A memory overflow in the NetScaler Push component may cause the device to behave unpredictably or stop working, potentially leading to a denial of service.

A coding mistake in Citrix NetScaler's DNS and DNS‑over‑HTTPS handling can cause the device to behave unpredictably or become unavailable.

The ADC and Gateway devices from Citrix can experience memory overload that makes them behave oddly or stop working, potentially interrupting user access.

A coding mistake in the packet handling code of Citrix NetScaler ADC and NetScaler Gateway can cause memory to be overwritten.

The NetScaler Console appliance does not properly verify a user's credentials, so anyone on the network can get past the login screen and reach areas.

The Citrix NetScaler ADC and Gateway devices can run out of memory when they handle SMPP (short message) traffic, which can cause the system to behave.

A flaw in the DNS-over-HTTPS handling of Citrix NetScaler ADC and Gateway can corrupt memory, leading to unpredictable behavior or a complete stop of.

Sicherheitsforscher und Administratoren melden massenhafte Spontanreboots betroffener Geräte. Updates sind nun verfügbar und sollten schnell aufgespielt werden.

NetScaler administrators, having barely concluded the rigorous remediation of two distinct, critical zero-day vulnerabilities, are now confronted with a fresh, urgent mandate to upgrade. Citrix has officially disclosed CVE-2026-88779, a profound vulnerability already observed actively weaponized within highly targeted cyberattacks. Alarmingly, this newly exposed threat compromises even those systems previously deemed entirely secure following September's emergency patching protocols. The Mechanics of the Memory Overflow…

At a Glance Malware family PHP web shells, a Perl web shell installer, Platypus agents, and a Python reverse shell Threat actor Four unnamed clusters; one uses a tool tied to China-nexus actors (suspected, not confirmed) Targets Citrix NetScaler appliances; eight eSentire customers across the post-disclosure clusters Delivery vector Exploitation of CVE-2026-88771, both before and after disclosure Key capabilities

Cet outil est un script POSIX shell en lecture seule destiné à vérifier l'exposition et la compromission des appliances Citrix NetScaler ADC / NetScaler Gateway face aux bulletins de sécurité CTX697096 (CVE-2026-88771 à CVE-2026-88778) et CTX697174 (CVE-2026-88779).

Cybersecurity Threat Research 'Weekly' Recap. Attackers abused fake installers, developer-platform lures, and AI-driven tooling to deliver loaders and steal credentials, including campaigns tied to Silver Fox, GlassWorm, JSCEAL, TA419, Remcos, and Vidar. Alongside these tradecraft shifts, the roundup highlighted active zero-day exploitation in Citrix NetScaler and PaperCut MF, plus supply-chain and exposed-credential risks involving MALFEX and leaked GitHub datasets. #SilverFox #GlassWorm #JSCEAL #TA419 #Remcos #Vidar #CitrixNetScaler #CVE-2026-88771 #CVE-2026-88772 #PaperCutMF #AdaptixC2 #MALFEX #TIKTOUK #Jewelbug #Warlock

Breaching a Citrix NetScaler via a zero-day vulnerability merely constitutes the inaugural phase of a sophisticated attack. Following successful infiltration, threat actors deploy previously uncatalogued implants, WHIPSHOT and SLAPSHOT. These insidious tools guarantee persistent device access, effectively transforming the perimeter gateway into a clandestine bridgehead leading directly into the corporate internal network. The Google Threat Intelligence Group, in collaboration with Mandiant, primarily attributed this observed campaign to CVE-2026-88772.

Cet article constitue la deuxième partie d'une série d'analyses portant sur un bulletin Citrix (CTX697096) corrigeant huit vulnérabilités dans Citrix NetScaler ADC et NetScaler Gateway. Il fait suite à une analyse du CVE-2026-88771 publiée la veille. CVE-2026-88772 est un débordement mémoire (memory overflow) dans le traitement DTLS, affectant le composant préauthentification de NetScaler.

Since at least early September 2026, attackers have taken root-level control of Citrix NetScaler appliances without a password. Mandiant and Google Threat Intelligence Group (GTIG) traced the break-ins to a Citrix NetScaler zero-day, CVE-2026-88772. In their new report on the campaign, the researchers describe custom web shells hidden behind fake image requests. At a Glance Actor

LevelBlue THOR identified active exploitation of CVE-2026-88771 against Citrix NetScaler ADC and NetScaler Gateway, with attacker-controlled authentication data used to execute commands, retrieve payloads, and stage configuration data. The activity progressed to reverse-shell deployment, privileged account creation, and web-shell installation using infrastructure and artifacts including main.py, update_c08937.pl, and sec_monitor. #CVE-2026-88771 #CitrixNetScaler #main.py #update_c08937.pl #sec_monitor

Cybersecurity researchers disclosed technical details of CVE-2026-88772, a critical Citrix NetScaler ADC and Gateway flaw that is being actively exploited in the wild. The bug is a DTLS-related memory overflow in the NetScaler Packet Processing Engine and can lead to remote code execution or denial-of-service. #CVE-2026-88772 #CitrixNetScaler #NetScalerADC #NetScalerGateway #NSPPE...

Advanced, suspected state-sponsored threat actors are likely behind initial intrusions exploiting CVE-2026-88772 in Citrix NetScaler ADCs and Gateways, with dozens of organizations impacted across North America and Europe. Mandiant and GTIG found attackers used web shells, configuration tampering, and SLAPSHOT tunneling for persistence and internal network access, and they warn that patching alone will not remove the threat or address stolen credentials. #CVE-2026-88772 #CVE-2026-88771 #CitrixNetScaler #Mandiant #GTIG #SLAPSHOT

Mandiant and GTIG identified active exploitation of CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway, with intrusions using custom tooling to gain root access, persist, and move into internal networks. The campaign deployed WHIPSHOT and SLAPSHOT to hide C2 in HTTP headers, proxy traffic for reconnaissance and credential theft, and abuse modified web server settings, while Citrix also warned that CVE-2026-88771 is being actively exploited. #CVE-2026-88772 #CVE-2026-88771 #CitrixNetScaler #WHIPSHOT #SLAPSHOT

Cet article présente l'analyse technique détaillée de CVE-2026-88771, une vulnérabilité d'injection de commandes pré-authentification affectant Citrix NetScaler ADC et NetScaler Gateway, exploitée activement en zero-day avant la publication de tout correctif.

 Two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are reportedly being exploited in the wild, raising serious concerns for organisations that rely on the products for remote access and application delivery. Security firm watchTowr disclosed the activity on September 26, stating that attackers had used the flaws to achieve remote code execution before Citrix released patches or detailed technical guidance. The company warned that the vulnerabilities could allow attackers to compromise exposed appliances and potentially gain access to connected networks.  According to watchTowr, the flaws were discovered during forensic investigations into suspected intrusions. Both vulnerabilities reportedly enable remote code execution, meaning an unauthenticated attacker could potentially execute malicious commands on a vulnerable NetScaler device. Because these appliances frequently sit at the edge of corporate networks and handle VPN or application access, a successful compromise could provide attackers with an important entry point for credential theft, lateral movement, data exfiltration or ransomware deployment.  At the time of the initial disclosure, Citrix had not confirmed the vulnerabilities, published affected-version information or released a security update. The absence of official indicators of compromise or a reliable workaround left administrators with limited options. Some organisations reportedly chose to take NetScaler appliances offline to reduce the risk, although doing so can disrupt remote workers, business applications and customer-facing services. Researchers expected Citrix to issue communications and patches during the week beginning September 28.  The situation later developed when Citrix confirmed that two critical NetScaler flaws had been exploited and released fixes alongside patches for six additional vulnerabilities. The issues were identified as CVE-2026-88771 and CVE-2026-88772, both carrying a CVSS score of 9.5. The first is an improper input-validation vulnerability that could allow an unauthenticated attacker to run arbitrary commands, while the second involves improper memory-buffer restrictions and could lead to remote code execution or denial-of-service attacks.  Security teams should treat these vulnerabilities as an emergency priority. Administrators should identify all internet-facing NetScaler ADC and Gateway systems, apply Citrix’s latest fixes immediately and review logs for unusual authentication, configuration or administrative activity. Organisations should also rotate potentially exposed credentials, inspect connected systems for signs of post-compromise activity and restrict management access wherever possible. CISA’s addition of both flaws to its Known Exploited Vulnerabilities catalogue further underlines the urgency of patching and incident investigation.

CVE WATCHTOWER logged 2,825 new vulnerabilities between September 21 and September 27, 2026. Of those, 218 scored CVSS 9.0 or higher. This weekly CVE report focuses on the flaws attackers already use. Daily Cybersecurity's intelligence flagged 9 exploited bugs this week, and edge devices dominate the list. The week in numbers The volume dropped from last week, but the danger did not.

Versions of Citrix NetScaler ADC and NetScaler Gateway released before the latest updates can be tricked into running unwanted code or stopping service.

Older versions of Citrix NetScaler ADC and NetScaler Gateway may treat incoming web requests differently, allowing a single request to be split and.

Malicious actors have commenced active attacks against Citrix NetScaler infrastructure. They are exploiting the critical vulnerability designated as CVE-2026-19490. This severe flaw enables remote adversaries to circumvent authentication protocols entirely. Consequently, they gain illicit access to corporate VPN gateways and AAA servers. The inaugural exploitation attempts materialized on September 3. Strikingly, this occurred merely twenty-four hours after the publication of a public Proof of Concept (PoC).