Citrix says attackers are exploiting two critical zero-days in NetScaler products, putting organizations that use them for remote access and application delivery at immediate risk. CVE-2026-88771 is an improper input validation flaw and CVE-2026-88772 is a memory overflow bug; both are rated 9.5, can lead to remote code execution, and affect default configurations of NetScaler ADC and NetScaler Gateway. Public signs of exploitation reportedly appeared days before Citrix’s Sept. 27 advisory.
2026.10.05
72% relevant
The piece also materially connects to the earlier NetScaler zero-day cluster by stating CVE-2026-88779 is being exploited amid the same wave of attacks and may be used to intentionally crash appliances to make exploitation of CVE-2026-88771 faster, though CVE-2026-88779 is a distinct newly tracked flaw.
Eduard Kovacs
2026.09.30
98% relevant
This article clearly updates the same underlying event by adding incident-response details from Mandiant, GTIG, GreyNoise, and others: exploitation had been ongoing since at least early September, dozens to 100+ organizations were hit, victims were concentrated in government and finance, and attackers used malware including the WHIPSHOT web shell and SLAPSHOT tunneling tool after gaining root on NetScaler ADC and Gateway appliances.
info@thehackernews.com (The Hacker News)
2026.09.30
95% relevant
This article adds concrete exploit-chain details for CVE-2026-88772, showing a pre-authentication path to shellcode execution on NetScaler, which directly updates the same zero-day event already being tracked.
Lawrence Abrams
2026.09.29
98% relevant
This directly updates the same Citrix NetScaler zero-day event by adding post-exploitation details from Mandiant and GreyNoise, including web-shell deployment paths, httpd.conf modifications, root access behavior, observed source infrastructure, affected sectors, and evidence that CVE-2026-88772 was used to gain footholds and pivot into internal networks.
2026.09.29
95% relevant
This article is a direct update on the same NetScaler zero-day event and adds that Google and GreyNoise observed exploitation from at least early September through September 24, that targets include government, finance, education, and professional services organizations in North America and Europe, and that attackers used custom malware after exploiting CVE-2026-88772.
Arctic Wolf Labs
2026.09.29
98% relevant
This source directly covers the same September 2026 Citrix NetScaler event and adds operational detail: Arctic Wolf says both flaws were exploited as zero-days, clarifies that CVE-2026-88771 affects default deployments without extra features, that CVE-2026-88772 is exploitable when DTLS is enabled by default on VPN servers, and reiterates the exact fixed releases and KEV timing.
Rob Wright
2026.09.29
100% relevant
This article establishes a distinct new event: the disclosure and active exploitation of two specific Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772.