No company name was given, so this treats you as a typical mid-size EU device maker with plants in Ireland and Malaysia. This week proposes one rating change (R07, 3×5 to 4×5) and two new risks (C1, C2); R12 and R19 hold, and no in-window Ireland-specific item or resin trigger was verified.
01CISA · Sep 27Citrix NetScaler zero-days exploited; CISA adds both to KEV
Citrix disclosed eight NetScaler ADC and Gateway vulnerabilities (CVE-2026-88771 to 88778) on Sep 27. Citrix confirmed exploitation of CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) on unmitigated deployments. CISA added both to its KEV catalog, said it had reports and partner intelligence confirming active global exploitation, and urged checking for compromise and preserving forensics before patching.
Per Help Net Security, fixed builds are 14.1-73.37 and 13.1-64.23 and webshells were planted. Researcher Kevin Beaumont said attacks had run for weeks and were 'probably nation state aligned' (his speculation, not confirmed). Tenable said it was not determined whether exploitation had reached wide scale, and that historically about two-thirds of NetScaler threat activity was APT and one-third ransomware affiliates (Tenable's research). Trade outlet MedDeviceCyber (secondhand) reported a CVSS of 9.5, more than 50,000 exposed instances, and three Dutch hospitals disabling systems as a precaution. Whether your plants use NetScaler is unknown.
For the register: R07 Ransomware on manufacturing systems, currently 3×5; propose 4×5 (one step), driven by sector exposure to an actively exploited VPN gateway; confirm whether you run NetScaler.
02CISA · Oct 4Third NetScaler flaw, CVE-2026-88779, added to KEV; attacks seen
CISA added CVE-2026-88779, a memory overflow that can cause denial of service, to KEV on Oct 4. Citrix said it observed targeted attacks on unmitigated deployments and found no impact on data integrity. Exploitation requires a SAML authentication configuration with Gateway or AAA. Fixed builds are 14.1-73.41 and 13.1-64.28.
Help Net Security reports probing and webshell-install attempts seen on Beaumont's honeypots, but it is unclear whether the flaw allows remote code execution. CISA set an Oct 7 deadline for US federal agencies. Citrix's IoC script can give false positives, so review results and preserve evidence before updating (per watchTowr).
For the register: R07, supports the proposed 4×5; no further rating step, since this is a DoS flaw and no confirmed hit on you. Confirm patch status and SAML use.
03MarineRadar · Sep 9Ransomware halted Malaysia's Port of Tanjung Pelepas on Sep 9
Outside the seven-day window but within 30 days: port systems went offline late on Sep 9 and a phased restart began Sep 10, per MarineRadar. Ransomware was reported as the cause; the port handled about 14 million TEU in 2025. Kuehne+Nagel issued a delay advisory.
Attribution and scope are as reported by trade press; this edition did not verify a primary port statement.
For the register: New risk C2, 'Malaysian port or logistics ransomware delay', proposed 2×3 and watch; driver is the reported Sep 9 outage. R12 no change, monitor (no verified resin trigger).
04EU MDR revision · Aug 11 statusEU MDR reform remains a proposal; no Council position yet
Per consultancy Entourage (secondary analysis, status as of Aug 11, published Sep 1), the Commission's targeted revision COM(2025) 1023 (Dec 16, 2025) proposes ending general certificate time limits, replacing routine recertification with periodic risk-based review. Parliament's SANT draft report was published Jun 30, 2026 and no first-reading position has been adopted. The Council had no general approach and there is no binding timetable. Entourage says adoption in 2026 is possible but could slip into 2027.
No new Council or Parliament event within the window was verified. A Lancet Regional Health – Europe commentary reported Oct 1 urges anchoring reform in regulatory science; that is opinion, not a trigger.
For the register: R19 EU MDR recertification delay, 3×4; no change, monitor. The current certificate cycle still applies until reform becomes law.
05Cooley LLP · Sep 22Leaked European Product Act draft proposes turnover-based penalties
Cooley LLP (via JD Supra) reports a leaked draft, with the Commission expected to publish its proposal on Oct 6, 2026, so the text may change. The draft would require pre-market registration and digital product passports, set penalties of 1–6% of global annual turnover, tighten oversight of notified bodies, add a market-surveillance fee on third-country imports, and exclude medicinal products and food.
How it treats medical devices, which sit under sector law, was not verified. This is a law firm's reading of a leaked draft.
For the register: New risk C1, 'EU Product Act overlay on device compliance', proposed 2×3 and watch; driver is the leaked draft. Confirm scope with counsel once the text is published.
Enable JavaScript to read this edition.