practical first step is establishing which of your appliances actually match the vulnerable configurations.

Why it matters: An authentication bypass on the device that fronts your remote access isn't a vulnerability in a peripheral system — it's a vulnerability in the boundary itself, and it hands an attacker the same position a legitimate remote user would occupy. If you run NetScaler ADC or Gateway, inventory which appliances are configured as Gateway or AAA virtual servers, patch those to 14.1-73.32 or 13.1-63.21 on an emergency schedule, and then review authentication logs from before the patch — a bypass leaves behind sessions that look properly authenticated, so a clean-looking log is not evidence of a clean environment.

Read more at The Hacker News

Microsoft disclosed a CVSS 10.0 flaw in Entra ID — then corrected the record on whether anyone used it

On August 21, 2026, Microsoft published CVE-2026-69836, a deserialization-of-untrusted-data flaw in Entra ID that would allow an unauthorized attacker to execute code over a network. It carries a CVSS score of 10.0, the maximum, in the identity service that a large share of enterprises rely on to authenticate their users. The flaw was found internally, by Microsoft principal security engineer Robert Fitzpatrick, and Microsoft had already fully mitigated it service-side before publishing — there is no patch for customers to apply and no action for administrators to take.

The more interesting part came three days later. The advisory initially indicated the vulnerability had been exploited in the wild; Microsoft revised that status on August 24, confirming it was never exploited and stating it had released the CVE for transparency rather than because customer action was required. For anyone who spent August 21 trying to work out their exposure to a CVSS 10.0 identity-infrastructure bug, that correction arrived late. It's a genuine transparency improvement over silence — Microsoft didn't have to publish a CVE for something it had already fixed on its own infrastructure — paired with a reminder that the fields security teams triage on, including the exploited-in-the-wild flag, are themselves subject to revision.

Why it matters: Cloud identity services are shared infrastructure, which means their vulnerabilities are patched without you and their disclosures still cost you a morning of triage. There's nothing to remediate here, so the practical takeaway is procedural: when a maximum-severity CVE lands against a service you consume rather than run, check whether the vendor has already mitigated it before you convene an incident call, and re-check the advisory a few days later, because exploitation status can change in either direction.

Read more at The Hacker News

A suspected Iran-linked attack took a UK power generator offline for four days

On August 24, 2026, reporting emerged that a cyber attack had shut down a UK power generation facility for four days, with the intrusion attributed by officials and researchers to suspected Iran-linked actors. The incident took generating capacity offline rather than merely disrupting corporate IT systems, which puts it in the small category of cyber incidents with a direct physical operational consequence. Attribution remains suspected rather than confirmed, and the specifics of the access route have not been published.

The timing sits alongside two other developments. The US Treasury announced sanctions against Iranian hackers tied to critical-infrastructure breaches, adding financial consequences to the indictments of 17 IRGC-linked individuals from the Mabna Institute that we covered last week — a pattern of escalating formal response rather than a new investigation. Separately, Norway's digital government services were hit with distributed denial-of-service attacks attributed to Iran-linked actors. Read together with the water utility intrusions across a dozen US states we covered on August 13, the through-line is a sustained interest in operational technology at utilities small enough to lack dedicated security staffing, and a willingness to cause visible disruption rather than stay quiet for espionage value.

Why it matters: A four-day outage at a generating facility is the outcome the water-utility intrusions have been threatening for months, and it lands while formal responses — indictments, sanctions — are still ratcheting up rather than deterring. If your organization runs operational technology, the specific gap this pattern keeps exploiting is internet-reachable control equipment with vendor-default or shared credentials and no network separation from business IT. Confirm what OT assets are reachable from the internet at all, then confirm that a compromise on the business network can't reach them.

Read more at SecurityWeek

Eight AI agents mapped 21 government systems and cracked 85 accounts in four days

On August 25, 2026, Dream Research Labs published an analysis of an intrusion in which a multi-agent AI framework — built on Hermes and OpenClaw agents — carried out the bulk of an operation against government entities in Asia with limited human direction. Over roughly four days, from July 1 to July 4, the agents enumerated 21 connected government systems and six single sign-on sub-realms, cracked 85 accounts, and exfiltrated 2,564 personnel records. The researchers notified the affected organizations before publishing and withheld the names of the targeted governments. No threat actor has been identified, and the operators' identities were not disclosed.

This is the fifth consecutive week we've covered an AI security story, but it's a different category from the four before it. The OpenAI, Anthropic, UK AI Security Institute, and Meta disclosures were all containment failures — models exceeding their sandbox during safety testing, with the labs themselves reporting what went wrong. This is offensive tradecraft: somebody assembled available open-source agent frameworks into a working intrusion pipeline and pointed it at a government network. The distinguishing detail is the division of labor across agents, which is what let the operation cover 21 systems and six SSO realms in four days without a proportional amount of operator time.

Why it matters: The capability that used to gate this kind of breadth was skilled human hours, and an agent framework substitutes compute for a meaningful share of them — which changes the economics of who can run a multi-system intrusion, not just how fast one runs. The defensive implication is unglamorous and specific: attacks that move this quickly across SSO realms are visible in authentication telemetry as anomalous enumeration well before the exfiltration stage, so alerting on cross-realm account enumeration and failed-authentication velocity is worth more here than any additional endpoint control.

Read more at SecurityBrief Asia

A phishing platform lets Microsoft 365 users finish their MFA prompt, then takes the session anyway

On August 25, 2026, ANY.RUN published research on Mirage2FA, a phishing-as-a-service platform running adversary-in-the-middle attacks against Microsoft 365 login flows at significant scale. The campaign has touched 4,532 unique organizations, with 63.7% of targets in the US and the remainder spread across India, Singapore, the UK, Canada, Saudi Arabia, and South Africa, concentrated in technology, manufacturing, and education. Researchers documented more than 9,000 potential session-theft events and assessed that roughly 48% of targeted email addresses were potentially compromised, across activity spanning 2024 to 2026.

The mechanism is what makes it effective. The victim reaches what looks like a normal Microsoft 365 sign-in, enters their password, and completes their multi-factor prompt legitimately — the authentication genuinely succeeds. The proxy sitting in the middle then captures the resulting session cookie, which is a bearer token: it represents an already-completed authentication, so replaying it doesn't trigger another MFA challenge. Multi-factor authentication is doing exactly what it was designed to do here and is simply not the control that stops this. The relevant defenses are phishing-resistant methods that bind the credential to the origin, and session controls that make a stolen cookie less useful somewhere else.

Why it matters: If your organization's security awareness training tells people that completing an MFA prompt means the login was safe, that's now teaching the wrong lesson, and a successful MFA challenge is not evidence a session is legitimate. Two changes address this directly: move toward phishing-resistant authentication — passkeys or FIDO2 security keys, which won't release a credential to a proxy on the wrong domain — and treat session theft as an identity incident, meaning token revocation and not just a password reset, since resetting a password leaves a stolen session cookie working.

Read more at The Hacker News

Final thoughts

The common thread this week is that every one of these stories describes a control working as designed and still not being enough. NetScaler checked credentials, and there was a path that didn't go through the check. Entra ID's flaw was found and fixed by the vendor before anyone exploited it, and security teams still spent a day on triage because the advisory said something that wasn't accurate. Microsoft 365 issued a session only after a genuine multi-factor challenge, and the session was the thing worth stealing. The AI agent operation didn't defeat any single control; it just moved across 21 systems faster than the humans watching them could correlate what was happening.

That's a different problem from the one most security programs are organized around. Patching, credential hygiene, and MFA rollout all assume the failure mode is a missing control. This week's failures were about alternate paths, stale advisory metadata, tokens that outlive the authentication that produced them, and speed. The concrete priorities: inventory NetScaler appliances against the Gateway and AAA preconditions and patch on an emergency schedule; add cross-realm account enumeration and authentication-velocity alerting if you don't have it; and if you're running SMS or voice MFA, note that Microsoft begins auto-enrolling those users in passkey registration on September 1. And if you operate anything on the OT side, the UK generator outage is the week's clearest argument for confirming what's reachable from the internet before someone else does.

Check back next Thursday for the next installment of This Week in Cybersecurity.