Threat Analysis: Citrix NetScaler Flaws, MLflow Exploitation, and the Manic Android Malware Targeting Europe
Hello, Mauven here.
This is your Daily Threat Analysis for the 20th of August 2026.
Three items today. One carries the highest possible operational urgency, CISA-confirmed active exploitation in the wild. The second requires a conversation with your IT provider today, not next week. The third is a European banking malware story that most UK SMB owners will dismiss as irrelevant to them, and that is precisely why I am covering it.
Priority One: MLflow Under Active Exploitation, CISA KEV Addition
CISA has added a critical vulnerability in MLflow to its Known Exploited Vulnerabilities catalogue. For those unfamiliar, a KEV addition is not a theoretical risk assessment. It means CISA has confirmed that threat actors are actively using this vulnerability in real attacks, right now.
MLflow is an open-source platform used to manage machine learning experiments, model deployments, and AI pipelines. If that sounds abstract, think of it this way: any business that has a data science function, or whose managed service provider is running AI/ML tooling on their behalf, may have MLflow in their environment, and may not know it.
The vulnerability is a server-side request forgery (SSRF) flaw. What that means in practice is that an attacker can send crafted requests through the MLflow server to reach internal systems and services that should not be publicly accessible. In environments where MLflow has access to cloud credentials, model artefacts, or internal APIs, which is most production MLflow deployments, the potential for lateral movement and data access is significant.
What the advisory does not spell out is the quiet reality that MLflow is frequently deployed by data teams who operate outside the normal IT security review cycle. It gets stood up quickly, it is not always included in vulnerability scanning schedules, and it is rarely configured with the same rigour as core business applications. That is the gap being exploited.
What to do: If you have a data team, ask them today whether MLflow is running anywhere in your environment, including cloud instances, dev environments, and anything managed by a third party on your behalf. If the answer is yes, patch immediately and review network access controls so the MLflow instance is not reachable from the public internet. If you do not know the answer, that itself is information worth having.
Priority Two: Citrix NetScaler, Patch Immediately
Citrix has issued an urgent advisory covering two new vulnerabilities in NetScaler Gateway and NetScaler ADC. The company is not using measured language here, the advisory says patch as soon as possible, and that phrasing from a vendor of this size reflects a considered assessment of exploitation likelihood.
NetScaler Gateway is widely deployed as a remote access solution for organisations of all sizes, including many UK SMBs who use it to provide staff with secure access to internal applications. NetScaler ADC is a network appliance used for load balancing and application delivery. Both are perimeter-facing infrastructure, meaning they are, by design, accessible from the internet.
The specific technical details of both CVEs have not been fully disclosed at time of writing, which is consistent with responsible disclosure practice when exploitation risk is high. What matters operationally is that Citrix does not typically issue emergency language without cause. Their track record on NetScaler vulnerabilities, particularly CVE-2023-3519 and subsequent exploitation waves, tells you something about how serious the vendor takes this product’s exposure surface.
The advisory has direct relevance to the UK SMB space because NetScaler Gateway is frequently deployed and managed by IT providers rather than in-house teams. If your remote access solution runs through Citrix, the question is not whether your provider will patch, it is when, and how you verify it has happened.
What to do: Contact your IT provider or MSP today and ask specifically: have the August 2026 Citrix NetScaler vulnerabilities been applied to our environment, and what is the timeline if not? If they are not aware of the advisory, that is a separate conversation you need to have about how they track vendor security communications. Do not wait for the next scheduled maintenance window.
On the Radar: Manic Android Malware Spreading Across Europe
A new Android banking trojan called Manic is targeting users across multiple European countries. The malware has one feature that sets it apart from standard banking trojans and warrants attention here.
Manic includes a fallback data exfiltration mechanism that uses nearby infected devices as relay points. If the compromised device loses internet connectivity, whether through network controls, MDM policies, or deliberate blocking, the malware can still transmit stolen data by routing it through other Manic-infected devices in close physical proximity, using short-range wireless communication.
This is not a theoretical capability. It is a documented feature of this specific malware family, and it matters because it partially defeats the assumption that network-level controls provide meaningful protection against data exfiltration from mobile devices.
For UK SMBs, the immediate relevance is BYOD. If your staff use personal Android devices to access work email, Microsoft 365, banking applications, or internal systems, and most do, because most UK SMBs do not have the resource to enforce strict mobile device management, then a device compromised by Manic could exfiltrate credentials and session tokens regardless of whether your office WiFi has content filtering in place.
The malware is currently documented as targeting European users. The UK is in Europe, geographically speaking, whatever your political preferences on the matter.
What to do: This is a BYOD hygiene issue. Encourage staff to only install Android applications from the Google Play Store, to keep Android security updates current, and to review which work accounts are accessible on personal devices. If your business handles sensitive client data and has no mobile device management policy, this is a reasonable prompt to have that conversation with your IT provider.
Also Worth Noting: NCSC on Agentic AI
The NCSC published a blog post today on managing the cyber risk of agentic AI, systems that operate autonomously on your behalf, making decisions and taking actions without direct human approval for each step.
The timing is not coincidental. Agentic AI tools are being sold to SMBs right now as productivity solutions: AI that books meetings, drafts responses, manages workflows, and accesses third-party services on your behalf. What the marketing materials do not typically cover is the attack surface that creates.
The NCSC’s guidance covers sandboxing, active oversight, and constraining what autonomous systems can actually do. If you are evaluating or have already deployed AI tools that act on your behalf, and increasingly the boundary between a productivity tool and an AI agent is not obvious, the NCSC blog is worth fifteen minutes of your time.
This connects, incidentally, to the separate story today about Grok being manipulated via prompt injection, where encrypted instructions embedded in content were used to redirect the AI’s behaviour. Prompt injection is not a niche research problem. It is an active attack technique, and as AI tools become more deeply integrated into business workflows, the consequences of a successful injection escalate accordingly.
What Today Tells You
Three of today’s stories share a common thread: exploitation of infrastructure and tools that organisations deploy without fully understanding or monitoring their exposure. MLflow gets stood up by data teams. NetScaler gets managed by IT providers. Android devices get used by staff. Agentic AI tools get purchased by operations teams. In each case, the security review either does not happen or is not rigorous enough.
The attackers understand this. The gap between deployment and security review is the attack surface.
Sources
| Source | Title | URL |
|---|---|---|
| BleepingComputer | Citrix urges admins to patch new NetScaler flaws as soon as possible | https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible/ |
| BleepingComputer | CISA warns of hackers exploiting critical MLflow vulnerability | https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-mlflow-vulnerability/ |
| BleepingComputer | New Manic Android malware can exfiltrate data through nearby devices | https://www.bleepingcomputer.com/news/security/new-manic-android-malware-can-exfiltrate-data-through-nearby-devices/ |
| NCSC | Managing the cyber risk of agentic AI | https://www.ncsc.gov.uk/blogs/managing-the-cyber-risk-of-agentic-ai |
| CISA | Known Exploited Vulnerabilities Catalog | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| The Register | Grok chat duped into swallowing injected instructions | https://www.theregister.com/ai-and-ml/2026/08/20/grok-chat-duped-into-swallowing-injected-instructions/5290019 |
Before tomorrow’s briefing: if Threat Analysis is useful to you, follow the show wherever you listen so it lands automatically, and pass it on to someone who needs the heads-up. The person in your network who manages IT for a small business and has not yet heard about the MLflow KEV addition, that is who I am thinking of.