citrix netscaler News Articles

Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware - IT Security News

2026-10-23 10:10 Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no...

3 weeks ago

Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - IT Security News

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting...

3 weeks ago

NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779 - IT Security News

Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting...

3 weeks ago

CISA Warns of Hackers Exploiting Two Citrix NetScaler 0-Days to Execute Code Remotely

Threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, allowing them to execute code remotely on exposed systems.

1 month ago

Week 41 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Belkasoft Forensic Acquisition of MediaTek-Based Android Devices Vladimir Katalov at Elcomsoft Low-Level Extraction of the HomePod mini Eoghan Casey at DFRWS G...

Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data - IT Security News

2026-10-08 17:10 Hackers are exploiting CVE-2026-88771, a critical Citrix NetScaler vulnerability, to run commands, install web shells, and collect appliance configuration data. The activity...

Update on Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: Expanded THOR Detection Coverage - Nextron Systems

Over the last several days, our Research Team has continued to analyze artifacts associated with the exploitation of Citrix NetScaler CVE-2026-88771 and CVE-2026-88772. As more samples, technical reports and...

TENEX.ai Threat Intelligence Report: Citrix NetScaler Zero-Day Attackers Plants Footholds That Survive Patching

Analysis of newly discovered CVE-2026-88771 zero-day exploit traces attacker infrastructure to a command-and-control cluster; TENEX releases more than 60 IOCs

Week 40 – 2026

If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Adam at Hexacorn The boring state of stalled timelines… Belkasoft Analyzing Windows BAM and DAM with Belkasoft X Christopher Eng at Ogmini Steam Frame - DFIR F...

Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited - Help Net Security

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: 16-year-old researcher breaks into Microsoft analytics

Kiteworks, Citrix Incidents Show Challenge of Zero-Day Response

One company told customers to power down its platform, while the other remained mum on reported attacks prior to releasing a patch for its product.

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs - SwapUpdate

Ravie LakshmananOct 01, 2026Vulnerability / Web Security

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Attackers exploit Citrix NetScaler CVE-2026-88771 to deploy web shells and attempt theft of configuration data.

Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks

NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772 have been exploited in zero-day attacks for weeks before patching.

Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) - IT Security News

Vendors can use your data to provide services. Declining a vendor can stop them from using the data you shared.Exponential Interactive, Inc d/b/a VDX.tvCookie duration: 90 (days).Data collected and processed:...

Citrix NetScaler Zero-Day: Patch Now, Then Check If Hackers Were Already Inside

Citrix NetScaler zero-days are under active exploitation, with attackers deploying web shells and tunneling tools. Patching alone may not remove an existing...

Citrix NetScaler Zero-Days Spread Mass Exploitation: Patching Won't Remove Backdoors

Citrix NetScaler zero-day vulnerabilities CVE-2026-88771 and CVE-2026-88772 triggered mass internet exploitation within minutes of a proof-of-concept release. With 100+ organizations already

Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) - IT Security News

2026-09-30 15:09 “Advanced and suspected state-sponsored threat actors” are likely to be behind the initial targeted intrusions that leveraged CVE-2026-88772, one of the two recently...

Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) - Help Net Security

Advanced threat actor exploited CVE-2026-88772, one of the two recently disclosed NetScaler zero-day flaws, for weeks.

Hackers Exploit Citrix NetScaler Zero-Day to Gain Root Access and Deploy Web Shells - IT Security News

2026-09-30 12:09 Threat actors are actively exploiting a critical zero-day vulnerability in Citrix NetScaler, identified as CVE-2026-88772, to gain unauthenticated root-level access to...

Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution - SwapUpdate

Ravie LakshmananSep 30, 2026Vulnerability / Network Security

New THOR Detection Coverage for Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 - Nextron Systems

On September 27, 2026, Citrix published security bulletin CTX697096 covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway. This post focuses on CVE-2026-88771, an unauthenticated command...

Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT

Unknown attackers exploit a patched Citrix NetScaler flaw to gain root access and deploy web shells and a tunneler.

Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution

Citrix NetScaler CVE-2026-88772 is exploited in the wild and can enable remote code execution through a DTLS buffer overflow.

Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services

Two questions remain: who is abusing the CVEs? And why did Citrix take so long to disclose?