ngCERT flags CVE-2026-23866 (WhatsApp iOS/Android AI rich responses linked to Instagram Reels) and CVE-2026-23863 (Windows attachment filename NUL spoofing) — update past listed floors; Meta says no evidence of exploitation in the wild.
ngCERT (NCC CSIRT) advises on CVE-2026-23866 (incomplete validation of AI rich-response messages tied to Instagram Reels on WhatsApp iOS/Android in listed version ranges) and CVE-2026-23863 (Windows attachment filename NUL spoofing prior to a listed Meta build). Remediation floors per ngCERT: update later than the advisory’s iOS/Android/Windows floors; prefer WhatsApp/Meta’s 2026 advisories for exact fixed builds if versions diverge. Meta: no evidence of exploitation in the wild. Soft hold: do not invent in-the-wild Nigerian campaigns. Buyer checklist: MDM-forced client updates; treat rich media from unknown contacts as untrusted until patched.
Source: ngCERT — WhatsApp vulnerabilities leveraging Instagram Reels · Vendor: WhatsApp Security Advisories 2026 · Soft hold: Meta — no evidence of exploitation in the wild; no invented in-the-wild NG campaigns