SMSMC Blog
MSP Oversight & Vendor RiskOctober 2026 · 8 min read

The Edge-Appliance Ticket Your MSP Must Close This Month

NetScaler KEVs and MikroTik RouterOS advisories landed over the past four weeks. Here is the written MSP oversight ticket NYS owners should send — inventory, exposure, build, evidence — before the next invoice.

By Jim Venuto

If a managed service provider runs your firewall, VPN, or office router, last month’s vulnerability calendar is an oversight problem, not only a patching problem. Internet-facing edge appliances are where remote work, vendor access, and ransomware initial access still meet. When CISA puts a product on the Known Exploited Vulnerabilities (KEV) catalog — or publishes a critical ICS advisory against gear common in SMB closets — the owner’s job is to force a written answer: what do we run, is it exposed, what build are we on, and what evidence shows we checked for compromise before we “fixed” it?

I wrote this for owners overseeing an MSP — New York State SMBs, municipalities, and the MSPs that serve them. It complements a companion post on this blog — NetScaler Is on the KEV List Again: Do Not Patch Blind — Triage First; here the deliverable is the ticket and the quarterly evidence, not the forensic runbook.

Catalog state: claims below are as of the October 16, 2026 KEV catalog (version 2026.10.16). Re-check the live KEV feed before you close the ticket.

What landed on the public calendar (late September – early October 2026)

Citrix NetScaler (actively exploited). On September 27, 2026, CISA’s alert (last revised October 9) amplifies ten NetScaler CVEs, CVE-2026-88771 through 88779 plus CVE-2026-107406, and confirms exploitation of CVE-2026-88771 and CVE-2026-88772, both on the KEV catalog. On October 4, CVE-2026-88779 was added to the KEV catalog with a short federal due date and forensic-triage language under BOD 26-04. Citrix’s mitigation path is in CTX697096, CTX697174 and CTX697191; compromise checks before patching are in CTX694799.

MikroTik RouterOS (KEV entries + a separate critical advisory). CISA’s KEV catalog lists recent MikroTik RouterOS entries including CVE-2026-67279 (added September 25, 2026) and CVE-2026-86060 / CVE-2026-67277 (added September 10, 2026). Those KEV notes point at MikroTik’s September 2026 vulnerability page. MikroTik’s page (updated October 6) lists six CVEs, including CVE-2026-67279 (the SSH issue exploited in the wild). The fix for CVE-2026-67278 in 7.24.2 / 7.23.4 was incomplete, so the full fix is in 7.24.3 (stable) and 7.23.6 (long-term); 6.49.21 fixes the v6-applicable issues. Separately, on September 29, 2026, CISA published ICS advisory ICSA-26-272-06 for CVE-2026-84411: an unauthenticated integer underflow in the web management service on RouterOS before 7.24, CVSS 3.1 score 9.8, allowing remote code execution as root or denial of service. CISA states no known public exploitation of CVE-2026-84411 was reported at publication — treat it as urgent hardening, not as a confirmed breach indicator by itself. For owner acceptance, require RouterOS 7.24.3 or later (or 7.23.6 long-term) so you clear both the vendor’s September KEV-related fixes and the ICSA <7.24 bar; if you are still on v6 (even 6.49.21), plan migration to 7.24.3+ or document risk acceptance because ICSA-26-272-06 still treats RouterOS before 7.24 as affected for CVE-2026-84411.

You do not need every CVE memorized. You need a process that catches any internet-facing appliance when the public catalog moves.

Who in NYS this hits — and why the MSP invoice is not enough

  • Offices whose “firewall” is a MikroTik, Ubiquiti, or similar SMB router with SSH, Winbox, or WebFig/HTTP reachable from the WAN “temporarily” since a VPN project.
  • Hybrid clinics, agencies, and towns still terminating remote access on a customer-managed NetScaler Gateway.
  • NYDFS-covered entities and anyone in their vendor chain. DFS’s May 21, 2026 heightened cybersecurity threat environment letter tells regulated entities to remediate known exploited vulnerabilities on internet-exposed systems (1.1), act on threat intelligence (2.3), and engage critical Third-Party Service Providers so they are aware and ready (2.6). Your MSP is that TPSP for edge gear.
  • SLED IT directors who inherit MSP-managed edge without a current asset list. CISA’s Awareness Month message for SLTT operators assumes someone can still find and patch the box that faces the internet.

Paying for “24/7 monitoring” does not satisfy oversight if nobody can produce the build string for the gateway.

Legacy stacks: the usual failure

The usual failure when the invoice says “managed firewall” and nobody can produce the build string:

  1. Edge firmware tracks are years behind because “it needs an after-hours window.”
  2. Management planes (NetScaler NSIP, MikroTik SSH/WebFig/Winbox, cloud controllers) are still reachable from the whole internet.
  3. The MSP patches on Friday, reboots, and files a one-line ticket — after wiping the only logs that would show pre-patch exploitation (the failure mode CISA’s BOD 26-04 forensic-triage guidance exists to prevent for federal agencies — and that private-sector operators should treat as best practice when a KEV entry flags forensic triage).
  4. AI chat tools get used to “explain the advisory” by pasting full configs containing credentials and address spaces into a consumer model.

Best approach forward: fix (1)–(3) with contract language and ticket evidence; add (4) as a data-handling rule in the same thread.

AI GRC for the oversight conversation

Ask your MSP, in writing, whether engineers use unapproved AI tools on appliance configs or packet captures. For NY SHIELD and Part 500 programs, that is vendor risk: private or nonpublic information in a prompt is still your data leaving your control. Approved enterprise AI with retention controls can help draft the inventory spreadsheet; it cannot replace the signed build attestation.

The ticket to send your MSP this week (copy/paste)

Subject: Internet-facing edge inventory + KEV response — due [date + 5 business days]

Please reply in the ticket (not chat) with:

  1. Inventory table: every customer-managed firewall, router, ADC, VPN concentrator, or wireless controller you operate for us — make/model, management IP, WAN exposure (yes/no), current firmware/build, support end date.
  2. NetScaler: If any Citrix NetScaler ADC/Gateway exists, confirm IoC/compromise checks per Citrix CTX694799 before upgrades when possible; list pre- and post-change builds covering CTX697096, CTX697174 and CTX697191 (CVE-2026-88771/88772/88779 and CVE-2026-107406); SAML configurations must be on 14.1-73.46 / 13.1-64.29 or later. Attach evidence.
  3. MikroTik / SMB routers: Confirm RouterOS version. Require RouterOS 7.24.3 or later (or 7.23.6 long-term) (covers MikroTik’s September fixed releases for the KEV-related issues and ICSA-26-272-06’s <7.24 bar for CVE-2026-84411). For v6 devices (including 6.49.21), schedule migration to 7.24.3+ or document owner-accepted residual risk. Before upgrade: export the log and confirm there is no critical “Flagged” compromise status (per MikroTik’s September 2026 guidance for CVE-2026-86060-class issues); if Flagged, preserve evidence and escalate IR before “cleaning” with an upgrade. After upgrade: attach a config review for unknown scripts, users, or settings. Confirm WAN management (SSH, Winbox, WebFig/HTTP) is disabled or restricted to allow-listed admin IPs / VPN. Confirm status against KEV entries CVE-2026-67279 / CVE-2026-86060 / CVE-2026-67277.
  4. Exposure reduction: For each internet-reachable management interface, either remove exposure or document compensating controls and owner-accepted risk.
  5. Evidence pack: screenshots or CLI of version output, change window, backup taken, and who approved the change. One-line “patched” is not acceptance criteria.
  6. AI / data handling: Confirm appliance configs and captures are not pasted into consumer AI tools.

Cite NYDFS HCTE items 1.1 and 2.6 if you are regulated or sell into a regulated customer. Cite CISA KEV + ICSA links so the priority is not “the owner read a blog.”

Acceptance criteria for the owner

  • Inventory table complete within five business days.
  • No silent “we don’t have NetScaler” when a gateway still answers on 443 from the internet — verify with an external scan you authorize or CISA Cyber Hygiene Services if you are eligible.
  • MikroTik devices at RouterOS 7.24.3 or later (or 7.23.6 long-term) (or documented risk acceptance for exceptions); NetScaler builds match Citrix fixed versions; management plane (including SSH) not world-open.
  • Ticket contains evidence attachments (including MikroTik Flagged-log check / post-upgrade config review where applicable), not vibes.
  • Open residual risks listed with dates.

What “done” looks like before the next invoice

You can answer a board, examiner, or insurer in four sentences: what edge we run, that it is current for this month’s KEVs/advisories (catalog as of Oct 16, 2026), that compromise checks preceded risky upgrades where CISA/Citrix call for them or the KEV entry flags forensic triage, and that the MSP’s next quarterly oversight report — see The MSP Oversight Report Your Board Should Ask For — will include the edge inventory as a standing section.

If your MSP cannot produce the inventory, that is the finding — log it as a dated remediation item with an owner, and make the edge inventory a standing deliverable in the next renewal or SOW.

Sources

Tags#msp#smb#sled#checklist#msp-partner#nydfs-part-500