Reported by 80 outlets
Citrix NetScaler zero-days CVE-2026-88771-88778 patched after confirmed exploitation
Why this score
- Breadth
- 2.00 / 2.0 · 80 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.50 / 2.0 · updates in 48h
- Pickup speed
- 0.35 / 0.6 · time to second source
- Recency
- × 0.64 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 6.6 / 10 = base × recency + community
Desk analysis
Citrix NetScaler ADC and Gateway appliances spent late September under active exploitation with no patches available. On September 25, 2026, a reddit thread on r/Citrix carried shutdown advice attributed to the Dutch national cyber security center, and by September 26 researchers at watchTowr and Kevin Beaumont had confirmed reports of two unpatched zero-day RCE flaws being exploited in the wild. Tenable's Research Special Operations team set up an FAQ while details were still thin, and some organizations simply took NetScalers offline rather than run them exposed.
Patches and identifiers followed, including CVE-2026-88771, a critical pre-authentication command injection flaw that Picus and others have since documented. Citrix and CISA have urged immediate patching of NetScaler ADC and Gateway. The exploitation is not hypothetical: Binary Defense's incident response team investigated an intrusion involving two NetScaler devices where the zero-days were used to deploy a modified version of the open-source Platypus remote administration framework on compromised appliances.
This mirrors the 2023 CitrixBleed pattern, where slow patching of edge appliances turned into mass compromise. Any internet-facing NetScaler still unpatched should be treated as potentially backdoored, since a Platypus implant persists through later patching. Watch for additional post-exploitation reports from IR firms, CISA KEV movement on the CVEs, and whether the modified Platypus backdoor shows up in other victims.
Timeline
-
update from cisa.gov
CISA KEV Catalog: CVE-2025-7775 (Citrix NetScaler Memory Overflow)
cisa.gov · 414d ago · August 26th, 2025
CISA added CVE-2025-7775 to the Known Exploited Vulnerabilities catalog on 2025-08-26. The entry describes a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that could allow remote code execution or denial of service when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Required action is to apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Due date was 2025-08-28.
-
update from nist.gov
NVD: CVE-2025-7775 Memory Overflow in NetScaler ADC and Gateway
nist.gov · 413d ago · August 26th, 2025
NIST published CVE-2025-7775 on 2025-08-26 with CVSS 3.1 score 9.8 and CVSS 4.0 score 9.2. References include the Citrix advisory (CTX694938) and the CISA KEV entry.
-
update from citrix.com
Citrix Bulletin CTX696604: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817 and CVE-2026-13474
citrix.com · 105d ago · July 1st, 2026
The Citrix bulletin that patched CVE-2026-8452 bundled fixes for six NetScaler CVEs in total, delivered in builds 14.1-72.61 and 13.1-63.18 (FIPS/NDcPP line 13.1-37.272). At publication Citrix described CVE-2026-8452 as a memory overflow leading to unpredictable behavior or denial of service and stated it had not observed any unmitigated exploitation. The Citrix support portal blocks direct crawling; the earliest Wayback Machine capture of the article is 2026-07-01T01:06:17Z, and reporting cited in this story places the advisory in June 2026.
-
update from watchtowr.com
You're Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))
watchtowr.com · 61d ago · August 14th, 2026
Sina Kheirkhah at watchTowr Labs published a full pre-auth exploitation writeup on 14 Aug 2026, thirteen days before this story's first sighting. The research demonstrates unauthenticated remote code execution as root via a heap overflow in NetScaler's SAML ds:SignedInfo canonicalization, where an oversized InclusiveNamespaces PrefixList is copied into a fixed-size buffer in the nsppe packet engine, yielding a write-what-where primitive, RIP control by overwriting tx_pkt_complete_fptr, and a PHP webshell dropped at /var/vpn/theme/x.php on 13.1 before 13.1-63.18. The author notes Citrix did not confirm the CVE mapping but believes the bug is CVE-2026-8452 based on its memory-overflow description, and credits bulletin CTX696604 with the fix.
-
update from rapid7.com
CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway
rapid7.com · 55d ago · August 19th, 2026
Overview On August 19, 2026, a security advisory was published for CVE-2026-19490 , a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges. NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS offloading, and application security capabilities, while NetScaler Gateway provides secure remote access and VPN functionality. Because these systems are frequently deployed in enterprise DMZs and exposed to the public internet, authentication bypass vulnerabilities affecting Citrix products are nearly always exploited by threat actors. CVE-2026-19490 affects the following systems: NetScaler ADC and NetScaler Gateway 14.1: Versions prior to 14.1-73.32 NetScaler ADC and NetScaler Gateway 13.1: Versions prior to 13.1-63.21 NetScaler ADC FIPS: Versions prior to 14.1-73.32 FIPS NetScaler ADC FIPS and NDcPP: Versions prior to 13.1-37.277 As of August 19, 2026, Rapid7 has not observed evidence that CVE-2026-19490 is being exploited in the wild. However, organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quick
-
update from cyberpress.org
Critical Citrix NetScaler Authentication Bypass Flaw Exposes Gateway Appliances
cyberpress.org · 54d ago · August 20th, 2026
Cloud Software Group has issued an urgent security bulletin for two high-severity vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances, formerly known as Citrix ADC and Citrix Gateway. Tracked as CVE-2026-19489 and CVE-2026-19490, the flaws could enable denial-of-service attacks or authentication bypass on vulnerable internet-facing appliances. The issues pose a significant risk to organizations that depend on NetScaler Gateway for remote access, VPN connectivity, and application delivery. Critical Citrix NetScaler Authentication Bypass Flaw The most severe issue, CVE-2026-19490, has received a CVSS v4.0 score of 9.3 and is categorized as CWE-288, Authentication Bypass Using an Alternate Path. Successful exploitation could allow a threat actor to gain unauthorized access to internal services without possessing valid credentials. Since these appliances commonly sit at the edge of corporate networks and enforce authentication for remote users, compromise could provide attackers with a direct entry point into sensitive enterprise environments. Exploitability depends on the software version and configuration.
-
mentioned by gbhackers.com
Critical Citrix NetScaler Flaw Allows Attackers to Bypass Authentication
gbhackers.com · 54d ago · August 20th, 2026
-
update from bleepingcomputer.com
Citrix urges admins to patch new NetScaler flaws as soon as possible
bleepingcomputer.com · 54d ago · August 20th, 2026
Admins can check if an appliance is vulnerable to attacks targeting CVE-2026-19490 by inspecting their NetScaler configuration for SAML action configuration (add authentication samlAction .) string and Auth or VPN vserver ('add authentication vserver .' and 'add vpn vserver .*') strings. The second, a high-severity memory overflow security flaw tracked as CVE-2026-19489 , can be abused by remote unauthenticated threat actors in denial-of-service (DoS) attacks when SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled on a large-scale NAT group configuration. Citrix advised customers to upgrade vulnerable NetScaler ADC and NetScaler Gateway appliances to: NetScaler ADC and NetScaler Gateway 14.1-73.32 or later, NetScaler ADC and NetScaler G
-
update from socprime.com
CVE-2026-19490: Critical Citrix NetScaler Authentication Bypass Exposes Enterprise Gateways
socprime.com · 54d ago · August 20th, 2026
CVE-2026-19490 carries a CVSS vector indicating network-based exploitation, low attack complexity, no privileges, and no user interaction, with potentially high impact to confidentiality, integrity, and availability. These characteristics make internet-facing vulnerable appliances an attractive target once reliable exploitation methods become publicly available.
-
mentioned by securityweek.com
Recent Citrix NetScaler Vulnerability Exploited in the Wild
securityweek.com · 47d ago · August 27th, 2026
-
update from bleepingcomputer.com
CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday
bleepingcomputer.com · 47d ago · August 27th, 2026
Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to patch their Citrix NetScaler appliances against an actively exploited vulnerability by Saturday. "We have not observed any unmitigated exploitation of this vulnerability as well." At the moment, Internet threat watchdog Shadowserver tracks over 22,000 NetScaler ADC appliances and nearly 1,800 Gateway instances exposed online. However, there is no information on how many are honeypots, have vulnerable configurations, or have already been patched.
-
update from gbhackers.com
CISA Warns of Actively Exploited Citrix NetScaler ADC and Gateway Vulnerability
gbhackers.com · 47d ago · August 27th, 2026
Citrix […] The post CISA Warns of Actively Exploited Citrix NetScaler ADC and Gateway Vulnerability appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from malware.news
Critical Citrix NetScaler Memory-Overflow Vulnerability
malware.news · 47d ago · August 27th, 2026
Recommended Actions Truesec recommends upgrading to the patched NetScaler firmware versions. To determine whether the appliance meets the preconditions, inspect the NetScaler configuration and look for the following strings[3]: An Auth Server (AAA Vserver): add authentication vserver . A Gateway (VPN Vserver, ICA Proxy, CVPN, RDP Proxy) : add vpn vserver . References [1] https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscale
-
update from bleepingcomputer.com
Critical Citrix NetScaler auth bypass now leveraged in attacks
bleepingcomputer.com · 39d ago · September 4th, 2026
Attackers have begun targeting a critical-severity Citrix NetScaler flaw in the wild, according to vulnerability intelligence company Previdian. "We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin , assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible," Citrix warned in mid-August when it addressed the flaw and urged admins to patch it as soon as possible . While the company has yet to flag the vulnerability as actively exploited in its August 19 security advisory , Previdian founder and security researcher Ryan Dewhurst told BleepingComputer on Thursday that attackers have begun targeting CVE-2026-19490 in the wild after a "credible" proof-of-concept exploit was published online. "On 3 September, one of our NetScaler sensors received requests matching the PoC from three distinct source IPs, geolocated to Australia, the United States and Germany," Dewhurst told BleepingComputer. "Our current assessment is that this provides evidence of exploitation attempts, but it does not confirm successful compromise of real-world systems." T
-
update from cybertop.ai
ICYMI: CVE-2026-19490 is an active exploitation of Citrix NetScaler's authentication bypass flaw. Our AI agents have distilled defensive mea
cybertop.ai · 33d ago · September 10th, 2026
Our AI agents have distilled defensive mea
via Mastodon https://cybertop.ai/t/cve-2026-19490-citrix-netscaler-authentication-bypass-using-an-alternate-path-or-channel-vulnerability
-
update from dev.to
What 239,000 Exposed NetScaler Instances Tell You About Remote Access Risk Citrix NetScaler sits between the internet and enterprise applica
dev.to · 24d ago · September 19th, 2026
What 239,000 Exposed NetScaler Instances Tell You About Remote Access Risk Citrix NetScaler sits between the internet and enterprise applica
via Mastodon https://dev.to/jeffreyciend/what-239000-exposed-netscaler-instances-tell-you-about-remote-access-risk-57j6
-
mentioned by cybertop.ai
CYBERTOP's AI agents identified CVE-2025-7775: Citrix NetScaler suffers a Memory Overflow Vulnerability, actively exploited. Disable unused
cybertop.ai · 19d ago · September 24th, 2026
-
update from reddit.com
Netscaler leak? (r/Citrix thread, first public surfacing)
reddit.com · 17d ago · September 26th, 2026
A sysadmin reported that their IT supplier's security team phoned to advise shutting NetScaler appliances down immediately, with nothing yet on the Citrix website or in tech news, and other sysadmins in the thread reporting the same. Tenable's September 27 FAQ states this thread carried details from an NCSC-NL pre-notification distributed TLP:AMBER+STRICT that had not been made public. The thread predates watchTowr's public confirmation by roughly ten hours and the story's first aggregated coverage by twelve.
-
update from x.com
watchTowr on X: rapidly reacting to rumors of multiple unpatched Citrix NetScaler RCE vulnerabilities
x.com · 17d ago · September 26th, 2026
The timestamp is derived from the post's snowflake ID. A follow-up watchTowr post at 22:19 UTC the same evening shared further information on both flaws and directed questions to Citrix.
-
update from www.cyberkendra.com
NetScaler alert: watchTowr says reports of unpatched remote code execution flaws in Citrix NetScaler are verified, and organisations are shu
www.cyberkendra.com · 17d ago · September 26th, 2026
NetScaler alert: watchTowr says reports of unpatched remote code execution flaws in Citrix NetScaler are verified, and organisations are shu
via Mastodon https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html
-
update from ifin.network
We are tracking the story about undisclosed 0-days in Citrix Netscaler devices. We have confirmation from multiple source now about the vera
ifin.network · 17d ago · September 26th, 2026
We have confirmation from multiple source now about the vera
via Mastodon https://ifin.network/t/citrix-advises-shutdown-due-to-new-undisclosed-netscaler-0-days/867
-
update from cisa.gov
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (CISA Alert)
cisa.gov · 17d ago · September 27th, 2026
The alert confirms active global exploitation of CVE-2026-88771 and CVE-2026-88772, both added to the KEV catalog, and urges compromise checks before patching.
-
update from www.cyberkendra.com
Now it's confirmed as, watchTowr says two unpatched NetScaler RCE zero-days were found exploited during forensics. Citrix's advisory and pat
www.cyberkendra.com · 17d ago · September 27th, 2026
Now it's confirmed as, watchTowr says two unpatched NetScaler RCE zero-days were found exploited during forensics.
-
update from thecybersecguru.com
🚨 Citrix NetScaler emergency shutdowns Organizations are reportedly being advised to take Citrix NetScaler appliances offline amid warnings
thecybersecguru.com · 16d ago · September 27th, 2026
🚨 Citrix NetScaler emergency shutdowns Organizations are reportedly being advised to take Citrix NetScaler appliances offline amid warnings
via Mastodon https://thecybersecguru.com/news/citrix-netscaler-zero-day-shutdown/
-
mentioned by lemmy.world
Citrix NetScaler admins are being told to shut down appliances amid reports of two new zero-days https:// lemmy.world/post/52417615
lemmy.world · 16d ago · September 27th, 2026
-
mentioned by zubiqo.com
Enterprise IT teams are pulling Citrix NetScaler hardware offline after reports surfaced of two unpatched zero-day vulnerabilities. Research
zubiqo.com · 16d ago · September 27th, 2026
-
mentioned by thehackernews.com
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation Source: The Hacker News Read: https:// thehackernews.com/202
thehackernews.com · 16d ago · September 27th, 2026
-
update from tenable.com
Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities
tenable.com · 16d ago · September 27th, 2026
The reports originate from a pre-notification sent out ahead of public disclosure, so there are currently no specific details about these flaws and no patches available. This post will be updated as new information becomes available. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding two reported zero-day vulnerabilities in Citrix NetScaler that sources say were actively exploited in the wild. On September 25, 2026, reports surfaced through a reddit post on r/Citrix regarding advice to shut down “Netscalers.” This included a report from a user that said this information came from the “Dutch national cyber security center” and further details included a note about two zero-day vulnerabilities. On September 26, 2026, additional reports confirming the existence of these flaws became public, including social posts from researchers at watchTowr on X , as well as Kevin Beaumo
-
mentioned by beyondmachines.net
Citrix NetScaler Appliance Users Get Shutdown Orders Over Unpatched Zero-Day Exploits Citrix NetScaler ADC and Gateway appliances are facing
beyondmachines.net · 16d ago · September 27th, 2026
-
mentioned by www.tenable.com
(tenable.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler Under Active Exploitation: FAQ and Analysis In brief - This article prov
www.tenable.com · 16d ago · September 27th, 2026
-
update from rulezet.org
SH3LLC0D3 - Exploit Attempt Citrix NetScaler Pre-Auth RCE Zero-Day (watchTowr Advisory) NetScaler ADC and NetScaler Gateway Security Bulleti
rulezet.org · 16d ago · September 27th, 2026
SH3LLC0D3 - Exploit Attempt Citrix NetScaler Pre-Auth RCE Zero-Day (watchTowr Advisory) NetScaler ADC and NetScaler Gateway Security Bulleti
via Mastodon https://rulezet.org/rule/detail_rule/770971
-
mentioned by thehackernews.com
Third NetScaler emergency since June. watchTowr says two unpatched remote code execution flaws in NetScaler ADC and Gateway are being exploi
thehackernews.com · 16d ago · September 27th, 2026
-
mentioned by securityonline.info
Two Citrix NetScaler zero-day flaws enabling remote code execution are reportedly under active exploitation. No CVE or patch yet. See mitiga
securityonline.info · 16d ago · September 27th, 2026
-
mentioned by support.citrix.com
Citrix has finally spoken. Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-
support.citrix.com · 16d ago · September 27th, 2026
-
mentioned by support.citrix.com
Citrix NetScaler zero-days Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed. This is a
support.citrix.com · 16d ago · September 27th, 2026
-
update from support.citrix.com
Citrix NetScaler ADC and Gateway security bulletin CTX697096 for CVE-2026-88771 through CVE-2026-88778
support.citrix.com · 16d ago · September 27th, 2026
Citrix has published security bulletin CTX697096 for Citrix NetScaler ADC and Citrix NetScaler Gateway, covering CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.
-
update from bleepingcomputer.com
Citrix admins warned to shut down NetScalers over 2 exploited zero-days
bleepingcomputer.com · 16d ago · September 27th, 2026
The first signs of the incident appeared when Citrix administrators began reporting on Reddit that IT suppliers and security teams were privately contacting their organizations and advising them to shut down their NetScaler appliances. "We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately," one administrator wrote .
-
mentioned by www.bleepingcomputer.com
Citrix admins warned to shut down NetScalers over 2 exploited zero-days https:// bleepingcomputer.com/news/security/ citrix-admins-warned-to
www.bleepingcomputer.com · 16d ago · September 27th, 2026
-
mentioned by ifin.network
We have updated our coverage of the new # Citrix # Netscaler vulnerabilities with the vendor's advisory. https:// ifin.network/t/multiple-ci
ifin.network · 16d ago · September 27th, 2026
-
mentioned by securityonline.info
Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patche
securityonline.info · 16d ago · September 27th, 2026
-
mentioned by www.cve.org
CVE-2026-88776, CVE-2026-88777 and CVE-2026-88778 affect Citrix NetScaler ADC and Gateway. Two are memory overflow flaws that can cause deni
www.cve.org · 16d ago · September 27th, 2026
-
update from decipher.sc
Researchers Warn of Citrix NetScaler Zero Day Exploitation
decipher.sc · 16d ago · September 27th, 2026
submitted by /u/YogiBerra88888 [link] [comments]
via reddit r/cybersecurity: Researchers Warn of Citrix NetScaler Zero Day Exploitation
-
mentioned by www.cyberkendra.com
🚨 CVE-2026-88771 & CVE-2026-88772: Citrix has patched two exploited NetScaler zero-days (CVSS 9.5). Update to 14.1-73.37 / 13.1-64.23 and ch
www.cyberkendra.com · 16d ago · September 27th, 2026
-
mentioned by www.bleepingcomputer.com
"Citrix admins warned to shut down NetScalers over 2 exploited zero-days" "" https://www. bleepingcomputer.com/news/secu rity/citrix-admins-
www.bleepingcomputer.com · 16d ago · September 27th, 2026
-
mentioned by thehackernews.com
🤖 Citrix NetScaler ADC/Gateway: two RCE zero-days exploited in the wild before any fix, CVSS v4 9.5 each. CVE-2026-88771 hit every deploymen
thehackernews.com · 16d ago · September 27th, 2026
-
mentioned by www.cert.se
(cert.se) Critical Vulnerabilities in Citrix NetScaler ADC and Gateway Enable Unauthenticated Remote Code Execution In brief - This article
www.cert.se · 16d ago · September 27th, 2026
-
mentioned by cert.europa.eu
Critical Vulnerabilities in Citrix NetScaler ADC and Gateway (CERT-EU Security Advisory 2026-014)
cert.europa.eu · 16d ago · September 27th, 2026
-
mentioned by undercodenews.com
https:// undercodenews.com/citrix-netsc aler-zero-day-crisis-official-patches-released-for-two-exploited-critical-rce-vulnerabilities-video/
undercodenews.com · 16d ago · September 27th, 2026
-
mentioned by support.citrix.com
Citrix zeroday is already actively being exploited. Patch was finally released! https:// support.citrix.com/support-hom e/kbsearch/article?a
support.citrix.com · 16d ago · September 27th, 2026
-
update from www.cert.europa.eu
Here we go again: CERT-EU security advisory 2026-014 (Citrix NetScaler)
www.cert.europa.eu · 16d ago · September 27th, 2026
Here we go again .... https://www.cert.europa.eu/publications/security-advisories/2026-014/ #citrix #cybersecurity
via Mastodon https://www.cert.europa.eu/publications/security-advisories/2026-014/
-
update from malware.news
AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway – CVE-2026-88771 and CVE-2026-88772
malware.news · 16d ago · September 27th, 2026
Number: AL26-024 Date: September 27, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Tracked as CVE-2026-88771 Footnote 3 , this vulnerability is an Improper Input Validation vulnerability (CWE-20) Footnote 4 .
-
mentioned by watchtowr.com
Citrix NetScaler Zero-Day RCE FAQ: CVE-2026-88771 and CVE-2026-88772 (watchTowr)
watchtowr.com · 16d ago · September 27th, 2026
-
update from desnips.nl
Hospitals close portals preventively after critical Citrix flaw, care continues
desnips.nl · 16d ago · September 27th, 2026
Hospitals close portals preventively after critical Citrix flaw, care continues
An extremely critical zero-day vulnerability in Citrix software prompted hospitals in the Brabant and Friesland regions to take their patient portals offline as a precaution to prevent theft of medical records. Patient care continued. The hospitals stressed the shutdowns were a precautionary measure, not the result of a hack. Original article (Dutch): https://desnips.nl/472d953-Citrix-storing-pati-ntendossier/
via Mastodon https://desnips.nl/472d953-Citrix-storing-pati-ntendossier/
-
mentioned by secdb.nttzen.cloud
🚨 [CISA-2026:0927] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 16d ago · September 27th, 2026
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-88772 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 16d ago · September 28th, 2026
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-88772 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 16d ago · September 28th, 2026
-
mentioned by www.cisa.gov
CISA working on a Sunday: Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-887712 were added to the Known Exploited Vulnerabilities (K
www.cisa.gov · 16d ago · September 28th, 2026
-
update from www.itnews.com.au
Citrix confirms exploitation of Netscaler Newly Discovered bugs Source: IT News Security (AU) Read: https://www. itnews.com.au/news/citrix-c
www.itnews.com.au · 16d ago · September 28th, 2026
Citrix confirms exploitation of Netscaler Newly Discovered bugs Source: IT News Security (AU) Read: https://www.
-
update from cyberpress.org
Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
cyberpress.org · 15d ago · September 28th, 2026
The vulnerabilities are part of a wider security bulletin, CTX697096, addressing eight NetScaler issues ranging from remote code execution and denial of service to HTTP request smuggling, policy bypass, and TCP initial sequence number prediction. Citrix said every NetScaler ADC and NetScaler Gateway deployment is affected, including appliances running the default configuration, with no optional feature or service required for exposure. DTLS is enabled by default on VPN virtual servers, making externally accessible NetScaler VPN infrastructure a priority for immedi
-
mentioned by gbhackers.com
Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
gbhackers.com · 15d ago · September 28th, 2026
-
update from bleepingcomputer.com
CISA orders feds to patch exploited Citrix flaws by Wednesday
bleepingcomputer.com · 15d ago · September 28th, 2026
Citrix strongly urges affected customers to install the relevant updated versions as soon as possible," the company warned in a Sunday blog post that has a 'noindex' meta tag which t
-
mentioned by www.bleepingcomputer.com
CISA orders feds to patch exploited Citrix flaws by Wednesday https:// bleepingcomputer.com/news/security/ cisa-orders-feds-to-patch-exploit
www.bleepingcomputer.com · 15d ago · September 28th, 2026
-
mentioned by theperimetersite.com
If you're looking at a Citrix NetScaler ADC or Gateway this morning, you probably saw the warning; two zero-days are being used in the wild
theperimetersite.com · 15d ago · September 28th, 2026
-
mentioned by sh3llc0d3.com
Critical: Citrix NetScaler: two critical vulnerabilities actively exploited. The risk is all the more important as these vulnerabilities have been
sh3llc0d3.com · 15d ago · September 28th, 2026
-
mentioned by github.com
Crash POC for one of the Citrix Netscaler RCE vulnerabilities https:// github.com/murrez/CVE-202 6-88772 …
github.com · 15d ago · September 28th, 2026
-
mentioned by www.linformatique.org
Citrix patches two NetScaler flaws already exploited: CVE-2026-88771 and CVE-2026-88772
www.linformatique.org · 15d ago · September 28th, 2026
-
mentioned by www.bleepingcomputer.com
"CISA orders feds to patch exploited Citrix flaws by Wednesday" "[...] government agencies over the weekend to secure their systems against
www.bleepingcomputer.com · 15d ago · September 28th, 2026
-
mentioned by securityweek.com
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
securityweek.com · 15d ago · September 28th, 2026
-
mentioned by threatnoir.com
⚠️ CRITICAL: Citrix confirms two NetScaler RCE zero-days exploited in attacks Citrix NetScaler ADC and Gateway appliances are under active a
threatnoir.com · 15d ago · September 28th, 2026
-
mentioned by threatnoir.com
⚠️ CRITICAL: Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation Two unpatched zero-day RCE vulnerabilities in C
threatnoir.com · 15d ago · September 28th, 2026
-
update from www.theregister.com
Certainties in life: Death, taxes, and critical Citrix vulns under attack Source: The Register - Security Read: https://www. theregister.com
www.theregister.com · 15d ago · September 28th, 2026
Certainties in life: Death, taxes, and critical Citrix vulns under attack Source: The Register - Security Read: https://www.
-
update from sh3llc0d3.com
Some IOCs / Patterns - Citrix Netscaler 0days https:// sh3llc0d3.com/blog/inside-th e-netscaler-zero-day-siege-chained-pre-auth-rces-weaponi
sh3llc0d3.com · 15d ago · September 28th, 2026
Some IOCs / Patterns - Citrix Netscaler 0days https:// sh3llc0d3.com/blog/inside-th e-netscaler-zero-day-siege-chained-pre-auth-rces-weaponi
via X https://sh3llc0d3.com/blog/inside-the-netscaler-zero-day-siege-chained-pre-auth-rces-weaponized-in-the-wild-watchtowr-disclosure/
-
mentioned by malware.news
Multiple Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
malware.news · 15d ago · September 28th, 2026
-
update from rapid7.com
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
rapid7.com · 15d ago · September 28th, 2026
This is especially concerning due to the prevalence of NetScaler appliances. Multiple CERTs worldwide have begun issuing alerts due to the critical nature of this situation. The following table summarizes all eight vulnerabil
-
mentioned by www.truesec.com
(truesec.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Exploited in the Wild: CVE-2026-88771 and CVE-2026-88772
www.truesec.com · 15d ago · September 28th, 2026
-
mentioned by www.rapid7.com
(rapid7.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Under Active Exploitation In brief - This article details
www.rapid7.com · 15d ago · September 28th, 2026
-
update from labs.watchtowr.com
Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs
labs.watchtowr.com · 15d ago · September 28th, 2026
submitted by /u/dx7r__ [link] [comments]
via reddit r/cybersecurity: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs
-
mentioned by labs.watchtowr.com
(labs.watchtowr.com) Critical Zero-Day Command Injection Vulnerability in Citrix NetScaler ADC and Gateway (CVE-2026-88771) In brief - This
labs.watchtowr.com · 15d ago · September 28th, 2026
-
mentioned by github.com
https:// github.com/watchtowrlabs/ watchTowr-vs-Citrix-Netscaler-CVE-2026-88771 … . .
github.com · 15d ago · September 28th, 2026
-
mentioned by www.cisa.gov
CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabi
www.cisa.gov · 15d ago · September 28th, 2026
-
mentioned by www.cisa.gov
CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabi
www.cisa.gov · 15d ago · September 28th, 2026
-
update from malware.news
Citrix security advisory (AV26-965)
malware.news · 15d ago · September 28th, 2026
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
update from www.truesec.com
Truesec has observed these potential C2 IPs: 104.248.244[.]66 139.180.152[.]138 77.83.199[.]39 https://www. truesec.com/hub/blog/multiple- c
www.truesec.com · 15d ago · September 28th, 2026
Truesec has observed these potential C2 IPs: 104.248.244[.]66 139.180.152[.]138 77.83.199[.]39 https://www.
-
mentioned by www.sophos.com
(sophos.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Under Active Exploitation In brief - This article details
www.sophos.com · 15d ago · September 28th, 2026
-
mentioned by www.yazoul.net
🔴 New security advisory: CVE-2026-88771 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R
www.yazoul.net · 15d ago · September 28th, 2026
-
update from unit42.paloaltonetworks.com
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
unit42.paloaltonetworks.com · 15d ago · September 28th, 2026
Unit 42 is aware of possible 0-day activity against NetScaler devices.
-
update from socprime.com
CVE-2026-88771 and CVE-2026-88772: Critical Citrix NetScaler Zero-Days Exploited in the Wild
socprime.com · 15d ago · September 28th, 2026
Successful compromise can therefore give attackers a strategically valuable foothold between external users and internal infrastructure.
-
mentioned by kudelskisecurity.com
(kudelskisecurity.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Enable Unauthenticated Remote Code Execution In
kudelskisecurity.com · 15d ago · September 28th, 2026
-
mentioned by unit42.paloaltonetworks.com
We are aware of possible zero-day activity against NetScaler devices. Citrix reports that CVE-2026-88771 and CVE-2026-88772 have been exploi
unit42.paloaltonetworks.com · 15d ago · September 28th, 2026
-
mentioned by unit42.paloaltonetworks.com
(unit42.paloaltonetworks.com) Critical Zero-Day Vulnerabilities Exploited in NetScaler ADC and Gateway Systems: CVE-2026-88771 and CVE-2026-
unit42.paloaltonetworks.com · 15d ago · September 28th, 2026
-
mentioned by www.greynoise.io
(greynoise.io) Zero-Day Exploitation Attempt Against Citrix NetScaler Gateway: Adversary Tradecraft and Post-Exploitation Analysis In brief
www.greynoise.io · 15d ago · September 28th, 2026
-
mentioned by www.greynoise.io
On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78\.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway
www.greynoise.io · 15d ago · September 28th, 2026
-
update from www.greynoise.io
GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed. https://ww
www.greynoise.io · 15d ago · September 28th, 2026
GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.
-
update from www.cert.europa.eu
Another day, another critical vulnerability in an edge device. We’ve analysed the CVE-2026-88771, one of the many vulnerabilities disclosed
www.cert.europa.eu · 15d ago · September 28th, 2026
Another day, another critical vulnerability in an edge device. We’ve analysed the CVE-2026-88771, one of the many vulnerabilities disclosed
via Mastodon https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771
-
mentioned by malware.news
CVE-2026-88771 and CVE-2026-88772: Two Critical Citrix NetScaler Flaws Under Active Exploitation
malware.news · 15d ago · September 28th, 2026
-
mentioned by www.bitsight.com
(bitsight.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Under Active Exploitation In brief - This article discu
www.bitsight.com · 15d ago · September 28th, 2026
-
mentioned by censys.com
🚨RAPID RESPONSE: Two critical Citrix NetScaler vulnerabilities are being actively exploited as zero-days. CVE-2026-88771 and CVE-2026-88772
censys.com · 15d ago · September 28th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE Citrix confirms two NetScaler RCE zero-days exploited in attacks Vulnerability | CRITICAL CVEs: CVE-2026-88771, CVE-20
www.yazoul.net · 15d ago · September 28th, 2026
-
mentioned by horizon3.ai
(horizon3.ai) Critical Authentication Bypass Vulnerability in Citrix NetScaler ADC and Gateway (CVE-2026-19490): Exploitation Risks and Reme
horizon3.ai · 15d ago · September 28th, 2026
-
mentioned by cyber.netsecops.io
📰 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-20
cyber.netsecops.io · 15d ago · September 28th, 2026
-
update from cyberscoop.com
Citrix patches actively exploited NetScaler zero-days after a weekend of unofficial warnings
cyberscoop.com · 15d ago · September 29th, 2026
Citrix took most of the weekend to confirm that attackers were actively exploiting the newest round of NetScaler zero-days, leaving network defenders and threat hunters to react without official confirmation. Yet, behind the scenes, multiple CERTs, advisory firms, insurance providers, researchers and chatty security professionals warned their respective peers and communities of a live and serious threat. By then, criticism was at a fever pitch, and for some NetScaler customers the warning came too late. “The information vacuum was most striking. Customers were receiving warnings through unofficial channels while Citrix remained publicly silent,” Ben Harris, founder and CEO at watchTowr, told CyberScoop. “Customers were left without communication, guidance, or even acknowledgement that the vulnerability that was rumored to exist was real.
-
mentioned by diesec.com
Citrix NetScaler: 2 unauthenticated RCE zero-days (CVSS 9.5), exploited before a patch existed. Default config affected. CISA KEV deadline W
diesec.com · 14d ago · September 29th, 2026
-
mentioned by www.nextron-systems.com
(nextron-systems.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway: Analysis of CVE-2026-88771 and CVE-2026-88772 E
www.nextron-systems.com · 14d ago · September 29th, 2026
-
mentioned by cybersecurefox.com
Critical Citrix NetScaler vulnerabilities exploited in attacks 🔗 https:// cybersecurefox.com/en/cisa-cri tical-vulnerabilities-citrix-netsca
cybersecurefox.com · 14d ago · September 29th, 2026
-
mentioned by kudelskisecurity.com
(kudelskisecurity.com) Critical Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Enable Unauthenticated Remote Code Execution In
kudelskisecurity.com · 14d ago · September 29th, 2026
-
mentioned by support.citrix.com
Citrix says attackers are exploiting two critical NetScaler flaws. CVE-2026-88771 allows unauthenticated command execution and affects defau
support.citrix.com · 14d ago · September 29th, 2026
-
mentioned by labs.watchtowr.com
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs
labs.watchtowr.com · 14d ago · September 29th, 2026
-
mentioned by cyber.netsecops.io
📰 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-20
cyber.netsecops.io · 14d ago · September 29th, 2026
-
mentioned by cloud.google.com
(cloud.google.com) Active Exploitation of Zero-Day Vulnerabilities in Citrix NetScaler ADC and Gateway Appliances: Analysis and Defense Stra
cloud.google.com · 14d ago · September 29th, 2026
-
mentioned by labs.watchtowr.com
New. WatchTower: Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https:// labs.watchtowr.com/here-we-go- aga
labs.watchtowr.com · 14d ago · September 29th, 2026
-
update from www.hipaajournal.com
DATE: September 29, 2026 at 10:30AM SOURCE: HIPAA JOURNAL Direct article link at end of text block below. Citrix has released patches to fix
www.hipaajournal.com · 14d ago · September 29th, 2026
DATE: September 29, 2026 at 10:30AM SOURCE: HIPAA JOURNAL Direct article link at end of text block below.
-
mentioned by ifin.network
We've been continuously updating this post with the latest information—now including details on exploitation of CVE-2026-88772. And all rele
ifin.network · 14d ago · September 29th, 2026
-
mentioned by www.bleepingcomputer.com
# Citrix confirms two # NetScaler RCE zero-days exploited in attacks https://www. bleepingcomputer.com/news/secu rity/citrix-admins-warned-t
www.bleepingcomputer.com · 14d ago · September 29th, 2026
-
mentioned by support.citrix.com
🤖 Citrix NetScaler dual zero-days: CVE-2026-88771 (RCE, CVSS 9.5, improper input validation) and CVE-2026-88772 (memory overflow, CVSS 9.5,
support.citrix.com · 14d ago · September 29th, 2026
-
mentioned by mastodon.thenewoil.org
https:// mastodon.thenewoil.org/@thenew oil/117355040311611706 thenewoil@mastodon.thenewoil.org - # Citrix confirms two # NetScaler RCE zero
mastodon.thenewoil.org · 14d ago · September 29th, 2026
-
update from bleepingcomputer.com
Hackers exploit Citrix NetScaler zero-day to deploy web shells
bleepingcomputer.com · 14d ago · September 29th, 2026
Mandiant says the attacks began in at least early September and are believed to have impacted organizations in North America and Europe across the government, financial services, education, legal, and professional services sectors.
-
mentioned by cloud.google.com
Mandiant and Google Threat Intelligence Group describe in-the-wild exploitation CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler A
cloud.google.com · 14d ago · September 29th, 2026
-
mentioned by deafnews.it
Citrix patches two actively exploited NetScaler zero-days (CVSS 9.5) after disclosure delay. CISA adds both to KEV catalog with Sept 30 fede
deafnews.it · 14d ago · September 29th, 2026
-
update from cyberscoop.com
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
cyberscoop.com · 14d ago · September 29th, 2026
The besieged security vendor and researchers didn’t confirm the attacks until late last week. “We are aware of dozens of impacted organizations,” Charles Carmakal, chief technology officer at Mandiant Consulting, wrote in a LinkedIn post . He attributed the attacks to “advanced and suspected state-sponsored threat actors.” The three-week gap — at minimum — between initial exploitation and confirmed in-the-wild attacks gave attackers a significant advantage. “We are still responding to active intrusions, and new evidence may change our understanding of the campaign timeline,” researchers who published a threat intelligence report on the attacks Tuesday told CyberScoop in an email. The incident response firm’s analysis on the latest zero-day attack spree targeting Citrix customers underscores the multi-layered mess network defenders have been responding to since Saturday. The zero-day exploits in Mandiant’s report only cover half of the problem.
-
mentioned by cyberscoop.com
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
cyberscoop.com · 14d ago · September 29th, 2026
-
mentioned by www.bleepingcomputer.com
"Hackers exploit Citrix NetScaler zero-day to deploy web shells" "[...] Cybersecurity firms say attackers exploited the Citrix NetScaler CVE
www.bleepingcomputer.com · 14d ago · September 29th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-88772: Citrix NetScaler zero-day exploited in the wild. Attackers deployed custom web shells and tunneling malware, gained root,
www.bleepingcomputer.com · 14d ago · September 30th, 2026
-
mentioned by securityaffairs.com
WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign
securityaffairs.com · 13d ago · September 30th, 2026
-
mentioned by threatnoir.com
⚠️ CRITICAL: Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers Two critical zero-day vulnerabilities in Citrix NetScaler are activ
threatnoir.com · 13d ago · September 30th, 2026
-
update from cyberpress.org
Hackers Exploit Citrix NetScaler Zero-Days to Gain Root Access and Deploy Web Shells
cyberpress.org · 13d ago · September 30th, 2026
GTIG’s telemetry indicates attackers send malformed or fragmented DTLS record headers during a pre-authentication handshake, causing heap-memory corruption in the NetScaler Packet Processing Engine, or NSPPE. Successful exploitation can divert execution to attacker-controlled shellcode running with root privileges on the appliance’s FreeBSD operating system. The intrusion set then modifies the appliance’s Apache configuration to execute files with misleading extensions. Mandiant observed actors registering .deb and .sig files as PHP handlers and using URL aliases that map seemingly benign icon reques
-
mentioned by suriq.io
🔴 EXPLOITED Two Citrix NetScaler zero-days were exploited before a patch existed, and CISA added both to its must-patch list. Upgrading clos
suriq.io · 13d ago · September 30th, 2026
-
mentioned by thecybersecguru.com
🚨 Critical Citrix NetScaler RCE alert. CVE-2026-88772 (CVSS 9.5) reportedly enables pre-auth remote code execution via a DTLS buffer overflo
thecybersecguru.com · 13d ago · September 30th, 2026
-
update from gbhackers.com
Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells
gbhackers.com · 13d ago · September 30th, 2026
After the initial compromise, they deploy custom PHP web shells and tools to tunnel within the internal network.
-
mentioned by thehackernews.com
🔒 Security News Digest - 2026-09-30 📊 6 updates from 4 sources: 🔹 The Hacker News: Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-
thehackernews.com · 13d ago · September 30th, 2026
-
mentioned by thehackernews.com
🤖 CVE-2026-88772 (CVSS 9.5): DTLS memory overflow in Citrix NetScaler ADC/Gateway lets unauthenticated attackers reach shellcode execution.
thehackernews.com · 13d ago · September 30th, 2026
-
update from securityweek.com
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
securityweek.com · 13d ago · September 30th, 2026
Mandiant found previously unseen malware in the attacks, including a PHP web shell named WHIPSHOT and a Python-based tunneling tool named SLAPSHOT. The two work together to g
-
mentioned by cyber.netsecops.io
📰 Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit 🚨 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772)
cyber.netsecops.io · 13d ago · September 30th, 2026
-
mentioned by www.reput.io
Two Citrix NetScaler zero-days (CVE-2026-88772/88771) gave attackers pre-auth root on the box that fronts your whole network. GTIG traced ex
www.reput.io · 13d ago · September 30th, 2026
-
update from cert.europa.eu
CERT-EU shares their insights on CVE-2026-88771 exploitation and provides threat hunting tips in different logs. https:// cert.europa.eu/blo
cert.europa.eu · 13d ago · September 30th, 2026
CERT-EU shares their insights on CVE-2026-88771 exploitation and provides threat hunting tips in different logs.
-
mentioned by malware.news
Actively Exploited NetScaler Vulnerabilities
malware.news · 13d ago · September 30th, 2026
-
update from theperimetersite.com
Government and finance offices are getting hit hard right now by two Citrix NetScaler vulnerabilities. They're CVE-2026-88772 and CVE-2026-8
theperimetersite.com · 13d ago · September 30th, 2026
Government and finance offices are getting hit hard right now by two Citrix NetScaler vulnerabilities.
-
mentioned by unit42.paloaltonetworks.com
A major update to our Threat Brief on NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 includes pre-disclosure activity and threa
unit42.paloaltonetworks.com · 13d ago · September 30th, 2026
-
mentioned by unit42.paloaltonetworks.com
Unit 42 provides attacker TTPs and malware analysis of Citrix NetScaler zero-day exploitation. IOC are listed. https:// unit42.paloaltonetwo
unit42.paloaltonetworks.com · 13d ago · September 30th, 2026
-
update from www.darkreading.com
🔒 Security News Digest - 2026-09-30 📊 9 updates from 4 sources: 🔹 darkreading: As AI Reshapes the SOC Career Ladder, Satisfaction Rises for
www.darkreading.com · 13d ago · September 30th, 2026
🔒 Security News Digest - 2026-09-30 📊 9 updates from 4 sources: 🔹 darkreading: As AI Reshapes the SOC Career Ladder, Satisfaction Rises for
via Mastodon https://www.darkreading.com/cybersecurity-careers/ai-reshapes-soc-career-ladder
-
mentioned by cyberworldops.eu
Mandiant and GTIG confirm active exploitation of NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 on ADC and Gateway appliances. Edge c
cyberworldops.eu · 13d ago · October 1st, 2026
-
mentioned by cyberworldops.eu
LevelBlue THOR observed active exploitation of CVE-2026-88771 in Citrix NetScaler ADC and Gateway for unauthenticated command execution. Pay
cyberworldops.eu · 12d ago · October 1st, 2026
-
mentioned by cyber.netsecops.io
📰 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-20
cyber.netsecops.io · 12d ago · October 1st, 2026
-
mentioned by ifin.network
Sigh The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed. https:// i
ifin.network · 11d ago · October 2nd, 2026
-
mentioned by gbhackers.com
Citrix NetScaler Appliances Reboot Repeatedly After 0-Day Security Update
gbhackers.com · 10d ago · October 3rd, 2026
-
update from www.cybersecuritydive.com
NetScaler is everywhere, which is precisely why this hurts everywhere. Patch your Citrix NetScaler instances for critical vulnerabilities im
www.cybersecuritydive.com · 10d ago · October 3rd, 2026
NetScaler is everywhere, which is precisely why this hurts everywhere.
-
mentioned by www.sygnia.co
Looking for additional Citrix NetScaler IOC? Sygnia has novel and credible indicators from CVE-2026-88771 exploitation (published 9/30): htt
www.sygnia.co · 10d ago · October 3rd, 2026
-
mentioned by cyber.netsecops.io
📰 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-20
cyber.netsecops.io · 10d ago · October 3rd, 2026
-
update from suriq.io
Citrix NetScaler has a new unauthenticated flaw (CVE-2026-88779) that lets a stranger crash the appliance. It hits boxes set up for SAML sin
suriq.io · 10d ago · October 4th, 2026
It hits boxes set up for SAML sin
via Mastodon https://suriq.io/blog/netscaler-cve-2026-88779-saml-dos
-
mentioned by euvd.enisa.europa.eu
🚨 EUVD-2026-92065 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: ADC, ADC, ADC (+3 more) 🏢 Vendor: NetScaler 📅 Updated: 2026-10-04 📝 Vulnerability i
euvd.enisa.europa.eu · 10d ago · October 4th, 2026
-
mentioned by radar.offseq.com
CVE-2026-88779 (HIGH, CVSS 8.7) impacts NetScaler ADC & Gateway https:// radar.offseq.com/threat/cve-20 26-88779-vulnerability-in-netscaler-
radar.offseq.com · 9d ago · October 4th, 2026
-
mentioned by ifin.network
This is the patch that never ends It goes on and on my friends Some people Started applying it Not knowing what it was And they will keep ap
ifin.network · 9d ago · October 4th, 2026
-
mentioned by borncity.com
Citrix confirms vulnerability CVE-2026-88779 in NetScaler ADC and NetScaler Gateway; can lead to crashes and denial of service
borncity.com · 9d ago · October 4th, 2026
-
update from theperimetersite.com
If you're spending your Sunday night anywhere near a terminal, start with the NetScaler gear. CISA put CVE-2026-88779 on the Known Exploited
theperimetersite.com · 9d ago · October 4th, 2026
If you're spending your Sunday night anywhere near a terminal, start with the NetScaler gear.
-
mentioned by secdb.nttzen.cloud
🚨 [CISA-2026:1004] CISA Adds One Known Exploited Vulnerability to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:
secdb.nttzen.cloud · 9d ago · October 4th, 2026
-
update from bleepingcomputer.com
Citrix patches NetScaler SAML zero-day exploited in attacks
bleepingcomputer.com · 9d ago · October 4th, 2026
"If the condition is triggered repeatedly, the service may remain unavailable. Citrix is also providing Global Deny Lists that will block access from known malicious IP addresses.
-
mentioned by support.citrix.com
🤖 CVE-2026-88779 (CVSS 8.7): memory corruption (CWE-119) in Citrix NetScaler ADC/Gateway, reachable unauthenticated over the network → DoS.
support.citrix.com · 9d ago · October 4th, 2026
-
mentioned by www.cisa.gov
CISA adds CVE-2026-88779 to the KEV Catalog. The Citrix security advisory itself doesn't mention it, but their blog post states the followin
www.cisa.gov · 9d ago · October 5th, 2026
-
mentioned by www.yazoul.net
🟠 New security advisory: CVE-2026-88779 affects multiple systems. • Impact: Significant security breach potential • Risk: Unauthorized acces
www.yazoul.net · 9d ago · October 5th, 2026
-
mentioned by www.yazoul.net
🟠 New security advisory: CVE-2026-88779 affects multiple systems. • Impact: Significant security breach potential • Risk: Unauthorized acces
www.yazoul.net · 9d ago · October 5th, 2026
-
mentioned by threataft.com
🚨 Citrix NetScaler SAML zero-day (CVE-2026-88779, CVSS 8.7) in CISA KEV. Actively exploited. Memory overflow in SAML handler → appliance cra
threataft.com · 9d ago · October 5th, 2026
-
mentioned by gbhackers.com
Citrix NetScaler SAML Vulnerability Enables Unauthenticated Remote DoS Attacks
gbhackers.com · 8d ago · October 5th, 2026
-
mentioned by securityweek.com
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
securityweek.com · 8d ago · October 5th, 2026
-
mentioned by meterpreter.org
Discover how hackers exploit CVE-2026-88771 in Citrix NetScaler to hide PHP web shells as CSS files, granting remote access and compromising
meterpreter.org · 8d ago · October 5th, 2026
-
mentioned by thehackernews.com
🤖 CVE-2026-88779 (CVSS 8.7): memory overflow in Citrix NetScaler ADC & NetScaler Gateway, exploited in zero-day attacks. Can knock SAML depl
thehackernews.com · 8d ago · October 5th, 2026
-
mentioned by cyberworldops.eu
Citrix patched CVE-2026-88779, a memory-overflow in NetScaler ADC/Gateway triggered via SAML SP/IdP configurations and exploited in targeted
cyberworldops.eu · 8d ago · October 5th, 2026
-
mentioned by gbhackers.com
CISA Flags Citrix NetScaler Flaw Exploited in Ongoing Attacks
gbhackers.com · 8d ago · October 5th, 2026
-
mentioned by malware.news
Citrix security advisory (AV26-996)
malware.news · 8d ago · October 5th, 2026
-
mentioned by cyber.netsecops.io
📰 Citrix Patches Critical NetScaler Zero-Day Under Active Attack Citrix patches critical zero-day (CVE-2026-88779) in NetScaler ADC & Gatewa
cyber.netsecops.io · 8d ago · October 5th, 2026
-
mentioned by www.sophos.com
(sophos.com) Critical Memory Overflow Vulnerability in Citrix NetScaler ADC and Gateway Under Active Exploitation In brief - This article al
www.sophos.com · 8d ago · October 5th, 2026
-
mentioned by cybersecurefox.com
Zero-day in Citrix NetScaler SAML: CVE-2026-88779 Impacts Availability 🔗 https:// cybersecurefox.com/en/zero-day -cve-2026-88779-in-citrix-n
cybersecurefox.com · 8d ago · October 5th, 2026
-
mentioned by insomnisec.com
Citrix NetScaler Zero-Days (CVE-2026-88771 and CVE-2026-88772): A Skeleton Key at the Network Edge If your organisation runs a Citrix NetSca
insomnisec.com · 8d ago · October 5th, 2026
-
update from socprime.com
CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments
socprime.com · 8d ago · October 5th, 2026
federal agencies instructed to remediate affected systems by October 7, 2026. Click Explore Detections to reach relevant detection content mapped to MITRE ATT&CK® and compatible with multiple SIEM, EDR, and Data Lake technologies.
-
mentioned by www.infosecurity-magazine.com
A serious security flaw has been found in Citrix networking equipment that could knock systems offline. If your business uses these tools, c
www.infosecurity-magazine.com · 8d ago · October 5th, 2026
-
mentioned by www.yazoul.net
🔵 THREAT INTELLIGENCE New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline Vulnerability | CRITICAL CVEs:
www.yazoul.net · 8d ago · October 5th, 2026
-
update from cyberscoop.com
Citrix discloses third actively exploited NetScaler zero-day in less than a week
cyberscoop.com · 8d ago · October 5th, 2026
“This means it doesn’t work out of the box against every NetScaler deployment,” Jake Knott, head of threat intelligence at watchTowr, told CyberScoop. “While this is very inconvenient, it doesn’t have organizations scrambling to trigger incident response.” Citrix was much quicker and consistent in alerting customers to the emerging threat Friday, and followed up the next day with a more detailed blog post and security advisory that contained a patch for the high-severity defect. “After we were alerted to this issue we immediately developed and published a mitigation while concurrently developing, testing and deploying a fix,” a company spokesperson said in a statement.
-
mentioned by korben.info
Citrix NetScaler Patch for CVE-2026-88779 (Here we go again with a patch!)
korben.info · 7d ago · October 6th, 2026
-
mentioned by beyondmachines.net
Citrix Patches NetScaler Zero-Day Exploited in Attacks Against Specific Organizations Citrix released emergency patches for CVE-2026-88779,
beyondmachines.net · 7d ago · October 6th, 2026
-
mentioned by insicurezzadigitale.com
PitScaler: three NetScaler zero-days exploited in one week, two before the patch
insicurezzadigitale.com · 7d ago · October 6th, 2026
-
mentioned by insicurezzadigitale.com
PitScaler: three NetScaler zero-days exploited in one week, two already before the patch
insicurezzadigitale.com · 7d ago · October 6th, 2026
-
mentioned by www.bleepingcomputer.com
# Citrix patches # NetScaler SAML zero-day exploited in attacks https://www. bleepingcomputer.com/news/secu rity/citrix-patches-netscaler-sa
www.bleepingcomputer.com · 7d ago · October 6th, 2026
-
update from malware.news
CVE-2026-88779: Citrix NetScaler Zero-Day
malware.news · 7d ago · October 6th, 2026
It affects NetScaler appliances configured as either a SAML service provider (SP) or SAML identity provider (IdP).
-
mentioned by cyber.netsecops.io
📰 Citrix Patches Critical NetScaler Zero-Day Under Active Attack Citrix patches critical zero-day (CVE-2026-88779) in NetScaler ADC & Gatewa
cyber.netsecops.io · 7d ago · October 6th, 2026
-
mentioned by securityweek.com
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
securityweek.com · 7d ago · October 6th, 2026
-
update from www.esentire.com
New. eSentire: More Shells Than a Seafood Buffet: Tracking Citrix NetScaler Exploitation Activities (CVE-2026-88771) https://www. esentire.c
www.esentire.com · 7d ago · October 6th, 2026
eSentire: More Shells Than a Seafood Buffet: Tracking Citrix NetScaler Exploitation Activities (CVE-2026-88771) https://www.
-
mentioned by www.nextron-systems.com
(nextron-systems.com) Enhanced Detection Rules for Citrix NetScaler Exploits CVE-2026-88771 and CVE-2026-88772: Comprehensive Coverage of Ex
www.nextron-systems.com · 7d ago · October 6th, 2026
-
update from www.redhotcyber.com
Have you updated NetScaler yet? Everything must be redone! A new zero-day appears.
www.redhotcyber.com · 6d ago · October 7th, 2026
You have to redo everything! A new zero-day appears. Link to article: https://www.redhotcyber.com/post/hai-gia-aggiornato-netscaler-tutto-da-rifare-spunta-un-nuovo-zero-day/
via Mastodon https://www.redhotcyber.com/post/hai-gia-aggiornato-netscaler-tutto-da-rifare-spunta-un-nuovo-zero-day/
-
mentioned by theperimetersite.com
It's October 7. Federal employees and vendors who care about compliance need to patch CVE-2026-88779 in Citrix NetScaler by today; if you di
theperimetersite.com · 6d ago · October 7th, 2026
-
mentioned by cybersecurefox.com
Critical zero-days in Citrix NetScaler give root access 🔗 https:// cybersecurefox.com/en/critical -vulnerabilities-in-citrix-netscaler-cve-2
cybersecurefox.com · 6d ago · October 7th, 2026
-
mentioned by meterpreter.org
Citrix reveals CVE-2026-88779, a critical memory overflow flaw in NetScaler SAML configurations leading to DoS, following recent RCE zero-da
meterpreter.org · 6d ago · October 7th, 2026
-
mentioned by www.linkedin.com
Citrix NetScaler security alert: two actively exploited vulnerabilities Citrix has confirmed exploitation of CVE-2026-88771 and CVE-2026-887
www.linkedin.com · 5d ago · October 8th, 2026
-
mentioned by gbhackers.com
Critical Citrix NetScaler CVE-2026-88771 Exploited for Reverse Shells and Persistent Access
gbhackers.com · 5d ago · October 8th, 2026
-
mentioned by deafnews.it
Third Citrix NetScaler zero-day in 10 days: CVE-2026-88779 hits SAML parser with CVSS 8.7. CISA orders federal agencies to patch by Oct. 7.
deafnews.it · 5d ago · October 8th, 2026
-
mentioned by blog.talosintelligence.com
(blog.talosintelligence.com) Emerging Threats in AI-Analysis Evasion and Critical Vulnerabilities: Insights from Talos Threat Intelligence I
blog.talosintelligence.com · 5d ago · October 8th, 2026
-
mentioned by ifin.network
I'm tired, boss. A new # Citrix CVE affecting SAML IdP/SP-configured devices is out. https:// ifin.network/t/cve-2026-107406 -somehow-anothe
ifin.network · 5d ago · October 8th, 2026
-
mentioned by support.citrix.com
I thought it was a Sunday because Citrix posted another yet another NetScaler security advisory: CVE-2026-107406 (9.5 critical) pre-auth mem
support.citrix.com · 5d ago · October 8th, 2026
-
mentioned by gbhackers.com
Critical Citrix NetScaler Vulnerability Allows Remote Code Execution Attacks – CVSS 9.5
gbhackers.com · 4d ago · October 9th, 2026
-
update from securityweek.com
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
securityweek.com · 4d ago · October 9th, 2026
Related: Critical NetScaler Vulnerability Exploited in Attacks Related: Cisco Patches a Dozen Critical Vulnerabilities Rel
-
mentioned by bleepingcomputer.com
Citrix warns admins to patch new NetScaler RCE flaw immediately
bleepingcomputer.com · 4d ago · October 9th, 2026
-
mentioned by radar.offseq.com
CRITICAL RCE vulnerability found in Citrix NetScaler ADC & Gateway. Remote attackers could execute code on unpatched systems. No CVE ID or a
radar.offseq.com · 4d ago · October 9th, 2026
-
mentioned by thecybersecguru.com
🚨 CRITICAL CITRIX NETSCALER FLAW: CVSS 9.5 CVE-2026-107406 could let attackers achieve REMOTE CODE EXECUTION or crash NetScaler ADC & Gatewa
thecybersecguru.com · 4d ago · October 9th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-107406: critical memory overflow in Citrix NetScaler ADC/Gateway can lead to RCE or DoS under specific SAML configurations. Citri
www.bleepingcomputer.com · 4d ago · October 9th, 2026
-
mentioned by malware.news
Citrix security advisory (AV26-1023)
malware.news · 4d ago · October 9th, 2026
-
update from socprime.com
CVE-2026-107406: Critical NetScaler ADC and Gateway RCE Vulnerability
socprime.com · 4d ago · October 9th, 2026
Organizations can strengthen their defenses against emerging vulnerability exploitation with SOC Prime’s AI-Native Detection Intelligence Platform, which helps security teams accelerate threat detection engineering, threat hunting, and investigation across diverse security environments.
-
mentioned by www.bleepingcomputer.com
# Citrix warns admins to patch new # NetScaler RCE flaw immediately https://www. bleepingcomputer.com/news/secu rity/citrix-warns-admins-to-
www.bleepingcomputer.com · 4d ago · October 9th, 2026
-
update from malware.news
CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained
malware.news · 21h ago · October 13th, 2026
The bug resides in ns_monuploadd_err.pl , a root Perl maintenance script that passes log line content to the shell. Attackers plant payloads by submitting a crafted username in an unauthenticated login request, which NetScaler writes to its logs. A semicolon in the injected text splits the find command, so the attacker's command runs as root.
-
mentioned by www.picussecurity.com
(picussecurity.com) Critical Pre-Authentication Command Injection Vulnerability in Citrix NetScaler ADC and Gateway (CVE-2026-88771) In brie
www.picussecurity.com · 20h ago · October 13th, 2026
-
mentioned by beyondmachines.net
CISA Urges Immediate Patching of Exploited Citrix NetScaler Vulnerabilities Citrix and CISA urged immediate patching of NetScaler ADC and Ga
beyondmachines.net · 19h ago · October 13th, 2026
-
update from gbhackers.com
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor
gbhackers.com · 15h ago · October 13th, 2026
Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices.
-
mentioned by www.picussecurity.com
New. Picus: CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained https://www. picussecurity.com/resource/blo g/cve-2026-887
www.picussecurity.com · 10h ago · October 13th, 2026