Tag: citrix
-
Citrix patches NetScaler SAML zero-day exploited in attacks
Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/
-
Citrix patches NetScaler SAML zero-day exploited in attacks
Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/
-
Citrix NetScaler Appliances Reboot Repeatedly After 0-Day Security Update
Citrix NetScaler administrators report repeated appliance crashes and forced reboots after deploying emergency updates for recently disclosed zero-day vulnerabilities, with the disruption now linked to a newly observed issue affecting SAML authentication deployments. The reports involve internet-facing NetScaler ADC and Gateway systems running patched releases, including version 14.1-73.37, which Citrix previously designated as a fixed…
-
Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response
One company told customers to power down its data-protection platform during a nine-hour window, while the other remained mum on reported attacks prior to releasing a patch for its product. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/kiteworks-citrix-incidents-challenges-zero-day-response
-
Aktiv ausgenutzte Netscaler-Lücken Arctic Wolf analysiert die Aktivitäten der Angreifer
Nach der Warnung des Australian Cyber Security Centre (ACSC) in dieser Woche und der Bestätigung von Citrix, dass mehrere Schwachstellen in Netscaler aktiv ausgenutzt werden, hat Arctic Wolf Labs neue Erkenntnisse zu beobachteten Angriffsaktivitäten veröffentlicht. Während sich die bisherige Berichterstattung vor allem auf die Schwachstellen selbst konzentriert hat, haben die Forscher von Arctic Wolf nun…
-
Aktiv ausgenutzte Netscaler-Lücken Arctic Wolf analysiert die Aktivitäten der Angreifer
Nach der Warnung des Australian Cyber Security Centre (ACSC) in dieser Woche und der Bestätigung von Citrix, dass mehrere Schwachstellen in Netscaler aktiv ausgenutzt werden, hat Arctic Wolf Labs neue Erkenntnisse zu beobachteten Angriffsaktivitäten veröffentlicht. Während sich die bisherige Berichterstattung vor allem auf die Schwachstellen selbst konzentriert hat, haben die Forscher von Arctic Wolf nun…
-
Aktiv ausgenutzte Netscaler-Lücken Arctic Wolf analysiert die Aktivitäten der Angreifer
Nach der Warnung des Australian Cyber Security Centre (ACSC) in dieser Woche und der Bestätigung von Citrix, dass mehrere Schwachstellen in Netscaler aktiv ausgenutzt werden, hat Arctic Wolf Labs neue Erkenntnisse zu beobachteten Angriffsaktivitäten veröffentlicht. Während sich die bisherige Berichterstattung vor allem auf die Schwachstellen selbst konzentriert hat, haben die Forscher von Arctic Wolf nun…
-
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data.LevelBlue’s Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler First seen on thehackernews.com Jump…
-
Mass exploitation of Citrix NetScaler: What we currently know
Suspected state-linked actors targeted critical vulnerabilities in the widely used platform, causing widespread disruption across Europe and North America. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/exploitation-citrix-netscaler-what-we-know/831780/
-
Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells
Threat actors are actively exploiting a critical zero-day vulnerability in Citrix NetScaler, identified as CVE-2026-88772, to gain unauthenticated root-level access to vulnerable Application Delivery Controller (ADC) and Gateway appliances. After the initial compromise, they deploy custom PHP web shells and tools to tunnel within the internal network. Mandiant Consulting and the Google Threat Intelligence Group…
-
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
Tags: access, citrix, exploit, finance, flaw, google, government, group, intelligence, mandiant, service, technology, threat, usaUnknown threat actors have been observed exploiting a newly patched security flaw in Citrix NetScaler ADC and NetScaler Gateway appliances to target organizations in North America and Europe.The activity, observed by Mandiant Consulting and Google Threat Intelligence Group (GTIG) in September 2026, has targeted government, financial services, technology, education, and legal and professional First seen…
-
WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign
Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been…
-
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild.The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that’s rooted in…
-
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Mandiant researchers said dozens of organizations have been impacted by attacks attributed to advanced and suspected state-sponsored threat groups. They expect more attacks to come. First seen on cyberscoop.com Jump to article: cyberscoop.com/citrix-netscaler-zero-day-attacks-three-weeks-undetected/
-
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/
-
Cyber authorities issue alerts over exploitation of Citrix vulns
The latest vulnerabilities to be uncovered in the frequently-targeted Citrix NetScaler product lines were being exploited well-before disclosure, prompting disquiet. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366651460/Cyber-authorities-issue-alert-over-exploitation-of-Citrix-vulns
-
Citrix NetScaler exploitation began days before public notification
Customers need to check systems for compromise prior to patching, because the security upgrade may not fully resolve an infected system.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/citrix-netscaler-exploitation-days-before-notification/831634/
-
Citrix NetScaler exploitation began days before public notification
Customers need to check systems for compromise prior to patching, because the security upgrade may not fully resolve an infected system.; First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/citrix-netscaler-exploitation-days-before-notification/831634/
-
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
The hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated. What started as stealthy targeting via zero-day exploits has now become … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771/
-
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers
The critical vulnerabilities, which impact default configurations of NetScaler products, essentially give attackers a skeleton key to customers’ networks. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/netscaler-zero-days-chaos-citrix
-
Citrix patches actively exploited NetScaler zero-days after a weekend of unofficial warnings
The vendor’s products are a common, recurring target for attackers, yet the official warning for some Citrix NetScaler customers was too late. First seen on cyberscoop.com Jump to article: cyberscoop.com/citrix-zero-days-delayed-disclosure/
-
Hackers Hit NetScaler Zero-Days Before Citrix Patched
CISA Adds 2 NetScaler Flaws to KEV as Researchers Detail Root-Level Exploit. Attackers exploited two critical Citrix NetScaler flaws before fixes were available, including a bug that lets hackers with no credentials run commands on appliances left in their factory settings. CISA added both to its KEV catalog and gave federal agencies days to patch…
-
Hackers Hit NetScaler Zero-Days Before Citrix Patched
CISA Adds 2 NetScaler Flaws to KEV as Researchers Detail Root-Level Exploit. Attackers exploited two critical Citrix NetScaler flaws before fixes were available, including a bug that lets hackers with no credentials run commands on appliances left in their factory settings. CISA added both to its KEV catalog and gave federal agencies days to patch…
-
Citrix urges immediate upgrades of NetScaler amid widespread exploitation attempts
Security teams received urgent calls to disconnect servers before authorities confirmed critical zero-day flaws. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/citrix-upgrades-netscaler-exploitation/831502/
-
US, UK warn of exploited Citrix NetScaler zero-day bugs
Incident responders began warning of potential vulnerabilities in NetScaler Gateway products on Saturday before cybersecurity agencies in the Netherlands, U.S. and U.K. released advisories on Sunday confirming vulnerabilities. Citrix itself confirmed eight new vulnerabilities. First seen on therecord.media Jump to article: therecord.media/us-uk-warn-of-citrix-netscaler-zero-day-bug
-
âš¡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work…
-
Zero-Day in Netscaler: Citrix bestätigt Angriffe
Sicherheitsforscher und -behörden warnen seit dem Wochenende vor den Schwachstellen. Citrix stellt nun auch Updates zur Beseitigung der Fehler bereit. First seen on golem.de Jump to article: www.golem.de/news/zero-day-in-netscaler-citrix-bestaetigt-angriffe-2609-213494.html
-
Citrix NetScaler Hit by Two Critical RCE Flaws Already Under Attack
Citrix has released fixes for two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-88771 and CVE-2026-88772. On September 27, the company confirmed that attackers had already exploited both in the wild. The same update addresses six other vulnerabilities. One of the two exploited bugs affects every deployment running a…
-
Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)
Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/
-
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.The vulnerabilities are listed below – CVE-2026-88771 (CVSS score: 9.5) – An improper input validation vulnerability that could allow an unauthenticated attacker to First seen…