{"metadata": {"vulnerability": "CVE-2026-88772", "count": 322, "kinds": {"milestone": 10, "sighting": 273, "kev": 19, "other": 20}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-10T07:14:57.369Z", "date_only": false, "value": "2026-09-10T07:14:57.369Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-88772", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-88772", "field": "timestamps.asserted_at", "uuid": "25ce362a-a184-4ea6-83c7-64bb2a2242a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "enisa-cnw-kev", "record": "CVE-2026-88772", "field": "timestamps.asserted_at", "uuid": "c6e5d3ee-94a3-487c-a2cd-d7dc4e78ca7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88772", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-88772", "field": "evidence.0.details.date_added", "uuid": "25ce362a-a184-4ea6-83c7-64bb2a2242a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-88772", "field": "timestamps.first_seen_at", "uuid": "25ce362a-a184-4ea6-83c7-64bb2a2242a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "enisa-cnw-kev", "record": "CVE-2026-88772", "field": "timestamps.first_seen_at", "uuid": "c6e5d3ee-94a3-487c-a2cd-d7dc4e78ca7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88772", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88772", "record": "FKIE_CVE-2026-88772", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-88772", "field": "status.status_updated_at", "uuid": "25ce362a-a184-4ea6-83c7-64bb2a2242a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "enisa-cnw-kev", "record": "CVE-2026-88772", "field": "status.status_updated_at", "uuid": "c6e5d3ee-94a3-487c-a2cd-d7dc4e78ca7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88772", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-09-27T09:09:00Z", "date_only": false, "value": "2026-09-27T09:09:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "622d98a1-2321-415a-a344-5e161bff0462", "url": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html"}, {"timestamp": "2026-09-27T10:21:12Z", "date_only": false, "value": "2026-09-27T10:21:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "466865b3-0163-4622-8245-337946187904", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30"}, {"timestamp": "2026-09-27T11:02:05Z", "date_only": false, "value": "2026-09-27T11:02:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a152472e-d15a-40f3-a237-f61325452c46", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772"}, {"timestamp": "2026-09-27T11:05:15Z", "date_only": false, "value": "2026-09-27T11:05:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/aktivt-utnyttelse-av-kritiske-sarbarheter-i-citrix-netscaler", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "6f6eb354-ebfa-4eb7-b800-eccac43f979b", "url": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/aktivt-utnyttelse-av-kritiske-sarbarheter-i-citrix-netscaler"}, {"timestamp": "2026-09-27T12:11:42Z", "date_only": false, "value": "2026-09-27T12:11:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "96e117e0-b1c0-4548-be75-b54eb81b47c0", "url": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu"}, {"timestamp": "2026-09-27T12:34:41Z", "date_only": false, "value": "2026-09-27T12:34:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "484cbf89-90cd-4091-a405-09916b313e57", "url": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler"}, {"timestamp": "2026-09-27T14:55:29Z", "date_only": false, "value": "2026-09-27T14:55:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0ef9c42b-4d16-4ea3-a03a-be6ee29a20c3", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394"}, {"timestamp": "2026-09-27T15:33:53.431Z", "date_only": false, "value": "2026-09-27T15:33:53.431710Z", "kind": "sighting", "label": "Seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117343729453093307", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9f45ce3e-3537-4e24-b4a8-9fa0079038f6", "content": "Netscaler CVEs are out:\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nPatch isn\u2019t yet through QA at Citrix still, been a week :02angery: \nThe primary vulns being exploited are 2026-88771, CVE-2026-88772, CVE-2026-88773 chained. \nIt gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.", "url": "https://cyberplace.social/users/GossiTheDog/statuses/117343729453093307"}, {"timestamp": "2026-09-27T15:36:30.407Z", "date_only": false, "value": "2026-09-27T15:36:30.407267Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3f28c353-dd58-417e-a0b5-0b6142e49531", "url": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6"}, {"timestamp": "2026-09-27T15:37:52.372Z", "date_only": false, "value": "2026-09-27T15:37:52.372309Z", "kind": "sighting", "label": "Seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9446ec5b-a9eb-4fff-97c5-1a33c41315a6", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "url": "https://social.circl.lu/users/circl/statuses/117343746256136269"}, {"timestamp": "2026-09-27T15:50:37.116Z", "date_only": false, "value": "2026-09-27T15:50:37.116411Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4ba35f4c-b84a-455a-992b-608802992a9c", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "url": "https://infosec.exchange/users/AAKL/statuses/117343796345996830"}, {"timestamp": "2026-09-27T15:56:07Z", "date_only": false, "value": "2026-09-27T15:56:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a47e3727-c51f-46ce-8e1e-77dc3a180696", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "url": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar"}, {"timestamp": "2026-09-27T16:09:56.033Z", "date_only": false, "value": "2026-09-27T16:09:56.033Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88772", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-27T16:09:56.033Z", "date_only": false, "value": "2026-09-27T16:09:56.033Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / NetScaler", "record": "CVE-2026-88772", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-27T16:18:00.663Z", "date_only": false, "value": "2026-09-27T16:18:00.663286Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwj77jedpp2r", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c4ed17da-156d-4313-b5b3-d9fbd875d349", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwj77jedpp2r"}, {"timestamp": "2026-09-27T16:18:01.362Z", "date_only": false, "value": "2026-09-27T16:18:01.362808Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mwj77jtazd2x", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9a5cf148-80d1-42a2-944f-15f019ddf243", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #PotatoSecurity #VPN #watchTowr #PatchNow", "url": "https://bsky.app/profile/potato.software/post/3mwj77jtazd2x"}, {"timestamp": "2026-09-27T16:24:30Z", "date_only": false, "value": "2026-09-27T16:24:30.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10175", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "8b3793f4-95ad-4a7e-97fd-d23d70f00ae5", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://t.me/thehackernews/10175"}, {"timestamp": "2026-09-27T16:24:30Z", "date_only": false, "value": "2026-09-27T16:24:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10175", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "1559646a-e87f-4d5d-8a4d-ebd9da4b9efc", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://t.me/thehackernews/10175"}, {"timestamp": "2026-09-27T16:45:00Z", "date_only": false, "value": "2026-09-27T16:45:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-88772", "field": "timestamps.asserted_at", "uuid": "fb84583a-1292-444b-a5af-e431e11e44e6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:45:00Z", "date_only": false, "value": "2026-09-27T16:45:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-88772", "field": "evidence.0.details.added_date", "uuid": "fb84583a-1292-444b-a5af-e431e11e44e6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:45:00Z", "date_only": false, "value": "2026-09-27T16:45:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-88772", "field": "timestamps.first_seen_at", "uuid": "fb84583a-1292-444b-a5af-e431e11e44e6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:45:00Z", "date_only": false, "value": "2026-09-27T16:45:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-88772", "field": "status.status_updated_at", "uuid": "fb84583a-1292-444b-a5af-e431e11e44e6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:55:29.765Z", "date_only": false, "value": "2026-09-27T16:55:29.765476Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-27T16:55:29.765Z", "date_only": false, "value": "2026-09-27T16:55:29.765476Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-27T17:00:13.448Z", "date_only": false, "value": "2026-09-27T17:00:13.448668Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mwjbkwf7sc22", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "8850041a-d8e7-4ced-9f67-139020f4d4e6", "content": "\ud83d\udea8 CVE-2026-88771 & CVE-2026-88772: Citrix has patched two exploited NetScaler zero-days (CVSS 9.5). Update to 14.1-73.37 / 13.1-64.23 and check for compromise.\nwww.cyberkendra.com/2026/09/cve-... \n\n#citrixvulnerability #netscaler #zeroday #infosec", "url": "https://bsky.app/profile/cyberkendra.com/post/3mwjbkwf7sc22"}, {"timestamp": "2026-09-27T17:00:47.386Z", "date_only": false, "value": "2026-09-27T17:00:47.386547Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwjblzg2jz2p", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b588ecb0-da1e-46d6-b6c0-6e00ae21ca4b", "content": "Citrix lanceert noodupdates na actieve uitbuiting van kritieke kwetsbaarheden in\n\nCitrix heeft beveiligingsupdates uitgebracht voor NetScaler ADC en NetScaler Gateway vanwege twee kritieke kwetsbaarheden, CVE-2026-88771 en CVE-2026-88772, die momenteel actief worden uitgebuit. Beide kwetsbaa...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwjblzg2jz2p"}, {"timestamp": "2026-09-27T17:11:09.500Z", "date_only": false, "value": "2026-09-27T17:11:09.500649Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjc6lkxem2k", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "113b3d18-d054-42af-861d-6796c11c9c25", "content": "\ud83e\udd16 Citrix NetScaler: 2 RCE zero-days exploited pre-patch, CVSS 9.5 each. CVE-2026-88771 hits every deployment (unauth cmd exec); CVE-2026-88772 via DTLS, default on VPN vservers. Fixed: 14.1-73.37 / 13.1-64.23.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjc6lkxem2k"}, {"timestamp": "2026-09-27T17:16:56Z", "date_only": false, "value": "2026-09-27T17:16:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-H5XM-PF48-4C32", "record": "GHSA-H5XM-PF48-4C32", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-27T17:16:56.390Z", "date_only": false, "value": "2026-09-27T17:16:56.390", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88772", "record": "FKIE_CVE-2026-88772", "field": "published"}, {"timestamp": "2026-09-27T17:25:16.170Z", "date_only": false, "value": "2026-09-27T17:25:16.170532Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "43d1d354-622b-490d-a9d6-97c0a54dfed8", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624"}, {"timestamp": "2026-09-27T17:34:41Z", "date_only": false, "value": "2026-09-27T17:34:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7672be8a-322a-4a3d-b7ec-9e5bae0b10f3", "content": "Citrix ha rilasciato aggiornamenti di sicurezza per ADC e Gateway, prodotti NetScaler dedicati alla distribuzione, gestione e accesso sicuro ad applicazioni e servizi, che sanano 8 vulnerabilit\u00e0, di cui 3 con gravit\u00e0 \"critica\" e 5 con gravit\u00e0 \"alta\". Tra queste si evidenziano le vulnerabilit\u00e0 identificate tramite CVE-2026-88771 e CVE-2026-88772, per le quali Citrix ha osservato lo sfruttamento su sistemi NetScaler non aggiornati.", "url": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler"}, {"timestamp": "2026-09-27T18:00:00Z", "date_only": false, "value": "2026-09-27T18:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ddf92871-7785-4d01-b8f1-cb489ac413b9", "url": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928"}, {"timestamp": "2026-09-27T18:07:14.377Z", "date_only": false, "value": "2026-09-27T18:07:14.377015Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfcuplch2i", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "25a9e822-0727-4448-a76b-8ad124a06e4f", "content": "\ud83d\udea8 CVE-2026-88772 \u2014 CVSS 9.5 CRITICAL\n\nVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88772\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfcuplch2i"}, {"timestamp": "2026-09-27T18:10:06.937Z", "date_only": false, "value": "2026-09-27T18:10:06.937026Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfhzd6gk24", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "43b9f4f0-75ce-44d9-9536-d611f374305e", "content": "CVE-2026-88772 - adc\nVersions of Citrix NetScaler ADC and NetScaler Gateway released before the latest updates can be tricked into running unwanted code or stopping service. This could let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#adc #citrixnetscaler #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfhzd6gk24"}, {"timestamp": "2026-09-27T18:29:26.796Z", "date_only": false, "value": "2026-09-27T18:29:26.796640Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgklj4fy2i", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0c25b550-ad80-45f3-8b59-547c9ca5d150", "content": "CVE-2026-88772 is trending. Hype score 26, currently #2 on cvemon.\n\nVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88772", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgklj4fy2i"}, {"timestamp": "2026-09-27T18:30:22Z", "date_only": false, "value": "2026-09-27T18:30:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-H5XM-PF48-4C32", "record": "GHSA-H5XM-PF48-4C32", "field": "published"}, {"timestamp": "2026-09-27T19:36:49.638Z", "date_only": false, "value": "2026-09-27T19:36:49.638126Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117343817673361515", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b10f1cb2-a4b6-4fd2-b178-01b8cf15a317", "content": "Citrix NetScaler zero-days\n\nExploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.\nThis is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart \nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n#citrix #netscaler #zeroday #cve", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117343817673361515"}, {"timestamp": "2026-09-27T19:37:04.606Z", "date_only": false, "value": "2026-09-27T19:37:04.606822Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/116797276219291526/statuses/117343904630365522", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "98cc9bf1-e49f-41af-b244-e3b765123761", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow\nhttps://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social", "url": "https://infosec.exchange/ap/users/116797276219291526/statuses/117343904630365522"}, {"timestamp": "2026-09-27T19:37:30.825Z", "date_only": false, "value": "2026-09-27T19:37:30.825903Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cloud/statuses/117344112149380671", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "fb00747f-9f06-4fce-bc16-e81c825427fa", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: two RCE zero-days exploited in the wild before any fix, CVSS v4 9.5 each. CVE-2026-88771 hit every deployment (unauth command execution); CVE-2026-88772 needs DTLS, on by default for VPN vservers. Fixed in 14.1-73.37 / 13.1-64.23.\ud83d\udd17 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html#CVE #Exploit #NetScaler #CyberSec", "url": "https://infosec.exchange/users/cloud/statuses/117344112149380671"}, {"timestamp": "2026-09-27T19:38:01.962Z", "date_only": false, "value": "2026-09-27T19:38:01.962955Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117064736050780246/statuses/117344423181886454", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "2a1078c9-c890-4ff7-aeff-0dd0dcc4b39b", "content": "Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement\nhttps://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach", "url": "https://infosec.exchange/ap/users/117064736050780246/statuses/117344423181886454"}, {"timestamp": "2026-09-27T19:45:23.550Z", "date_only": false, "value": "2026-09-27T19:45:23.550364Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwjksevdsq2p", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ff78b29f-092c-4201-9acd-4ebf227c0564", "content": "Citrix confirms active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, enabling remote code execution and denial of service. #Citrix #NetScaler #RCE", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwjksevdsq2p"}, {"timestamp": "2026-09-27T19:58:06.196Z", "date_only": false, "value": "2026-09-27T19:58:06.196480Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/zackwhittaker.com/post/3mwjlj2oots27", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "cad07691-265d-4e66-94e5-6c278a6be450", "content": "CISA has confirmed two bugs in Citrix NetScaler are being exploited in active cyberattacks, CVE-2026-88771 and CVE-2026-88772, in a rare weekend drop of security news. www.cisa.gov/known-exploi...\n\nCitrix has a support base article, confirming exploitation. support.citrix.com/support-home...", "url": "https://bsky.app/profile/zackwhittaker.com/post/3mwjlj2oots27"}, {"timestamp": "2026-09-27T20:01:14.936Z", "date_only": false, "value": "2026-09-27T20:01:14.936675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlopz7wo2b", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "11068e7d-a32b-4d67-a75a-23b94cef7247", "content": "~Certeu~\nCitrix confirms active exploitation of two unauthenticated NetScaler RCEs; patch immediately and assess internet-facing appliances.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwjlopz7wo2b"}, {"timestamp": "2026-09-27T20:02:35.675Z", "date_only": false, "value": "2026-09-27T20:02:35.675315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlr55n5d2g", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c4d08368-005d-498f-9d77-0ea2ec9ebdd9", "content": "~Cisa~\nCISA reports active exploitation of two Citrix NetScaler vulnerabilities and urges rapid remediation.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwjlr55n5d2g"}, {"timestamp": "2026-09-27T20:03:54.625Z", "date_only": false, "value": "2026-09-27T20:03:54.625688Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlthkufc2e", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e7073f25-0686-472d-b2f3-a53e396c9acb", "content": "~Cybergcca~\nActive exploitation of NetScaler flaws enables remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #CyberSecurity #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwjlthkufc2e"}, {"timestamp": "2026-09-27T20:39:32.575Z", "date_only": false, "value": "2026-09-27T20:39:32.575266Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwjnt7hfzn25", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "fbf95cd5-2143-4b49-8ded-9e23af3a22a9", "content": "AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway \u2013 CVE-2026-88771 and CVE-2026-88772", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwjnt7hfzn25"}, {"timestamp": "2026-09-27T21:00:00Z", "date_only": false, "value": "2026-09-27T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "33e78a29-aa34-4a3f-bd61-f1f8e98b018e", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083"}, {"timestamp": "2026-09-27T21:06:55Z", "date_only": false, "value": "2026-09-27T21:06:55.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/GithubRedTeam/103584", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c62025a3-e512-4235-8a29-eaf27a828090", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88772\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 21:06:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103584"}, {"timestamp": "2026-09-27T21:23:15.267Z", "date_only": false, "value": "2026-09-27T21:23:15.267872Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwjqbeup6i2k", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "25aff03a-e00c-4051-9761-08b2301dfbc3", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88772: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, b\u2026\nCVSS 9.5 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-88772\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mwjqbeup6i2k"}, {"timestamp": "2026-09-27T21:57:34.718Z", "date_only": false, "value": "2026-09-27T21:57:34.718026Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6q65g32l", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e1f359ea-b17b-4155-9585-243c75edf0c2", "content": "\ud83d\uded1 CVE-2026-88772\nCitrix NetScaler\nCVSS 9.5 / KEV: No\nTL;DR: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 1\u2026\nhttps://cvesentinel.com/report/CVE-2026-88772?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6q65g32l"}, {"timestamp": "2026-09-27T22:00:01Z", "date_only": false, "value": "2026-09-27T22:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-88772", "field": "timestamps.recorded_at", "uuid": "25ce362a-a184-4ea6-83c7-64bb2a2242a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T22:00:02.520Z", "date_only": false, "value": "2026-09-27T22:00:02.520287Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25ce362a-a184-4ea6-83c7-64bb2a2242a3", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0fe93264-4990-4f0d-b5b0-79aef737fe8d", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25ce362a-a184-4ea6-83c7-64bb2a2242a3"}, {"timestamp": "2026-09-27T23:00:16Z", "date_only": false, "value": "2026-09-27T23:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8MEljeuzrAecwW2JZuMlZ_8lhVdmg06Hvcm7mYkrERJsk-Q", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d4a05281-1235-4f16-bc35-9db856c34026"}, {"timestamp": "2026-09-27T23:00:16Z", "date_only": false, "value": "2026-09-27T23:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8MEljeuzrAecwW2JZuMlZ_8lhVdmg06Hvcm7mYkrERJsk-Q", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "49574cdc-9ef6-43f6-8a28-5ad2a5a11fad"}, {"timestamp": "2026-09-27T23:00:31Z", "date_only": false, "value": "2026-09-27T23:00:31.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44631", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a886ab4c-709e-4070-b7fd-0bd5e7711a40", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "url": "https://t.me/VulnerabilityNews/44631"}, {"timestamp": "2026-09-27T23:00:38Z", "date_only": false, "value": "2026-09-27T23:00:38.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44635", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "160b7eb5-9877-422c-9757-81986047d995", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability\nCVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/44635"}, {"timestamp": "2026-09-27T23:00:40Z", "date_only": false, "value": "2026-09-27T23:00:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44636", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7938bc4b-f8c7-4e2c-ad24-50b1513f31b4", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "url": "https://t.me/VulnerabilityNews/44636"}, {"timestamp": "2026-09-27T23:03:26.982Z", "date_only": false, "value": "2026-09-27T23:03:26.982064Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "127abcbd-f200-4b65-9512-7b78cc19fdba", "content": "Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.\n\nwww.deyda.net/index.php/en...\n\n#DeydaConsulting #NetScaler #Citrix", "url": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w"}, {"timestamp": "2026-09-27T23:16:13.679Z", "date_only": false, "value": "2026-09-27T23:16:13.679672Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "02f4897b-6568-413e-940d-7315df121422", "content": "Emergency Citrix Patch and the $2.2M Vendor Liability Lesson\n\nFirst, Citrix has confirmed that two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and NetScaler Gateway are being actively exploited by attackers.\n\nhttps://youtu.be/ean43KG9b1g", "url": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l"}, {"timestamp": "2026-09-27T23:46:55.681Z", "date_only": false, "value": "2026-09-27T23:46:55.681356Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mwjycask222o", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "24eca138-b129-4c85-9853-9c2a6c98b3d9", "content": "CISA added Citrix NetScaler flaw CVE-2026-88772 to its Known Exploited Vulnerabilities catalog.\n\n\u2022 Memory buffer bug in NetScaler ADC and Gateway, RCE or DoS\n\nhttps://thecircuitry.to/article/cisa-adds-citrix-netscaler-cve-2026-88772-to-kev-catalog-mukcx3d4", "url": "https://bsky.app/profile/thecircuitry.to/post/3mwjycask222o"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "last_revision_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "initial_release_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "initial_release_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-28T00:56:58Z", "date_only": false, "value": "2026-09-28T00:56:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "f611824b-5407-4497-9567-58be797badfb", "url": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway"}, {"timestamp": "2026-09-28T01:53:55Z", "date_only": false, "value": "2026-09-28T01:53:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "052892bd-af18-4863-9a16-5cc21fac2840", "url": "https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited"}, {"timestamp": "2026-09-28T03:24:17.900Z", "date_only": false, "value": "2026-09-28T03:24:17.900852Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "aa53e811-fe14-4839-83e0-d2f04fffb281", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 27\uff09\n\nCVE-2026-88771 Citrix NetScaler \u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\nCVE-2026-88772 Citrix NetScaler\u306b\u304a\u3051\u308b\u30e1\u30e2\u30ea\u30d0\u30c3\u30d5\u30a1\u306e\u7bc4\u56f2\u5185\u3067\u306e\u64cd\u4f5c\u306e\u4e0d\u9069\u5207\u306a\u5236\u9650\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v"}, {"timestamp": "2026-09-28T03:55:42.777Z", "date_only": false, "value": "2026-09-28T03:55:42.777Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-88772", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-28T03:55:42.777Z", "date_only": false, "value": "2026-09-28T03:55:42.777Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88772", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-28T04:04:23.148Z", "date_only": false, "value": "2026-09-28T04:04:23.148825Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "2e809211-b521-4b27-85eb-d6e3a7989217", "content": "~Cisa~\nThreat actors are globally exploiting two critical NetScaler zero-days enabling remote code execution.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26"}, {"timestamp": "2026-09-28T05:00:00Z", "date_only": false, "value": "2026-09-28T05:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9c579e22-75de-4f01-a494-cc044824c2e2", "url": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway"}, {"timestamp": "2026-09-28T05:16:20Z", "date_only": false, "value": "2026-09-28T05:16:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "735643e8-c41a-4dcd-bbdc-a0418f9fbd52", "url": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965"}, {"timestamp": "2026-09-28T05:29:51Z", "date_only": false, "value": "2026-09-28T05:29:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "efb59cc6-0246-4b29-83f4-7e952718c219", "content": "Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\n\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.", "url": "https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/"}, {"timestamp": "2026-09-28T06:09:32.450Z", "date_only": false, "value": "2026-09-28T06:09:32.450733Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwknogr2dp2q", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "92953b61-d63e-418f-9f3b-8a12863161de", "content": "Analysis: CVE-2026-88771 and CVE-2026-88772", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwknogr2dp2q"}, {"timestamp": "2026-09-28T06:30:53.481Z", "date_only": false, "value": "2026-09-28T06:30:53.481216Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwkoumrpz52v", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "153d5433-1da4-4861-b527-00c6c7ebe260", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-88772: \u26a0\ufe0f CVE-2026-88772: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-88772-vulnerability-in-citrix-netscaler-adc-and", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwkoumrpz52v"}, {"timestamp": "2026-09-28T07:00:08.094Z", "date_only": false, "value": "2026-09-28T07:00:08.094013Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwkqivpzaq27", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "df2acdf2-94b3-4614-af40-e3ed21acd90c", "content": "\ud83d\udce2 \u26a0\ufe0f [VULN] Citrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es CVE-2026-88771 CVE-2026-88772\n\nCitrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es. Les entreprises doivent v\u00e9rifier les versions et rechercher une possible intrusion sur leurs \u00e9quipements.\n\n#CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwkqivpzaq27"}, {"timestamp": "2026-09-28T07:00:12.799Z", "date_only": false, "value": "2026-09-28T07:00:12.799747Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/index.fomoera.com.ap.brid.gy/post/3mwkqivzj67n2", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "aa0cbc0c-883f-4922-97b0-1a9290336be1", "content": "Citrix liber\u00f3 el 27 de septiembre parches para CVE-2026-88771 y CVE-2026-88772, dos fallas cr\u00edticas de NetScaler ADC y Gateway que ya se explotaban. Los equipos actualizados en agosto siguen expuestos y CISA pide revisar antes de parchar.", "url": "https://bsky.app/profile/index.fomoera.com.ap.brid.gy/post/3mwkqivzj67n2"}, {"timestamp": "2026-09-28T07:24:56Z", "date_only": false, "value": "2026-09-28T07:24:56.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10176", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "82395842-9fd7-41dc-82c2-d53a3941b01e", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "url": "https://t.me/thehackernews/10176"}, {"timestamp": "2026-09-28T07:24:56Z", "date_only": false, "value": "2026-09-28T07:24:56.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10176", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a3dcd0c8-6f82-42f2-a42b-e0cb8736c74f", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "url": "https://t.me/thehackernews/10176"}, {"timestamp": "2026-09-28T07:28:47.376Z", "date_only": false, "value": "2026-09-28T07:28:47.376486Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwks45oiwt2n", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c2568598-1899-4c5d-ab1a-d661415d7160", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: CVE-2026-88771 + CVE-2026-88772 (unauth RCE) exploited in the wild. One hits default configs, the other needs DTLS. CISA KEV, FCEB deadline Sep 30.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwks45oiwt2n"}, {"timestamp": "2026-09-28T07:32:35.923Z", "date_only": false, "value": "2026-09-28T07:32:35.923452Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d827a853-8b07-4ba7-914f-847b1d95bdd7", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24"}, {"timestamp": "2026-09-28T07:45:12.765Z", "date_only": false, "value": "2026-09-28T07:45:12.765807Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwkszjefso2c", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "634f3259-f070-460c-940b-8dafcf82011e", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwkszjefso2c"}, {"timestamp": "2026-09-28T07:45:24.793Z", "date_only": false, "value": "2026-09-28T07:45:24.793341Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwkszv2vxu2m", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d6269b7c-02b4-434f-b174-6625a078e5b3", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwkszv2vxu2m"}, {"timestamp": "2026-09-28T07:45:41.613Z", "date_only": false, "value": "2026-09-28T07:45:41.613277Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwkt2ezry22y", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b0dea50e-5499-445a-ba98-9f0f57f0065f", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwkt2ezry22y"}, {"timestamp": "2026-09-28T07:57:08.315Z", "date_only": false, "value": "2026-09-28T07:57:08.315111Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwktos6gfcfa", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d13fe333-92e1-41aa-9c20-597a4dff67d0", "content": "NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a42\u4ef6\u3001\u653b\u6483\u3067\u306e\u60aa\u7528\u3092Citrix\u304c\u78ba\u8a8d\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47848/", "url": "https://bsky.app/profile/shiojiri.com/post/3mwktos6gfcfa"}, {"timestamp": "2026-09-28T08:29:59.116Z", "date_only": false, "value": "2026-09-28T08:29:59.116419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mwkvjiucu22y", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e824a817-58e9-49c9-b695-c445c0bb06aa", "content": "CVE-2026-88771 & CVE-2026-88772 (CVSS 9.5, CISA KEV): two Citrix NetScaler RCE zero-days exploited before a patch existed. 88771 hits default configs unauthenticated. Upgrade to 14.1-73.37 / 13.1-64.23. Query: (product~\"Citrix NetScaler\") and last_seen>-7D", "url": "https://bsky.app/profile/modat-io.bsky.social/post/3mwkvjiucu22y"}, {"timestamp": "2026-09-28T08:45:05.876Z", "date_only": false, "value": "2026-09-28T08:45:05.876898Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "8f3aff75-32ea-4b59-8469-1d1e1ee95f43", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d"}, {"timestamp": "2026-09-28T09:00:04Z", "date_only": false, "value": "2026-09-28T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/yXVzrAnyMVzUsfnjfkALrfBcKxKGxOpo3xtfae2jh7WYEoo", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "51573e48-a71f-4ff3-9bb8-c1c07ae4eb9d"}, {"timestamp": "2026-09-28T09:00:04Z", "date_only": false, "value": "2026-09-28T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/yXVzrAnyMVzUsfnjfkALrfBcKxKGxOpo3xtfae2jh7WYEoo", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "66e6db6e-d164-4a64-a9f6-c4eab8d3c504"}, {"timestamp": "2026-09-28T09:00:21.790Z", "date_only": false, "value": "2026-09-28T09:00:21.790250Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mwkx7v3rjp2q", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "13abc953-aad3-4333-9e42-bff4df24cf47", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/cert-fr.bsky.social/post/3mwkx7v3rjp2q"}, {"timestamp": "2026-09-28T09:00:23.247Z", "date_only": false, "value": "2026-09-28T09:00:23.247265Z", "kind": "sighting", "label": "Seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117347845378892968", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "59a22584-68a4-433a-b116-dd6f605c3dd8", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0fLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "url": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117347845378892968"}, {"timestamp": "2026-09-28T10:00:02Z", "date_only": false, "value": "2026-09-28T10:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "enisa-cnw-kev", "record": "CVE-2026-88772", "field": "timestamps.recorded_at", "uuid": "c6e5d3ee-94a3-487c-a2cd-d7dc4e78ca7e", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:00:03.060Z", "date_only": false, "value": "2026-09-28T10:00:03.060227Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c6e5d3ee-94a3-487c-a2cd-d7dc4e78ca7e", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "8cbd306a-ab27-4e1c-838e-a199fb44638f", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c6e5d3ee-94a3-487c-a2cd-d7dc4e78ca7e"}, {"timestamp": "2026-09-28T10:00:08Z", "date_only": false, "value": "2026-09-28T10:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103627", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "08766759-354d-4855-8b5c-361fdcfa506f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88772-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FollowerSeize\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 09:58:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103627"}, {"timestamp": "2026-09-28T10:04:18.366Z", "date_only": false, "value": "2026-09-28T10:04:18.366891Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwl2s6tm5k27", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "38b4fbea-2dc5-477b-974d-e49b656b46fb", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/28/c...\n\n#cybersecurity #cybersecuritynews #0day #exploit #vulnerability @ncsc-nl.bsky.social @doublepulsar.com @satn.am @tenablesecurity.bsky.social", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mwl2s6tm5k27"}, {"timestamp": "2026-09-28T10:22:26Z", "date_only": false, "value": "2026-09-28T10:22:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/55987", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3ec24177-6a05-464d-b83b-00160e241318", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug (https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55987"}, {"timestamp": "2026-09-28T10:37:25Z", "date_only": false, "value": "2026-09-28T10:37:25+00:00", "kind": "kev", "label": "Asserted", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88772", "field": "timestamps.asserted_at", "uuid": "ad7ee50f-9ff2-40ee-8508-6cfe3f274745", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:37:25Z", "date_only": false, "value": "2026-09-28T10:37:25+00:00", "kind": "kev", "label": "First seen", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88772", "field": "timestamps.first_seen_at", "uuid": "ad7ee50f-9ff2-40ee-8508-6cfe3f274745", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:37:25Z", "date_only": false, "value": "2026-09-28T10:37:25+00:00", "kind": "kev", "label": "Last seen", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88772", "field": "timestamps.last_seen_at", "uuid": "ad7ee50f-9ff2-40ee-8508-6cfe3f274745", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:37:25Z", "date_only": false, "value": "2026-09-28T10:37:25+00:00", "kind": "kev", "label": "Status updated", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88772", "field": "status.status_updated_at", "uuid": "ad7ee50f-9ff2-40ee-8508-6cfe3f274745", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:37:38.015Z", "date_only": false, "value": "2026-09-28T10:37:38.015919Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ad7ee50f-9ff2-40ee-8508-6cfe3f274745", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "5c74fd28-1695-4170-bd60-8ae9e22ff9fa", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ad7ee50f-9ff2-40ee-8508-6cfe3f274745"}, {"timestamp": "2026-09-28T10:44:05.374Z", "date_only": false, "value": "2026-09-28T10:44:05.374380Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwl4zcq2vc2n", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a59e0548-7bb9-4aaa-8235-b6900ace8777", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nwww.helpnetsecurity.com/2026/09/28/c...\n\n#Cybersecurity #Cyber #SituationalAwareness", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mwl4zcq2vc2n"}, {"timestamp": "2026-09-28T11:00:13Z", "date_only": false, "value": "2026-09-28T11:00:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/86UKc-a8dyoVcD7Y4niyS9OxM-BpnvAATArPBShCYu67BME", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b4fc1393-b8f9-4e67-95bf-13d4feb56fd2"}, {"timestamp": "2026-09-28T11:00:13Z", "date_only": false, "value": "2026-09-28T11:00:13.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/86UKc-a8dyoVcD7Y4niyS9OxM-BpnvAATArPBShCYu67BME", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a6aa68a6-1064-41df-ba8b-34a9995726c2"}, {"timestamp": "2026-09-28T11:24:41.994Z", "date_only": false, "value": "2026-09-28T11:24:41.994131Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0796b8eb-7254-44af-8c9e-ccfcbc7d0498", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r"}, {"timestamp": "2026-09-28T12:15:14.661Z", "date_only": false, "value": "2026-09-28T12:15:14.661688Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwlc4dywdh2k", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "14ff878c-9bad-4e2f-af5a-17651eb08fb5", "content": "NetScaler ADC and Gateway patched for two zero-days: CVE-2026-88771 and CVE-2026-88772. CISA has ordered federal\u2026 https://0daynews.com/articles/2026-09-28-citrix-netscaler-patches-cve-2026-88771-cve-2026-88772/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3799", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mwlc4dywdh2k"}, {"timestamp": "2026-09-28T12:20:28.341Z", "date_only": false, "value": "2026-09-28T12:20:28.341631Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwlccmt4btzo", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c7f4799d-a891-47c0-ad8c-7e47eeb93349", "content": "Citrix reports active exploitation of two critical NetScaler flaws: CVE-2026-88771 and CVE-2026-88772. Update affected customer-managed systems; CERT-EU urges compromise checks for exposed appliances.", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwlccmt4btzo"}, {"timestamp": "2026-09-28T12:26:47.670Z", "date_only": false, "value": "2026-09-28T12:26:47.670", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88772", "record": "FKIE_CVE-2026-88772", "field": "lastModified"}, {"timestamp": "2026-09-28T12:31:03Z", "date_only": false, "value": "2026-09-28T12:31:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-H5XM-PF48-4C32", "record": "GHSA-H5XM-PF48-4C32", "field": "modified"}, {"timestamp": "2026-09-28T13:02:04Z", "date_only": false, "value": "2026-09-28T13:02:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "489c2e94-6303-46b3-a9e7-36b42cc13eed", "content": "Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. \n\nThe post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild appeared first on Unit 42.", "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/"}, {"timestamp": "2026-09-28T13:05:07.250Z", "date_only": false, "value": "2026-09-28T13:05:07.250243Z", "kind": "sighting", "label": "Seen", "source": "https://social.bund.de/users/bsi/statuses/117348804174042056", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "994dae72-f00b-40b7-83cb-b75193ac3e23", "content": "\u26a0\ufe0f \ud83d\udce2 Sicherheitswarnung: Am 27. September 2026 ver\u00f6ffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitsl\u00fccken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte \u00fcber eine aktive Ausnutzung verbreitet hatten.\nMehr dazu hier: https://www.bsi.bund.de/dok/1209522", "url": "https://social.bund.de/users/bsi/statuses/117348804174042056"}, {"timestamp": "2026-09-28T13:24:41.115Z", "date_only": false, "value": "2026-09-28T13:24:41.115767Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117348616624288037", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "08ebe92a-bdbe-4c8e-83c4-a291a1b4a624", "content": "CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway\n#CISA #KEV #Citrix #zeroday #CVE", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117348616624288037"}, {"timestamp": "2026-09-28T13:25:44.340Z", "date_only": false, "value": "2026-09-28T13:25:44.340434Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwlg27rcss25", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c782fcce-751e-4671-951b-d41a62192786", "content": "Citrix says two critical NetScaler vulnerabilities are being actively exploited.\n\nCVE-2026-88771 enables unauthenticated RCE across all deployments.\n\nCVE-2026-88772 can lead to RCE or DoS where DTLS is enabled.\n\ncyberupdates365.com/citrix-netsc...\n\n#Cybersecurity #Citrix #NetScaler", "url": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwlg27rcss25"}, {"timestamp": "2026-09-28T14:20:50Z", "date_only": false, "value": "2026-09-28T14:20:50.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberok_news/256", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d15e7c15-c068-4ad2-b6c1-23f0b5b29527", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Citrix NetScaler ADC \u0438 Gateway: CVE-2026-88771\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 (RCE) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u0435\u0441\u0441\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2026-88771 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430. Payload \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438 NetScaler, \u043e\u0442\u043a\u0443\u0434\u0430 \u0435\u0433\u043e \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 Perl-\u0441\u043a\u0440\u0438\u043f\u0442 ns_monuploadd_err.pl, \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 shell \u0431\u0435\u0437 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u0435\u043a\u0442\u043e\u0440 \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u043e\u0434\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u043c: User-Agent \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u043b\u044f, \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433\u0438, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u0423\u044f\u0437\u0432\u0438\u043c \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u26a1\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 26.09.2026 \u2014 watchTowr \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\u2022 27.09.2026 \u2014 Citrix \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-88771 \u0438 CVE-2026-88772 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 30.09.2026.\n\u2022 28.09.2026 \u2014 watchTowr \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC \u0438 Detection Artifact Generator, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u2014 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0435.\n\n\ud83d\udd3aCVSS v4.0: 9.5 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udccb \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\u2022 \u041f\u043e\u043c\u0438\u043c\u043e CVE-2026-88771, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0434\u043b\u044f CVE-2026-88772 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 DTLS, RCE/DoS, CVSS 9.5). \n\u2022 \u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u2014 CVE-2026-88773 (HTTP request smuggling, 9.3) \u0438 CVE-2026-88774 \u2014 88778 (memory overflow, predictable values, 7.0\u20138.8) \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c, \u0432\u0441\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0442 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439. \n\u2022 \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e: CVE-2026-88778 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c Enhanced ISN Generation.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 NetScaler ADC \u0438 Gateway 14.1 \u0434\u043e 14.1-73.37.\n\u2022 NetScaler ADC \u0438 Gateway 13.1 \u0434\u043e 13.1-64.23.\n\u2022 NetScaler ADC FIPS \u0434\u043e 14.1-73.37 FIPS.\n- NetScaler ADC FIPS \u0438 NDcPP \u0434\u043e 13.1-37.279.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u043c, \u0438 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0435 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Secure Private Access. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b Citrix \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u0414\u043b\u044f CVE-2026-88771 workaround \u043d\u0435\u0442. \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2026, \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n2. \u0414\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0430\u043c\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043b\u043e\u0433\u0438: \u043f\u0430\u0442\u0447 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0441\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043f\u0430\u0442\u0442\u0435\u0440\u043d pitboss PPE unexpectedly died NSPPE \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438.\n\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e IoC \u0447\u0435\u0440\u0435\u0437 Security Advisory \u0432 NetScaler Console.\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441\u0435\u0441\u0441\u0438\u0439 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.\n\n\ud83d\udd17 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 watchTowr + PoC \n\ud83d\udd17 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c Citrix CTX697096\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-88771 \u0432 NVD \n\ud83d\udd17 FAQ watchTowr", "url": "https://t.me/cyberok_news/256"}, {"timestamp": "2026-09-28T14:57:30.075Z", "date_only": false, "value": "2026-09-28T14:57:30.075760Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/inferlume.bsky.social/post/3mwll6cqkss25", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7c27129c-92ef-4f93-831a-ee6b9b844e59", "content": "Unpatched Citrix NetScaler gateways face active zero-day RCE exploitation under CVE-2026-88771 and CVE-2026-88772, triggering emergency CISA KEV deadlines while ShinyHunters and cloud wipers breach perimeters.\n\nFull Report: inferlume.com/reports/dail...\n\n#NetScaler #ZeroDay #ThreatIntel #CISA #SOC", "url": "https://bsky.app/profile/inferlume.bsky.social/post/3mwll6cqkss25"}, {"timestamp": "2026-09-28T15:00:07Z", "date_only": false, "value": "2026-09-28T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "72202243-da17-4661-8bb5-02647b776454"}, {"timestamp": "2026-09-28T15:00:07Z", "date_only": false, "value": "2026-09-28T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7cc080fc-7a84-4c39-976e-5366d86edb15"}, {"timestamp": "2026-09-28T15:13:53.920Z", "date_only": false, "value": "2026-09-28T15:13:53.920861Z", "kind": "sighting", "label": "Seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117349313638958333", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "cb41302d-97a6-4929-bda2-68c5d14d8aad", "content": "There's various proof of concepts doing the rounds on Github for the new Citrix vulns.  All the ones I've seen so far are fake AI slop.  \nE.g. this one is AI generated, it's not a PoC, it doesn't exploit, the fingerprint method it uses doesn't exist and as a checker it doesn't actually work either.\nhttps://github.com/murrez/CVE-2026-88772", "url": "https://cyberplace.social/users/GossiTheDog/statuses/117349313638958333"}, {"timestamp": "2026-09-28T15:38:19.125Z", "date_only": false, "value": "2026-09-28T15:38:19.125958Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ian-bishop.bsky.social/post/3mwlnhgxwd22j", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "dd3bf312-a5cc-4f6d-a29f-f9990316b2ce", "content": "Citrix just confirmed two critical NetScaler RCE zero-days (CVE-2026-88771 & CVE-2026-88772) are being exploited in the wild. CISA added them to KEV with a Sept 30 deadline for feds. If you run NetScaler ADC/Gateway \u2014 patch to 14.1-73.37 / 13.1-64.23 now.\nsecnewsheadlines.com/p/citrix-net...", "url": "https://bsky.app/profile/ian-bishop.bsky.social/post/3mwlnhgxwd22j"}, {"timestamp": "2026-09-28T16:07:09.566Z", "date_only": false, "value": "2026-09-28T16:07:09.566710Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwlp32wvzz2z", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "8928594d-c9ee-477d-bd90-18cbaa65b2ea", "content": "~Cybergcca~\nCISA added two Citrix NetScaler CVEs to KEV; apply updates.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwlp32wvzz2z"}, {"timestamp": "2026-09-28T17:00:01Z", "date_only": false, "value": "2026-09-28T17:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-88772", "field": "timestamps.recorded_at", "uuid": "fb84583a-1292-444b-a5af-e431e11e44e6", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T17:00:55.080Z", "date_only": false, "value": "2026-09-28T17:00:55.080439Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fb84583a-1292-444b-a5af-e431e11e44e6", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "bcd0aa37-7ade-4f65-bb40-943907bca18c", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fb84583a-1292-444b-a5af-e431e11e44e6"}, {"timestamp": "2026-09-28T17:09:25.413Z", "date_only": false, "value": "2026-09-28T17:09:25.413045Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwlskfdoo72n", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "eeb67a08-3f05-40a7-a629-239dc6d22d6e", "content": "CVE-2026-88771 and CVE-2026-88772: Critical Citrix NetScaler Zero\n\nThis article heavily emphasizes that exploitation is confirmed but downplays the lack of specific Indicators of Compromise, suggesting organizations should trust broad advisories over granular threat intelligence. If established \u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mwlskfdoo72n"}, {"timestamp": "2026-09-28T17:11:17.098Z", "date_only": false, "value": "2026-09-28T17:11:17.098388Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mwlsnpsdvz2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b1b5c0e2-5110-4cb7-aabb-92a372a68374", "content": "Citrix nouzov\u011b opravil NetScaler ADC a Gateway po potvrzen\u00ed aktivn\u00edho zneu\u017e\u00edv\u00e1n\u00ed chyb CVE-2026-88771 a CVE-2026-88772 (CVSS 9,5), umo\u017e\u0148uj\u00edc\u00edch vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du; doporu\u010duje okam\u017eitou aktualizaci.", "url": "https://bsky.app/profile/365tipu.cz/post/3mwlsnpsdvz2f"}, {"timestamp": "2026-09-28T17:36:44.872Z", "date_only": false, "value": "2026-09-28T17:36:44.872739Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwlu3am7722d", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d5f027a5-d343-4fe2-8322-d041b97db08f", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix t\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwlu3am7722d"}, {"timestamp": "2026-09-28T19:48:57.941Z", "date_only": false, "value": "2026-09-28T19:48:57.941089Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwm3hnzhj62x", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "5440d9c3-59c4-44de-944a-e865f434f549", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-88772 \u2013 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer\u00a0Vulnerability\n\nA high-severity memory buffer vulnerability in Citrix NetScaler is under active exploitation. Review CISA\u2026\n\nhttps://thecybermind.co/41l1", "url": "https://bsky.app/profile/thecybermind.co/post/3mwm3hnzhj62x"}, {"timestamp": "2026-09-28T20:10:57.542Z", "date_only": false, "value": "2026-09-28T20:10:57.542431Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4oyp7q42b", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "81f08ea8-4da9-42d5-b1b9-f534c0208032", "content": "@ncsc.gov.uk\nTwo NetScaler flaws are actively exploited; patch or isolate affected systems.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #Citrix #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwm4oyp7q42b"}, {"timestamp": "2026-09-28T20:14:06.186Z", "date_only": false, "value": "2026-09-28T20:14:06.186146Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4un63mx2b", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "175aaf0f-05f8-4aa9-861a-d21974a28793", "content": "@sophossecurity.bsky.social\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwm4un63mx2b"}, {"timestamp": "2026-09-28T20:30:06.849Z", "date_only": false, "value": "2026-09-28T20:30:06.849582Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "101762e2-f7f6-4069-a536-422b45b437f0", "content": "\ud83d\udce2 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploit\u00e9s activement\n\n\ud83d\udd0d Vuln\u00e9rabilit\u00e9s identifi\u00e9es Citrix a publi\u00e9 le bulletin de s\u00e9curit\u00e9 CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#NetScaler #ZeroDay #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24"}, {"timestamp": "2026-09-28T21:00:04Z", "date_only": false, "value": "2026-09-28T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ea6015d1-d8fe-43b4-932e-1b1fa51869dc"}, {"timestamp": "2026-09-28T21:00:04Z", "date_only": false, "value": "2026-09-28T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "412a43a4-9063-4479-adca-f5c1a8f34a5e"}, {"timestamp": "2026-09-28T22:34:30.209Z", "date_only": false, "value": "2026-09-28T22:34:30.209395Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "2f221caf-9d52-43ed-b8d3-b6bf3703cba1", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207"}, {"timestamp": "2026-09-28T22:34:45.752Z", "date_only": false, "value": "2026-09-28T22:34:45.752833Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3aefa18e-6bb7-4433-9f97-edab626fa80c", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x"}, {"timestamp": "2026-09-28T23:00:57Z", "date_only": false, "value": "2026-09-28T23:00:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/44657", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d14b94ba-8e81-44d8-a5de-e2bde46bc944", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "url": "https://t.me/VulnerabilityNews/44657"}, {"timestamp": "2026-09-28T23:44:28.571Z", "date_only": false, "value": "2026-09-28T23:44:28.571205Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwmimqtog22y", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e240caae-d61d-4a53-876f-3f5196eeaa2e", "content": "Citrix NetScaler\u306eCritical \u8106\u5f31\u6027 2\u4ef6\u304c\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306b\u60aa\u7528\u3000CVE-2026-88771\u30fbCVE-2026-88772\u3001\u672a\u8a8d\u8a3cRCE\u306e\u6050\u308c \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwmimqtog22y"}, {"timestamp": "2026-09-29T00:54:26.806Z", "date_only": false, "value": "2026-09-29T00:54:26.806839Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmmjwegtr2b", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7547132a-aee4-4031-ba98-250a901b5ca0", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\uff08Citrix NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u4e16\u754c\u898f\u6a21\u3067\u60aa\u7528\uff09 #HelpNetSecurity (Sep 28)\nwww.helpnetsecurity.com/2026/09/28/c...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmmjwegtr2b"}, {"timestamp": "2026-09-29T01:30:32.285Z", "date_only": false, "value": "2026-09-29T01:30:32.285882Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwmokgomny2p", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "bfd37339-5e1d-41b0-a033-3ec8170d0c7b", "content": "Citrix NetScaler-apparaten getroffen door kritieke zero-day kwetsbaarheden met a\n\nCitrix heeft het grootste deel van het weekend de actieve exploitatie van nieuwe zero-day kwetsbaarheden in NetScaler bevestigd. Deze kwetsbaarheden, ge\u00efdentificeerd als CVE-2026-88771 en CVE-2026-88772, hebben...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwmokgomny2p"}, {"timestamp": "2026-09-29T02:25:32Z", "date_only": false, "value": "2026-09-29T02:25:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/node/639", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ac8f081d-1b10-4c9c-8f94-1f89c82e1902", "url": "https://www.cert.dk/node/639"}, {"timestamp": "2026-09-29T02:37:06.815Z", "date_only": false, "value": "2026-09-29T02:37:06.815956Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwmsbj6czi2l", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ccce0a34-7538-41d8-92f5-18e07bc36d85", "content": "\ud83d\udccc CVE-2026-88772 - Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 F... https://www.cyberhub.blog/cves/CVE-2026-88772", "url": "https://bsky.app/profile/cyberhub.blog/post/3mwmsbj6czi2l"}, {"timestamp": "2026-09-29T03:15:29.302Z", "date_only": false, "value": "2026-09-29T03:15:29.302883Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwmug4oohv25", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "bbfc5e97-6170-4b49-914d-c3c98e63e89c", "content": "The latest update for #BitSight includes \"CVE-2026-88771 and CVE-2026-88772: Two Critical Citrix NetScaler Flaws Under Active Exploitation\" and \"Identity Risk: 5 Access Pathways Emerging Across #ThreatIntelligence\".\n \n#Cybersecurity #RiskManagement https://opsmtrs.com/43KoF0t", "url": "https://bsky.app/profile/opsmatters.com/post/3mwmug4oohv25"}, {"timestamp": "2026-09-29T04:23:39.846Z", "date_only": false, "value": "2026-09-29T04:23:39.846419Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwmy7zgrmq23", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "88366df5-4a80-4be7-9922-f89bbddb0f99", "content": "Citrix NetScaler \u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u4e16\u754c\u898f\u6a21\u3067\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\n\nCitrix\u306f\u3001NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u30fb\u9ad8severity\u5ea6\u306e\u8106\u5f31\u60278\u4ef6\u3092\u4fee\u6b63\u3057\u307e\u3057\u305f\u3002\u3046\u30612\u4ef6\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\u306f\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3066\u304a\u308a\u3001\u4fb5\u5bb3\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306bWeb\u30b7\u30a7\u30eb\u304c\u4ed5\u639b\u3051\u3089\u308c\u3066\u3044\u307e\u3057\u305f", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwmy7zgrmq23"}, {"timestamp": "2026-09-29T05:11:10.405Z", "date_only": false, "value": "2026-09-29T05:11:10.405494Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwn2uxsf3k2d", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "1a7529b2-435f-474f-86af-c63506454542", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nCitrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day a\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwn2uxsf3k2d"}, {"timestamp": "2026-09-29T07:11:03Z", "date_only": false, "value": "2026-09-29T07:11:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/440", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "fd7ee6dc-13f6-4cd4-9c0b-1c0327ea2cbe", "content": "Citrix NetScaler PreAuth Command Injection\n\nCVE-2026-88771 Improper input validation leading to RCE in a default NetScaler configuration, with no additional product features required.\n\nBlog:\n   \u2022 https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/\n   \u2022 https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/\n\nSearch Query:\nZoomEye: app=\"Citrix NetScaler\"\nFOFA: app=\"NetScaler-AAA\"", "url": "https://t.me/P0x3k_1N73LL1G3NC3/440"}, {"timestamp": "2026-09-29T07:15:24.940Z", "date_only": false, "value": "2026-09-29T07:15:24.940451Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwnbt4vvtu27", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9895ffb8-771a-4236-8ffd-4a67397fb005", "content": "Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after nearly two days of unofficial warnings. The flaws can enable remote code execution. #Citrix #NetScaler #CISA", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwnbt4vvtu27"}, {"timestamp": "2026-09-29T07:28:07.788Z", "date_only": false, "value": "2026-09-29T07:28:07.788904Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "22afcdd7-d208-4a52-9b70-9c04c018d86d", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 73 interactions\nCVE-2026-88772: 61 interactions\nCVE-2026-87902: 44 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 20 interactions\nCVE-2026-88772: 13 interactions\nCVE-2026-82384: 6 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v"}, {"timestamp": "2026-09-29T07:37:33.011Z", "date_only": false, "value": "2026-09-29T07:37:33.011899Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd2mz43c27", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "77539f0c-2b43-48b5-8a69-cefac5208dd7", "content": "\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u043e\u0446 \u0441\u0435\u0442\u0435\u0439\n\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\n\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd2mz43c27"}, {"timestamp": "2026-09-29T07:38:59.617Z", "date_only": false, "value": "2026-09-29T07:38:59.617666Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd57ao2227", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b2e9b1ef-3d0b-4c1d-b4a4-889112f45aa6", "content": "\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd57ao2227"}, {"timestamp": "2026-09-29T09:32:58.973Z", "date_only": false, "value": "2026-09-29T09:32:58.973000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d2e79cc0-a1c8-44fa-86a3-9ece1ff7f2cd", "url": "https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772"}, {"timestamp": "2026-09-29T10:36:04.390Z", "date_only": false, "value": "2026-09-29T10:36:04.390972Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwnmzvqyd22h", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4f32ef2a-cadb-45ae-9035-7c58d2ce12a5", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) - Help Net Security www.helpnetsecurity.com/2026/09/28/c...", "url": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwnmzvqyd22h"}, {"timestamp": "2026-09-29T11:55:18.127Z", "date_only": false, "value": "2026-09-29T11:55:18.127788Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mwnrhcfxfc2a", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "23b03306-5058-4de6-bc02-a62dd0677563", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited\nin the Wild\nunit42.paloaltonetworks.com/netscaler-ze...", "url": "https://bsky.app/profile/samilaiho.com/post/3mwnrhcfxfc2a"}, {"timestamp": "2026-09-29T13:52:08.530Z", "date_only": false, "value": "2026-09-29T13:52:08.530508Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybergeodigest.bsky.social/post/3mwnxykoll225", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "5fed2398-91ba-46d6-bdc8-7b60765f822f", "content": "Today's CyberGeoDigest \u2014 20 stories\n\nTop: CVE-2026-88772 Zero-Day Hits Citrix NetScaler in Active Government, Finance Campaign\n\n#APT #ThreatIntel #CyberSecurity", "url": "https://bsky.app/profile/cybergeodigest.bsky.social/post/3mwnxykoll225"}, {"timestamp": "2026-09-29T14:00:02.142Z", "date_only": false, "value": "2026-09-29T14:00:02.142302Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mgtech.bsky.social/post/3mwnygoin4g2c", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b7e4a5c6-6b54-49c4-9500-142d8bf2700f", "content": "\ud83d\udea8 BREAKING: CVE-2026-88771 and CVE-2026-88772 are rated critical with 9.5 CVSS scores. CVE-2026-88771 allows remote code execution by unauthenticated attackers.\n\nhttps://www.theregister.com/security/2026/09/28/certainties-in-life-death-taxes-and-critical-citrix-vulns-under-attack/5299369", "url": "https://bsky.app/profile/mgtech.bsky.social/post/3mwnygoin4g2c"}, {"timestamp": "2026-09-29T14:00:35.608Z", "date_only": false, "value": "2026-09-29T14:00:35.608594Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117354688304468536", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "cff24ecd-4949-487f-9590-bb7e915ed02f", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117354688304468536"}, {"timestamp": "2026-09-29T14:01:03.856Z", "date_only": false, "value": "2026-09-29T14:01:03.856284Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwnyij7o4z2x", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "f70de990-c8bf-417c-b94e-4e2875713ffc", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwnyij7o4z2x"}, {"timestamp": "2026-09-29T14:03:29.020Z", "date_only": false, "value": "2026-09-29T14:03:29.020892Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwnymsyacr2s", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c2974168-660e-499c-922c-c28894131612", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs", "url": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwnymsyacr2s"}, {"timestamp": "2026-09-29T14:24:31.541Z", "date_only": false, "value": "2026-09-29T14:24:31.541584Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwnzshlwrg2a", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "221655bd-8e84-4583-8d26-779c49b2b232", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwnzshlwrg2a"}, {"timestamp": "2026-09-29T14:29:04.868Z", "date_only": false, "value": "2026-09-29T14:29:04.868188Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cR0w/statuses/117354800209103638", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ba7ec4ec-aeaf-4a00-97d5-213891e63e33", "content": "Citrix shenanigans from @watchTowr \nhttps://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772/blob/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772.py", "url": "https://infosec.exchange/users/cR0w/statuses/117354800209103638"}, {"timestamp": "2026-09-29T14:35:15.024Z", "date_only": false, "value": "2026-09-29T14:35:15.024252Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117354824630218380", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "b3ca8ca7-fad2-498f-ba4b-676daf621070", "content": "New.\nWatchTower: Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/\nYesterday:\nWatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #infosec #vulnerability #NetScaler #Citrix", "url": "https://infosec.exchange/users/AAKL/statuses/117354824630218380"}, {"timestamp": "2026-09-29T15:21:15.234Z", "date_only": false, "value": "2026-09-29T15:21:15.234841Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3mwo4xvozr22d", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "70f42c2a-6c99-41eb-843c-2554e47c54c2", "content": "We've been continuously updating this post with the latest information\u2014now including details on exploitation of CVE-2026-88772. And all relevant indicators have been added to our MISP feed.\n\nifin.network/t/multi...\n\n#ThreatIntel #ThreatIntelligence #IFIN", "url": "https://bsky.app/profile/ifin-intel.org/post/3mwo4xvozr22d"}, {"timestamp": "2026-09-29T15:21:33.746Z", "date_only": false, "value": "2026-09-29T15:21:33.746930Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwo4r6x6zs72", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "a384ca46-81d9-4543-bd68-4f2beee30ed9", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "url": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwo4r6x6zs72"}, {"timestamp": "2026-09-29T15:23:30.167Z", "date_only": false, "value": "2026-09-29T15:23:30.167084Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117355005437174759", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "42409b5c-5ced-4531-a495-b372d2d8efba", "content": "We've been continuously updating this post with the latest information\u2014now including details on exploitation of CVE-2026-88772. And all relevant indicators have been added to our MISP feed.\nhttps://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867\n#ThreatIntel #ThreatIntelligence #IFIN", "url": "https://infosec.exchange/ap/users/115741367687413652/statuses/117355005437174759"}, {"timestamp": "2026-09-29T16:10:11.180Z", "date_only": false, "value": "2026-09-29T16:10:11.180826Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwo7pay5hu2v", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "861d804d-bac0-415f-ae9a-fb3a4c7f0244", "content": "\ud83e\udd16 Citrix NetScaler dual zero-days: CVE-2026-88771 (RCE, CVSS 9.5) and CVE-2026-88772 (memory overflow, RCE/DDoS), both in default configs of NetScaler ADC/Gateway. Exploited in the wild, patched Sept 27.\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwo7pay5hu2v"}, {"timestamp": "2026-09-29T16:37:12Z", "date_only": false, "value": "2026-09-29T16:37:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c81a2de4-3c74-4bab-8b51-e297dc87114b", "content": "Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]", "url": "https://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/"}, {"timestamp": "2026-09-29T17:42:33.040Z", "date_only": false, "value": "2026-09-29T17:42:33.040217Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwoepznrje2b", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d2e08879-561a-4990-afd8-bb172267953b", "content": "watchTowr details a pre-auth memory overflow in Citrix NetScaler's DTLS handling, CVE-2026-88772, the second of eight CVEs Citrix patched in one advisory. The writeup walks the flaw; the \"here we go again\" framing is doing some work, since the patch itself already shipped.", "url": "https://bsky.app/profile/cybersecurity.page/post/3mwoepznrje2b"}, {"timestamp": "2026-09-29T18:37:34.802Z", "date_only": false, "value": "2026-09-29T18:37:34.802880Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mwohwxhmcx2y", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7e6c333e-3916-4225-b773-2531ceece7b0", "content": "Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mwohwxhmcx2y"}, {"timestamp": "2026-09-29T18:48:52.332Z", "date_only": false, "value": "2026-09-29T18:48:52.332175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mwoil5kwxz2c", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "54a3c7b4-7a2e-4b5b-9fe0-b4759cdb61fb", "content": "Attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy web shells and tunneling malware for root access and credential theft.", "url": "https://bsky.app/profile/thecircuitry.to/post/3mwoil5kwxz2c"}, {"timestamp": "2026-09-29T18:52:13.529Z", "date_only": false, "value": "2026-09-29T18:52:13.529677Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwoir4sj6o2i", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "2d5f7a40-d6d7-4eaa-8238-335792b0e470", "content": "\u30cf\u30c3\u30ab\u30fc\u304cCitrix NetScaler\u306e\u30bc\u30ed\u30c7\u30a4\u3092\u60aa\u7528\u3001Web\u30b7\u30a7\u30eb\u3092\u8a2d\u7f6e\n\n\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696d\u5404\u793e\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u8005\u306fCitrix NetScaler\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u300cCVE-2026-88772\u300d\u3092\u60aa\u7528\u3057\u3001\u72ec\u81ea\u306eWeb\u30b7\u30a7\u30eb\u3084\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u578b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u8a2d\u7f6e\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3055\u3089\u306broot\u6a29\u9650\u3092\u596a\u53d6\u3057\u3066\u8a8d\u8a3c\u60c5\u5831\u3092\u7a83\u53d6\u3057\u3001\u5185\u90e8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3078\u4fb5\u5bb3\u3092\u5e83\u3052\u3066\u3044\u307e\u3059\u3002 Mandiant\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u306f", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwoir4sj6o2i"}, {"timestamp": "2026-09-29T19:11:58Z", "date_only": false, "value": "2026-09-29T19:11:58.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/25684", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4f064133-8389-4efe-aeae-d0a841b892eb", "content": "\u200aHackers exploit Citrix NetScaler zero-day to deploy web shells\n\nCybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "url": "https://t.me/BleepingComputer/25684"}, {"timestamp": "2026-09-29T20:16:12.827Z", "date_only": false, "value": "2026-09-29T20:16:12.827459Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwongtsdtg23", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4307e0c8-e566-4a55-b644-df252211280c", "content": "~Spiderlabs~\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwongtsdtg23"}, {"timestamp": "2026-09-29T22:01:22Z", "date_only": false, "value": "2026-09-29T22:01:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/zu6p-mnf04FIQlwz6Jc90QIemeqpkiwRVDLe7C-LLFs1Z0w", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "16d56d94-6df8-4125-ad01-e7c5bfce9c62"}, {"timestamp": "2026-09-29T22:01:23.247Z", "date_only": false, "value": "2026-09-29T22:01:23.247711Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwotddg35g2n", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c2aef067-2663-4f44-af60-1bdad91e6111", "content": "Citrix NetScaler-apparaten het slachtoffer van grootschalige zero-day aanvallen\n\nAanvallers hebben twee kritieke zero-day kwetsbaarheden, CVE-2026-88772 en CVE-2026-88771, in Citrix NetScaler-apparaten massaal uitgebuit. De vroegst bekende exploitatie van CVE-2026-88772 dateert van 3 septem...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwotddg35g2n"}, {"timestamp": "2026-09-29T22:09:20Z", "date_only": false, "value": "2026-09-29T22:09:20.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/lsHU-UFoE9jp8RYYvXLm1SpQJKpFnC1QG-nftonJyjWN0ys", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d61354a3-7b55-4a8b-977a-07c7bde92bd8"}, {"timestamp": "2026-09-29T22:15:29.481Z", "date_only": false, "value": "2026-09-29T22:15:29.481357Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwou4luxvw2c", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "f62ff8a1-58ce-40dc-b886-70e4fc10cb89", "content": "Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 were used to deploy web shells, tunneling malware, and steal credentials in attacks across North America and Europe. #Citrix #NorthAmerica #Europe", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwou4luxvw2c"}, {"timestamp": "2026-09-29T22:36:12.077Z", "date_only": false, "value": "2026-09-29T22:36:12.077144Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/packetstorm.bsky.social/post/3mwovbnjtqw2j", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "5a1af63a-c2f4-45a3-b0df-d6675ec88012", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://packetstorm.news/news/view/44294 #news", "url": "https://bsky.app/profile/packetstorm.bsky.social/post/3mwovbnjtqw2j"}, {"timestamp": "2026-09-29T23:00:35Z", "date_only": false, "value": "2026-09-29T23:00:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44661", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "98cf2517-1f7a-40af-b27b-c331d0071d90", "content": "Hackers exploit Citrix NetScaler zero-day to deploy web shells\n\nCybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "url": "https://t.me/VulnerabilityNews/44661"}, {"timestamp": "2026-09-29T23:46:44.427Z", "date_only": false, "value": "2026-09-29T23:46:44.427360Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwoz7s2apt2i", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b0e0f008-f339-4b61-844c-33c7e68a8e91", "content": "The latest update for #Sophos includes \"Jev's Paradox: The hidden cost of cheap #AI decisions\" and \"Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation\".\n \n#cybersecurity #antivirus #malware https://opsmtrs.com/487u2e2", "url": "https://bsky.app/profile/opsmatters.com/post/3mwoz7s2apt2i"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-88772", "field": "evidence.0.details.due_date", "uuid": "25ce362a-a184-4ea6-83c7-64bb2a2242a3", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "revisions.2.revision_date"}, {"timestamp": "2026-09-30T02:21:18.269Z", "date_only": false, "value": "2026-09-30T02:21:18.269218Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwpbu64luy2s", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c8337455-04c5-46ea-8db5-ff8f180041b7", "content": "\ud83e\udd16 CVE-2026-88772: Citrix NetScaler zero-day exploited in the wild. Web shells + tunneling malware, root access, credential theft and lateral movement.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwpbu64luy2s"}, {"timestamp": "2026-09-30T03:30:30Z", "date_only": false, "value": "2026-09-30T03:30:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e1f187c3-de56-482b-bda8-e6767afe733e", "content": "Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild.\n\nThe vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler", "url": "https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html"}, {"timestamp": "2026-09-30T04:36:58.207Z", "date_only": false, "value": "2026-09-30T04:36:58.207663Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/redoracle.com/post/3mwpjgqq6jt2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c75fbadd-92c0-4b1a-a6f8-b2ae65af7d80", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) https://redoracle.com/News/citrix-netscaler-rce-zero-days-exploited-globally-for-weeks-cve-2026.html #2026 #netscaler #vulnerabilities", "url": "https://bsky.app/profile/redoracle.com/post/3mwpjgqq6jt2f"}, {"timestamp": "2026-09-30T05:15:23.867Z", "date_only": false, "value": "2026-09-30T05:15:23.867735Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpllhpyhs27", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ad388144-d783-497d-9ca5-5d919decf372", "content": "Mandiant and GTIG report active exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88772 and CVE-2026-88771, with custom tools, root access, persistence, and hidden C2 in HTTP headers. #CitrixNetScaler #WHIPSHOT #SLAPSHOT", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpllhpyhs27"}, {"timestamp": "2026-09-30T05:34:39Z", "date_only": false, "value": "2026-09-30T05:34:39.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10198", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "f0039d7d-a174-4218-99b0-6e2cac1f62da", "content": "\ud83d\uded1 Citrix NetScaler CVE-2026-88772 can turn 120 crafted DTLS records into root-level shellcode execution.\n\nwatchTowr\u2019s new analysis shows how about 174 KB of reassembled data overruns a 35,840-byte scratch buffer, hijacks control flow, and uses mprotect() to bypass NX.\n\nThe flaw is already exploited in the wild.\n\nInside the exploit chain: https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html", "url": "https://t.me/thehackernews/10198"}, {"timestamp": "2026-09-30T05:57:04.883Z", "date_only": false, "value": "2026-09-30T05:57:04.883537Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwpnvytzex2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "51a058ce-2c7f-4505-847a-2b46346c71ca", "content": "\ud83d\udee1\ufe0f Revue cyber du 30/09 :\n\u2022 Citrix : 2 zero-days NetScaler (CVE-2026-88772) exploit\u00e9s, web shells + root. Patch avant mercredi (CISA).\nbleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwpnvytzex2f"}, {"timestamp": "2026-09-30T06:08:33.659Z", "date_only": false, "value": "2026-09-30T06:08:33.659600Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwpokf6jsk2t", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "75cfe68f-a265-46ac-b489-0c878b39ebcd", "content": "\ud83d\udd34 NetScaler CVE-2026-88772 \u2014 attacks go beyond RCE\nAttackers are deploying WHIPSHOT web shells and SLAPSHOT tunneling malware, gaining root access and pivoting into internal networks.\nstemshop.top/blog/netscal...\n#CVE #CVE202688772 #Citrix #NetScaler #WebShell #CyberSecurity", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwpokf6jsk2t"}, {"timestamp": "2026-09-30T06:54:10Z", "date_only": false, "value": "2026-09-30T06:54:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/ctinow/257628", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "eeb47b11-1dc8-4d20-aa12-edea148610d0", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\nhttps://ift.tt/upV32fq", "url": "https://t.me/ctinow/257628"}, {"timestamp": "2026-09-30T07:01:52.085Z", "date_only": false, "value": "2026-09-30T07:01:52.085973Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwprjtbeej2o", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "917ac476-1601-47da-8be0-2f123d52ae24", "content": "CVE-2026-88772 in Citrix NetScaler ADC/Gateway DTLS handling enables remote code execution or denial-of-service via a memory buffer overflow.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwprjtbeej2o"}, {"timestamp": "2026-09-30T07:01:58.666Z", "date_only": false, "value": "2026-09-30T07:01:58.666757Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwprjzonu42e", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "2fb0c013-e4ee-4111-a832-07abdfde3fe4", "content": "CVE-2026-88772 in Citrix NetScaler ADC/Gateway DTLS handling enables remote code execution or denial-of-service via a memory buffer overflow.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwprjzonu42e"}, {"timestamp": "2026-09-30T07:02:10.962Z", "date_only": false, "value": "2026-09-30T07:02:10.962164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwprkfchy42d", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a7068289-fd37-4979-b10c-06719337e611", "content": "CVE-2026-88772 in Citrix NetScaler ADC/Gateway DTLS handling enables remote code execution or denial-of-service via a memory buffer overflow.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwprkfchy42d"}, {"timestamp": "2026-09-30T07:20:32.586Z", "date_only": false, "value": "2026-09-30T07:20:32.586284Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "1f36f289-a55a-4058-be90-7e863cf38bac", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 93 interactions\nCVE-2026-88772: 93 interactions\nCVE-2026-87902: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 32 interactions\nCVE-2026-88771: 20 interactions\nCVE-2026-86950: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h"}, {"timestamp": "2026-09-30T07:20:56Z", "date_only": false, "value": "2026-09-30T07:20:56.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/gf8iqD--KUzNtQwvICIQV53KhjaEI71nq_lpiyx0bRlbfA", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "fd26e097-902c-4ee8-a2d5-fe93f36d9e49"}, {"timestamp": "2026-09-30T07:29:13.383Z", "date_only": false, "value": "2026-09-30T07:29:13.383931Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/2xilxbtk6uqtg", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "dff19acc-b43c-4d3c-9204-ab21802a7559", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution", "url": "https://bsky.app/profile/infosec.skyfleet.blue/post/2xilxbtk6uqtg"}, {"timestamp": "2026-09-30T08:03:54Z", "date_only": false, "value": "2026-09-30T08:03:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/MalaysiaHacktivistz/17040", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0613ac42-7a32-4cbd-85f3-abfff83a555b", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "url": "https://t.me/MalaysiaHacktivistz/17040"}, {"timestamp": "2026-09-30T08:03:54Z", "date_only": false, "value": "2026-09-30T08:03:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/MalaysiaHacktivistz/26432", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "89c60ef1-9ae1-4836-a0e3-3bac78765402", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "url": "https://t.me/MalaysiaHacktivistz/26432"}, {"timestamp": "2026-09-30T08:03:54Z", "date_only": false, "value": "2026-09-30T08:03:54.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/TengkorakCyberCrewzz/15226", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ee5e7f99-68a4-469e-a286-0f28ad1a9ae4", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "url": "https://t.me/TengkorakCyberCrewzz/15226"}, {"timestamp": "2026-09-30T08:03:54Z", "date_only": false, "value": "2026-09-30T08:03:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/26432", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "8e6be0b3-2736-48bd-a6f1-ecb532c8dd25", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "url": "https://t.me/MalaysiaHacktivistz/26432"}, {"timestamp": "2026-09-30T08:19:17.224Z", "date_only": false, "value": "2026-09-30T08:19:17.224498Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-21d4358b-a60121ca5d9080d1", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4d2a43dc-2d32-49e8-afb6-4e204ead6fc2", "content": "Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been [\u2026]WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign", "url": "https://poliverso.org/objects/0477a01e-21d4358b-a60121ca5d9080d1"}, {"timestamp": "2026-09-30T08:23:16.122Z", "date_only": false, "value": "2026-09-30T08:23:16.122027Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3mwpw3fpq5u2r", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a2b697bc-5891-4853-8676-53e6e986d250", "content": "\ud83d\uddb2\ufe0f #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia\n\nCitrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nLeer M\u00e1s / Read More...", "url": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3mwpw3fpq5u2r"}, {"timestamp": "2026-09-30T08:38:43.031Z", "date_only": false, "value": "2026-09-30T08:38:43.031636Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-30T08:38:43.031Z", "date_only": false, "value": "2026-09-30T08:38:43.031636Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-30T09:11:01.652Z", "date_only": false, "value": "2026-09-30T09:11:01.652085Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mwpyqsbv762o", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "0d0ddf37-44e8-4c40-879f-4c50af1e9262", "content": "Critical Citrix NetScaler RCE (CVE-2026-88772) exploited in the wild: a deep dive into the DTLS buffer\u00a0overflow\n\nCitrix NetScaler vulnerability, NetScaler RCE, Citrix zero-day, DTLS buffer overflow, CVE-2026-88771, NetScaler\u2026\n\nhttps://thecybersecguru.com/news/citrix-netscaler-cve-2026-88772-rce/", "url": "https://bsky.app/profile/thecybersecguru.com/post/3mwpyqsbv762o"}, {"timestamp": "2026-09-30T09:30:27.491Z", "date_only": false, "value": "2026-09-30T09:30:27.491869Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpztjjjno2m", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9bb73152-9490-420c-9b3c-e0dab13b13f0", "content": "CVE-2026-88772 hits Citrix NetScaler ADC and Gateway via a DTLS memory overflow in NSPPE, enabling pre-auth RCE or DoS. Active exploitation reported. #CitrixNetScaler #NSPPE #CVE202688772", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpztjjjno2m"}, {"timestamp": "2026-09-30T09:34:06.240Z", "date_only": false, "value": "2026-09-30T09:34:06.240730Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwq222j4mk2q", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "08009e96-5293-4b87-99ea-e3fda103d62a", "content": "Citrix NetScaler ADC/Gateway\u306b\u3001DTLS\u51e6\u7406\u306e\u30e1\u30e2\u30ea\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\uff08CVE-2026-88772\uff09\u8106\u5f31\u6027\u304c\u3042\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u5b9f\u884c\u53ef\u80fd\u3067\u3059\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mwq222j4mk2q"}, {"timestamp": "2026-09-30T09:35:34.667Z", "date_only": false, "value": "2026-09-30T09:35:34.667773Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/it4intserver.bsky.social/post/3mwq24oqie72w", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9ef9a89d-18ca-4ad0-b0d1-7087fbf222fc", "content": "iT4iNT SERVER Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution VDS VPS Cloud #Cybersecurity #Vulnerability #CVE202688772 #NetScaler #InfoSec", "url": "https://bsky.app/profile/it4intserver.bsky.social/post/3mwq24oqie72w"}, {"timestamp": "2026-09-30T10:02:10.429Z", "date_only": false, "value": "2026-09-30T10:02:10.429453Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwq3m7xgyw2j", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7f6139a5-51f2-49bd-ab52-9c7d8140e7bb", "content": "Threat actors exploited CVE-2026-88772 in Citrix NetScaler ADC/Gateway to gain root access, deploy PHP web shells and tunneling tools, and steal credentials via internal reconnaissance.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwq3m7xgyw2j"}, {"timestamp": "2026-09-30T10:02:11.749Z", "date_only": false, "value": "2026-09-30T10:02:11.749985Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwq3mbh6jz2y", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "29671970-8066-4e38-9925-617e546c0d3d", "content": "Threat actors exploited CVE-2026-88772 in Citrix NetScaler ADC/Gateway to gain root access, deploy PHP web shells and tunneling tools, and steal credentials via internal reconnaissance.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwq3mbh6jz2y"}, {"timestamp": "2026-09-30T10:02:25.072Z", "date_only": false, "value": "2026-09-30T10:02:25.072938Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwq3moudv72o", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "300c42c9-ece8-4bec-a527-a84553c8280d", "content": "Threat actors exploited CVE-2026-88772 in Citrix NetScaler ADC/Gateway to gain root access, deploy PHP web shells and tunneling tools, and steal credentials via internal reconnaissance.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwq3moudv72o"}, {"timestamp": "2026-09-30T10:07:46.326Z", "date_only": false, "value": "2026-09-30T10:07:46.326668Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mwq3wawyak2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "654b087c-bf12-4ca4-a625-a159be4b5529", "content": "\ud83d\udd12 Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nCybersecurity researchers have disclosed technical details of a recently patched critica...\n\nhttps://tinyurl.com/2c45cebh #CyberSecurity #InfoSec #CrustyTLDR", "url": "https://bsky.app/profile/crustytldr.bsky.social/post/3mwq3wawyak2f"}, {"timestamp": "2026-09-30T10:45:21.044Z", "date_only": false, "value": "2026-09-30T10:45:21.044778Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwq5zgv2s72o", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "c871731a-1478-49c7-84d8-ae72a40d9c8a", "content": "NetScaler CVE-2026-88772: documented attack chain covers web shells, tunneling malware, root access, and lateral\u2026 https://0daynews.com/articles/2026-09-30-citrix-netscaler-cve-2026-88772-web-shell-campaign/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-4032", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mwq5zgv2s72o"}, {"timestamp": "2026-09-30T10:48:20Z", "date_only": false, "value": "2026-09-30T10:48:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "44962fab-5c71-42e8-a6d6-ba18312e88a2", "content": "Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\n\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.", "url": "https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/"}, {"timestamp": "2026-09-30T10:49:54Z", "date_only": false, "value": "2026-09-30T10:49:54.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8662", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3abb3cb5-c7ff-4141-b3ce-a48bc80adfc7", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "url": "https://t.me/true_secator/8662"}, {"timestamp": "2026-09-30T10:49:54Z", "date_only": false, "value": "2026-09-30T10:49:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8662", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "71e4488e-1d6e-4d47-89c2-626ca34ce0c9", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "url": "https://t.me/true_secator/8662"}, {"timestamp": "2026-09-30T10:51:28Z", "date_only": false, "value": "2026-09-30T10:51:28.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8663", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0f1dc0d1-c865-403d-b403-1cb0a5b34c99", "content": "\u0412 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c\u0443: \u0432 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 Mandiant \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-88772, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0442\u0435\u0445 \u0436\u0435 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0430\u0442\u0430\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b GreyNoise.\n\nMandiant \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NetScaler (NSPPE), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.\n\n\u0425\u043e\u0442\u044f \u0443 Google Threat Intelligence Group \u043d\u0435\u0442 \u043a\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u0430\u043d\u0430\u043b\u0438\u0437 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 \u043a\u0443\u0447\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u043f\u043e\u0442\u043e\u043a \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 FreeBSD.\n\n\u0412 Google \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a PHP \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 NetScaler \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Mandiant, \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u0444\u0430\u0439\u043b /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b .deb \u0444\u0430\u0439\u043b\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 NetScaler.\n\n\u0412 \u0434\u0440\u0443\u0433\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b .sig \u0444\u0430\u0439\u043b\u044b \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a .ico \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u043c /vpn/media/ \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 PHP-\u0444\u0430\u0439\u043b\u044b.\n\nGoogle \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u0444\u0430\u0439\u043b\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 CSS, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 PHP shell_exec() \u0438\u043b\u0438 eval().\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 HTTP-\u043e\u0442\u0432\u0435\u0442\u044b 404 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434, \u0447\u0442\u043e \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c.\n\nMandiant \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u0430\u043a WHIPSHOT \u0438 SLAPSHOT.\n\nWHIPSHOT - \u044d\u0442\u043e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u043d\u0430 PHP, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u0430\u043a\u0435\u0442 Debian \u0438 \u0445\u0440\u0430\u043d\u044f\u0449\u0430\u044f\u0441\u044f \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 NetScaler VPN.\n\n\u041e\u043d\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a HTTP-\u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f SLAPSHOT, \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044f \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 Base64 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044f \u0438\u0445 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\nWHIPSHOT \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043b\u0438 SLAPSHOT, \u0438 \u043c\u043e\u0436\u0435\u0442 \u043b\u0438 \u043e\u043d \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Python \u0432 \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435.\n\nSLAPSHOT \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f TCP \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Python, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e NetScaler \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043f\u043e \u0441\u0435\u0442\u0438.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0442 WHIPSHOT \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0445\u043e\u0441\u0442\u0430\u043c\u0438, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u044d\u0442\u0438\u043c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0441\u0435\u0441\u0441\u0438\u0438 \u043f\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u0441\u0432\u043e\u044e \u0440\u0430\u0431\u043e\u0442\u0443\n\n\u0425\u043e\u0442\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 root, \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430\u043c\u0438, \u043e\u0431\u044b\u0447\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b NetScaler.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 /bin/sh \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0442\u0430\u043a\u0436\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438.\n\nMandiant \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f Citrix \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.\n\n\u041a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u0438\u043b\u0438 \u043f\u0441\u0435\u0432\u0434\u043e\u043d\u0438\u043c\u044b \u0432 httpd.conf, \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b .deb \u0438\u043b\u0438 .sig, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043a\u043e\u0434 PHP, \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u043e\u0442\u0432\u0435\u0442\u044b HTTP 404, \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0438 NSPPE, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 /tmp/.uxdport \u0438\u043b\u0438 /tmp/.uxdlock, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441\u043e SLAPSHOT.", "url": "https://t.me/true_secator/8663"}, {"timestamp": "2026-09-30T10:51:28Z", "date_only": false, "value": "2026-09-30T10:51:28.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8663", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a21f5a8c-8440-4fff-a244-439b4f1f1e9c", "content": "\u0412 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c\u0443: \u0432 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 Mandiant \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-88772, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0442\u0435\u0445 \u0436\u0435 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0430\u0442\u0430\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b GreyNoise.\n\nMandiant \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NetScaler (NSPPE), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.\n\n\u0425\u043e\u0442\u044f \u0443 Google Threat Intelligence Group \u043d\u0435\u0442 \u043a\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u0430\u043d\u0430\u043b\u0438\u0437 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 \u043a\u0443\u0447\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u043f\u043e\u0442\u043e\u043a \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 FreeBSD.\n\n\u0412 Google \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a PHP \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 NetScaler \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Mandiant, \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u0444\u0430\u0439\u043b /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b .deb \u0444\u0430\u0439\u043b\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 NetScaler.\n\n\u0412 \u0434\u0440\u0443\u0433\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b .sig \u0444\u0430\u0439\u043b\u044b \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a .ico \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u043c /vpn/media/ \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 PHP-\u0444\u0430\u0439\u043b\u044b.\n\nGoogle \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u0444\u0430\u0439\u043b\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 CSS, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 PHP shell_exec() \u0438\u043b\u0438 eval().\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 HTTP-\u043e\u0442\u0432\u0435\u0442\u044b 404 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434, \u0447\u0442\u043e \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c.\n\nMandiant \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u0430\u043a WHIPSHOT \u0438 SLAPSHOT.\n\nWHIPSHOT - \u044d\u0442\u043e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u043d\u0430 PHP, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u0430\u043a\u0435\u0442 Debian \u0438 \u0445\u0440\u0430\u043d\u044f\u0449\u0430\u044f\u0441\u044f \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 NetScaler VPN.\n\n\u041e\u043d\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a HTTP-\u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f SLAPSHOT, \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044f \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 Base64 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044f \u0438\u0445 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\nWHIPSHOT \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043b\u0438 SLAPSHOT, \u0438 \u043c\u043e\u0436\u0435\u0442 \u043b\u0438 \u043e\u043d \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Python \u0432 \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435.\n\nSLAPSHOT \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f TCP \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Python, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e NetScaler \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043f\u043e \u0441\u0435\u0442\u0438.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0442 WHIPSHOT \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0445\u043e\u0441\u0442\u0430\u043c\u0438, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u044d\u0442\u0438\u043c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0441\u0435\u0441\u0441\u0438\u0438 \u043f\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u0441\u0432\u043e\u044e \u0440\u0430\u0431\u043e\u0442\u0443\n\n\u0425\u043e\u0442\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 root, \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430\u043c\u0438, \u043e\u0431\u044b\u0447\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b NetScaler.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 /bin/sh \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0442\u0430\u043a\u0436\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438.\n\nMandiant \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f Citrix \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.\n\n\u041a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u0438\u043b\u0438 \u043f\u0441\u0435\u0432\u0434\u043e\u043d\u0438\u043c\u044b \u0432 httpd.conf, \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b .deb \u0438\u043b\u0438 .sig, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043a\u043e\u0434 PHP, \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u043e\u0442\u0432\u0435\u0442\u044b HTTP 404, \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0438 NSPPE, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 /tmp/.uxdport \u0438\u043b\u0438 /tmp/.uxdlock, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441\u043e SLAPSHOT.", "url": "https://t.me/true_secator/8663"}, {"timestamp": "2026-09-30T10:53:09.160Z", "date_only": false, "value": "2026-09-30T10:53:09.160629Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwq6hevvx72x", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e9c23440-8664-4278-9076-d224f745bafe", "content": "NetScaler CVE-2026-88772 enables root access, WHIPSHOT web shells & SLAPSHOT tunneling\u2014patch now before compromise expands. #NetScaler #ZeroDay #WHIPSHOT #SLAPSHOT #CVE2026-88772 https://thedailytechfeed.com/netscaler-vulnerability-gives-root-access-enables-whipshot-slapshot-attack-tools/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mwq6hevvx72x"}, {"timestamp": "2026-09-30T12:31:37.757Z", "date_only": false, "value": "2026-09-30T12:31:37.757353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwqdxizvv22l", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "c11a7ebf-6299-4fdf-83a6-957cf5b0d4cd", "content": "\ud83e\udd16 CVE-2026-88772 (CVSS 9.5): DTLS memory overflow in Citrix NetScaler ADC/Gateway gives pre-auth attackers shellcode execution. Exploited in the wild for root access (WHIPSHOT/SLAPSHOT).\nhttps://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwqdxizvv22l"}, {"timestamp": "2026-09-30T12:44:34.083Z", "date_only": false, "value": "2026-09-30T12:44:34.083438Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwqeok5fwk26", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0ce0a0a3-aad1-4618-8511-760dc726b281", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/30/c...\n\n#cybersecurity #cybersecuritynews #Europe #USA #education #financialindustry #telecommunications @mandiant.com", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mwqeok5fwk26"}, {"timestamp": "2026-09-30T12:53:04.724Z", "date_only": false, "value": "2026-09-30T12:53:04.724041Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwqf5l4qor2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "20d7b96b-0d5a-4761-919d-6a623004c52c", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwqf5l4qor2f"}, {"timestamp": "2026-09-30T12:54:13.833Z", "date_only": false, "value": "2026-09-30T12:54:13.833785Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqf7q6ous2p", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "fbd0d799-5fc2-41a1-9328-d9cf5548c42b", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqf7q6ous2p"}, {"timestamp": "2026-09-30T13:10:36.642Z", "date_only": false, "value": "2026-09-30T13:10:36.642731Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwqg57awfu2l", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "522ed7d5-5aa7-4403-a4cd-35fef3eec305", "content": "\u56fd\u5bb6\u652f\u63f4\u578b\u3068\u307f\u3089\u308c\u308b\u30cf\u30c3\u30ab\u30fc\u30019\u6708\u521d\u65ec\u304b\u3089NetScaler\u306e\u30bc\u30ed\u30c7\u30a4\u3092\u60aa\u7528\uff08CVE-2026-88772\uff09\n\nMandiant\u306e\u6700\u9ad8\u6280\u8853\u8cac\u4efb\u8005\uff08CTO\uff09\u3067\u3042\u308bCharles Carmakal\u6c0f\u306f\u3001\u6700\u8fd1\u516c\u8868\u3055\u308c\u305fNetScaler\u306e2\u4ef6\u306e\u8106\u5f31\u6027\u306e\u3046\u3061\u3001\u30bc\u30ed\u30c7\u30a4\u3068\u3057\u3066\u60aa\u7528\u3055\u308c\u305fCVE-2026-88772\u3092\u7a81\u3044\u305f\u521d\u671f\u306e\u6a19\u7684\u578b\u4fb5\u5165\u306b\u3064\u3044\u3066\u3001\u300c\u9ad8\u5ea6\u3067\u3001\u56fd\u5bb6\u306e\u652f\u63f4\u3092\u53d7\u3051\u3066\u3044\u308b\u3068\u307f\u3089\u308c\u308b\u653b\u6483\u8005\u300d\u304c\u80cc\u5f8c\u306b\u3044\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u3044\u3068", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwqg57awfu2l"}, {"timestamp": "2026-09-30T13:17:12.535Z", "date_only": false, "value": "2026-09-30T13:17:12.535201Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwqgix4xq22l", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c2e6392f-596e-4e27-b2bc-0e183958186a", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\n\nwww.helpnetsecurity.com/2026/09/30/c...\n\n#Kyberturvallisuus #Kyber #Tilannekuva", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mwqgix4xq22l"}, {"timestamp": "2026-09-30T13:42:33.141Z", "date_only": false, "value": "2026-09-30T13:42:33.141127Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwqhrs7fky2h", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "8bf159a9-ee69-4045-a885-e2862da96e8c", "content": "A Citrix NetScaler zero-day (CVE-2026-88772, pre-auth DTLS memory overflow) was exploited for at least three weeks before detection. WatchTowr's writeup includes IOCs, and defenders are hunting for indicators like \"heartbeat\" strings and suspicious inbound traffic.", "url": "https://bsky.app/profile/cybersecurity.page/post/3mwqhrs7fky2h"}, {"timestamp": "2026-09-30T14:21:44.212Z", "date_only": false, "value": "2026-09-30T14:21:44.212608Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117360432922523865", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4ae0b280-172e-4776-a051-3c3c547d86a0", "content": "\ud83d\udcf0 Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit\n\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-zero-days-and-oracle-peoplesoft-flaw-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117360432922523865"}, {"timestamp": "2026-09-30T14:21:53.289Z", "date_only": false, "value": "2026-09-30T14:21:53.289352Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwqk4mygqd2t", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "1abe10f1-4c1d-4f4e-bd39-0e37fb4111f0", "content": "\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwqk4mygqd2t"}, {"timestamp": "2026-09-30T15:04:14.010Z", "date_only": false, "value": "2026-09-30T15:04:14.010442Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mwqmiffcax2o", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7dde2108-48c2-492f-bda6-d7e43dc32669", "content": "Why check now?\n\nGoogle/Mandiant report active CVE-2026-88772 exploitation and likely impact across several sectors. Unit 42's hunts are general guidance, not observed campaign fingerprints.", "url": "https://bsky.app/profile/alphahunt.io/post/3mwqmiffcax2o"}, {"timestamp": "2026-09-30T15:06:22.352Z", "date_only": false, "value": "2026-09-30T15:06:22.352993Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwqmm6zext2t", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "8ee11cd9-bd89-4789-be27-25882c939911", "content": "A DTLS buffer overflow in Citrix NetScaler lets attackers execute code without login via CVE-2026-88772. #CVE2026-88772 #Citrix #NetScaler #Cybersecurity #RemoteCodeExecution https://thedailytechfeed.com/citrix-netscaler-critical-flaw-cve-2026-88772-enables-pre-auth-remote-code-execution/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mwqmm6zext2t"}, {"timestamp": "2026-09-30T15:31:04Z", "date_only": false, "value": "2026-09-30T15:31:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3382", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "2f3dfb45-9773-4388-9091-0e2c0a32d5f3", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "url": "https://t.me/pphm_HackerNews/3382"}, {"timestamp": "2026-09-30T15:31:04Z", "date_only": false, "value": "2026-09-30T15:31:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/3382", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "10aab2ba-ca17-480c-a6c2-7bd45a4233bc", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "url": "https://t.me/pphm_HackerNews/3382"}, {"timestamp": "2026-09-30T16:41:59Z", "date_only": false, "value": "2026-09-30T16:41:59.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/56012", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0c4548c0-2992-44ed-80ec-feb0f4505119", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/56012"}, {"timestamp": "2026-09-30T16:41:59Z", "date_only": false, "value": "2026-09-30T16:41:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/56012", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "f572aaeb-1c8a-4c53-92f9-94ca20b0e914", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/56012"}, {"timestamp": "2026-09-30T17:15:25.964Z", "date_only": false, "value": "2026-09-30T17:15:25.964564Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqtsym67r2m", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "5be7daba-68e9-46c9-9d47-c97355ed4a23", "content": "Citrix patched two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after weeks-long attacks used for unauthenticated RCE, root access, and web shells. Over 100 victims may be affected. #NetScaler #Mandiant #Europe", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqtsym67r2m"}, {"timestamp": "2026-09-30T19:19:33.334Z", "date_only": false, "value": "2026-09-30T19:19:33.334408Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwr2qw4vgc2d", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "df1f7b87-dd77-45ea-b9ca-188936b7f2b7", "content": "Hackers exploit Citrix NetScaler zero-day to deploy web shells\n\nCybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwr2qw4vgc2d"}, {"timestamp": "2026-09-30T20:42:04.514Z", "date_only": false, "value": "2026-09-30T20:42:04.514457Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwr7ehv2se25", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "aefe0d8b-caa1-4e5b-96a4-702d536e2841", "content": "Government and finance offices are getting hit hard right now by two Citrix NetScaler vulnerabilities. They're CVE-2026-88772 and CVE-2026-88771.\n\n#vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwr7ehv2se25"}, {"timestamp": "2026-09-30T23:00:48Z", "date_only": false, "value": "2026-09-30T23:00:48.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44692", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3160666e-3fd7-4f91-8369-bbabfab3831f", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "url": "https://t.me/VulnerabilityNews/44692"}, {"timestamp": "2026-10-01T00:28:56.575Z", "date_only": false, "value": "2026-10-01T00:28:56.575922Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwrm24xh2v2u", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4dbd9d36-b048-43df-8507-0f715a505916", "content": "CVE-2026-88772, a Citrix NetScaler DTLS memory overflow, is exploited in the wild. A watchTowr PoC and full details are now public. Patch NetScaler now.\n\n#Citrix #NetScaler #CVE202688772 #DTLS #watchTowr #KEV #ZeroDay #RCE", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwrm24xh2v2u"}, {"timestamp": "2026-10-01T02:16:25Z", "date_only": false, "value": "2026-10-01T02:16:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "30344cee-1c74-40bc-9a88-a3fca2a1952e", "url": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa"}, {"timestamp": "2026-10-01T02:38:13.533Z", "date_only": false, "value": "2026-10-01T02:38:13.533164Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtbdgfwd2v", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9eab637d-acfc-40a7-b145-34a61b75a92a", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\uff08Citrix NetScaler\u306eCVE-2026-88772\u3001\u8a8d\u8a3c\u524d\u304b\u3089\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u81f3\u308b\u653b\u6483\u624b\u6cd5\u304c\u5224\u660e\uff09 #TheHackerNews (Sep 30)\nthehackernews.com/2026/09/citr...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtbdgfwd2v"}, {"timestamp": "2026-10-01T02:38:22.752Z", "date_only": false, "value": "2026-10-01T02:38:22.752631Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtbm5w4p26", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a2bf35e9-971f-4f94-a187-eb62dd0f4de3", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\uff08\u56fd\u5bb6\u652f\u63f4\u578b\u3068\u307f\u3089\u308c\u308b\u653b\u6483\u8005\u3001NetScaler\u30bc\u30ed\u30c7\u30a4\u30929\u6708\u521d\u65ec\u304b\u3089\u60aa\u7528\uff09 #HelpNetSecurity (Sep 30)\nwww.helpnetsecurity.com/2026/09/30/c...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtbm5w4p26"}, {"timestamp": "2026-10-01T02:39:48.518Z", "date_only": false, "value": "2026-10-01T02:39:48.518256Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrte6gyvq2e", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "b3a59a92-803c-461e-a5df-f4adf0801d76", "content": "CVE-2026-88772: Citrix NetScaler Zero-Day Exploited, PoC Details Emerge\uff08Citrix NetScaler\u30bc\u30ed\u30c7\u30a4CVE-2026-88772\u304c\u5b9f\u60aa\u7528\u3001PoC\u306e\u8a73\u7d30\u3082\u660e\u3089\u304b\u306b\uff09 #SecurityOnline (Sep 30)\nsecurityonline.info/citrix-netsc...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrte6gyvq2e"}, {"timestamp": "2026-10-01T02:40:56.345Z", "date_only": false, "value": "2026-10-01T02:40:56.345051Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtg66vbp26", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "556ec0df-f11e-4eb6-a59f-addebc724045", "content": "CVE-2026-88772: Citrix NetScaler Zero-Day Exploited, PoC Details Emerge\uff08Citrix NetScaler\u30bc\u30ed\u30c7\u30a4CVE-2026-88772\u304c\u5b9f\u60aa\u7528\u3001PoC\u8a73\u7d30\u3082\u516c\u958b\uff09 #SecurityOnline (Sep 30)\nsecurityonline.info/citrix-netsc...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtg66vbp26"}, {"timestamp": "2026-10-01T03:26:21.099Z", "date_only": false, "value": "2026-10-01T03:26:21.099374Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwrvxek3fc25", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "0d7bbe44-bff1-4912-a636-04c6aad8fdb6", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nCybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wil\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwrvxek3fc25"}, {"timestamp": "2026-10-01T04:43:54.017Z", "date_only": false, "value": "2026-10-01T04:43:54.017041Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mws2c2pvlm2t", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "6b59dfaa-c783-48b0-bef7-28d15a222c29", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)\n\nThis article heavily emphasizes the pre-disclosure activity to establish intent, but by focusing so much on historical TTPs, it risks downplaying the immediate, active risk presented\u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mws2c2pvlm2t"}, {"timestamp": "2026-10-01T04:52:13Z", "date_only": false, "value": "2026-10-01T04:52:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/3173", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a22005d3-00fa-4ccc-a03c-0dbf5866e73c", "content": "Citrix NetScaler CVE-2026-88772 can turn 120 crafted DTLS records into root-level shellcode execution.\n\nwatchTowr\u2019s new analysis shows how about 174 KB of reassembled data overruns a 35,840-byte scratch buffer, hijacks control flow, and uses mprotect() to bypass NX.\n\nThe flaw is already exploited in the wild.", "url": "https://t.me/CyberDispatch/3173"}, {"timestamp": "2026-10-01T04:52:13Z", "date_only": false, "value": "2026-10-01T04:52:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3173", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7cbb39ff-4369-44ac-ab96-7420d9387282", "content": "Citrix NetScaler CVE-2026-88772 can turn 120 crafted DTLS records into root-level shellcode execution.\n\nwatchTowr\u2019s new analysis shows how about 174 KB of reassembled data overruns a 35,840-byte scratch buffer, hijacks control flow, and uses mprotect() to bypass NX.\n\nThe flaw is already exploited in the wild.", "url": "https://t.me/CyberDispatch/3173"}, {"timestamp": "2026-10-01T06:45:52Z", "date_only": false, "value": "2026-10-01T06:45:52.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/infosec_ita_notizie/4207", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "63b3b1d9-a1b7-4649-a1b6-de4ac2512772", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "url": "https://t.me/infosec_ita_notizie/4207"}, {"timestamp": "2026-10-01T06:45:52Z", "date_only": false, "value": "2026-10-01T06:45:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/infosec_ita_notizie/4207", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "94529980-3313-4f6e-a999-15fef0b7db4a", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "url": "https://t.me/infosec_ita_notizie/4207"}, {"timestamp": "2026-10-01T07:44:06.302Z", "date_only": false, "value": "2026-10-01T07:44:06.302436Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "81bdd48d-6d64-4dd9-9dab-da51558c9957", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 107 interactions\nCVE-2026-88772: 105 interactions\nCVE-2026-87902: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 14 interactions\nCVE-2026-88772: 12 interactions\nCVE-2026-84782: 10 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r"}, {"timestamp": "2026-10-01T08:07:13.612Z", "date_only": false, "value": "2026-10-01T08:07:13.612583Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mwsfnmbeym2w", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ed7eccec-7431-4c8b-bd7f-09873ea2aa83", "content": "COGNOSCERE Tech Brief \u2014 2026-10-01\n\nCISA confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772, both CV\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mwsfnmbeym2w"}, {"timestamp": "2026-10-01T08:14:57.059Z", "date_only": false, "value": "2026-10-01T08:14:57.059310Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwsg3hfmwa2x", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "693a5c5d-5539-4b8b-a15b-ddcd5253f6ab", "content": "Attackers exploit Citrix NetScaler zero-day CVE-2026-88772 for root access, then hide WHIPSHOT web shells and a SLAPSHOT tunneler. Patch now.\n\n#CitrixNetScaler #ZeroDay #CVE202688772 #CVE202688771 #WHIPSHOT #SLAPSHOT #Mandiant #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwsg3hfmwa2x"}, {"timestamp": "2026-10-01T09:51:44Z", "date_only": false, "value": "2026-10-01T09:51:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "17624f98-f8f8-445a-925c-de5cd50944a1", "url": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland"}, {"timestamp": "2026-10-01T11:21:25.662Z", "date_only": false, "value": "2026-10-01T11:21:25.662239Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqisbpyg22", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "1882419a-c353-4a52-a919-255dde0a889b", "content": "Government and finance bodies got hit by weeks-long zero-day attacks on NetScaler CVE-2026-88771 and CVE-2026-88772. Here we go again with the usual corporate grief.\n\n#NetScalerAgain #PatchFatigue", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqisbpyg22"}, {"timestamp": "2026-10-01T11:21:26.824Z", "date_only": false, "value": "2026-10-01T11:21:26.824176Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqium4tp2u", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "1d5369ae-3bee-4b04-b277-8ff3b194f42a", "content": "Government and finance organisations have spent weeks being battered by zero-day attacks, because why would critical infrastructure catch a break? Security firms confirmed threat actors are joyfully exploiting NetScaler flaws CVE-2026-88771 and CVE-2026-88772 across targeted netw...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqium4tp2u"}, {"timestamp": "2026-10-01T11:26:06.627Z", "date_only": false, "value": "2026-10-01T11:26:06.627366Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwsqraxkos25", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "a0aacc61-1e6f-477b-9ce0-fbedce514b55", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\n\n\u201cAdvanced and suspected state-sponsored threat actors\u201d are likely to be behind the initial targeted intrusions that leveraged CVE-2026-88772, one of the two recently disclosed Ne\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwsqraxkos25"}, {"timestamp": "2026-10-01T17:00:06Z", "date_only": false, "value": "2026-10-01T17:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8670", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "460d2fe3-e816-42be-83be-f440bd53816a", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u044b\u0434\u0435\u043b\u0438\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435:\n\n1. TeamViewer \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u044f\u0434\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u0438 \u0445\u043e\u0441\u0442-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f - \u044d\u0442\u043e \u043e\u0431\u0445\u043e\u0434 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0441\u0441\u0438\u044f\u043c (CVE-2026-92370), \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0438\u0439 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 TeamViewer Full Client \u0438 Host \u0434\u043b\u044f Windows, Linux \u0438 macOS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0432\u0435\u0434\u0443\u0449\u0438\u0435 \u043a RCE \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u0427\u0435\u0442\u044b\u0440\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 (CVE-2026-19743), \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435 (CVE-2026-92368), \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 TOCTOU (CVE-2026-92369) \u0438 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u0443\u0442\u0438 (CVE-2026-92371), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f.\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f NT AUHORITY/SYSTEM \u0438\u043b\u0438 root.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e PoC \u0438\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043e\u043d\u0430 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c TeamViewer \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 15.82.\n\n2. \u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 Microsoft, \u0445\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421 CVE-2026-73570 (CVSS 8,9) \u0432 Zimbra Collaboration Suite (ZCS) \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 10.1.20 \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0435\u0449\u0435 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f CVE-2026-73570 \u0431\u044b\u043b\u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b 20 \u0438\u044e\u043b\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 ZCS 10.1.20, \u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043d\u0435\u0439 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 13 \u0430\u0432\u0433\u0443\u0441\u0442\u0430. \u0412 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 28 \u0438\u044e\u043b\u044f \u043f\u043e 7 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 Microsoft \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u0432\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0432\u043d\u0435 \u043f\u043e\u043b\u043e\u0441\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0442\u043e\u0447\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f.\n\n3. WatchGuard \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430, DoS-\u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0438 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0443\u0442\u0435\u0439 \u0432 Fireware OS, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 RCE.\n\nCVE-2026-86131 (CVSS 9.2), \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BOVPN \u0447\u0435\u0440\u0435\u0437 TLS.  \u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 VPN-\u0441\u0435\u0440\u0432\u0435\u0440, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u043c\u0441\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 Firebox.\n\n4. Bitget \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0443\u043a\u0440\u0430\u0432\u0448\u0438\u0435 \u0443 \u043d\u0435\u0435 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 387,5 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b., \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f 0-day \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c SlowMist \u0438 Mandiant (1 \u0438 2), \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0434\u0430\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u043e\u0439 \u0431\u0438\u0440\u0436\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0432\u044b\u0432\u043e\u0434\u0430 \u0441\u0440\u0435\u0434\u0441\u0442\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0430\u0436\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u043d\u043e\u0447\u0438 25 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f.\n\nBitget \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0431\u0435\u0449\u0430\u0435\u0442 5% \u0442\u0435\u043c, \u043a\u0442\u043e \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0438\u043b\u0438 \u0437\u0430\u043c\u043e\u0440\u043e\u0437\u0438\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n5. KiteWorks \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0431\u0440\u0430\u0434\u043e\u0432\u0430\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0442\u0435\u043c, \u0447\u0442\u043e \u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043e\u0436\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u0441\u043d\u043e\u0432\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043a \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443.\n\n\u041d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 Kiteworks \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e\u0442 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0433\u043e\u0442\u043e\u0432\u044f\u0442\u0441\u044f \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 \u0435\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b.\n\n6. \u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Python Authlib \u043d\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0443 \u0441 \u043f\u0443\u0441\u0442\u044b\u043c \u043f\u043e\u043b\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OAuth \u0438 OpenID.\n\n7. Palo Alto Networks \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438\u043c\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 50 000 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 CVE-2026-88772 \u0438 CVE-2026-88771 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 NetScaler.\n\n8. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u041f\u041e \u041d\u0430\u0442\u0430\u043d \u0424\u0430\u0440\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b Relapse, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 PS5. \u041e\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub.\n\n9. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 Google \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u043a\u0430\u043a \u0418\u0418 \u043c\u0435\u043d\u044f\u0435\u0442 \u0442\u0435\u043c\u043f\u044b \u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 GTIG, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u0430\u0436\u0434\u044b\u0439 \u043c\u0435\u0441\u044f\u0446 \u0432 2026 \u0433\u043e\u0434\u0443, \u043a\u0430\u043a \u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u043c\u0435\u0441\u044f\u0447\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445, \u0443\u0434\u0432\u043e\u0438\u043b\u043e\u0441\u044c.\n\n10. \u041f\u043e\u0437\u0438\u0442\u0438\u0432\u044b \u0432 \u0431\u043b\u043e\u0433\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043f\u0440\u043e \u0442\u043e, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043d\u0430\u0439\u0442\u0438  CVE-2026-43783: LPE \u0447\u0435\u0440\u0435\u0437 DesktopServicesHelper \u0432 macOS 26.5.", "url": "https://t.me/true_secator/8670"}, {"timestamp": "2026-10-01T17:20:54.249Z", "date_only": false, "value": "2026-10-01T17:20:54.249839Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117366799289085094", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "019786db-144c-47c2-a7ad-3c2f23aa3618", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117366799289085094"}, {"timestamp": "2026-10-01T17:21:10.781Z", "date_only": false, "value": "2026-10-01T17:21:10.781749Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtem4q7q22w", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "422d0a7a-78ac-4842-8ccc-1d82d93c4d3e", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtem4q7q22w"}, {"timestamp": "2026-10-01T17:30:28.581Z", "date_only": false, "value": "2026-10-01T17:30:28.581403Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwtf4sa6472x", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c0eb1da0-3357-4027-9607-93139c891626", "content": "\ud83d\udce2 Citrix NetScaler : d\u00e9bordement m\u00e9moire DTLS pr\u00e9authentification CVE-2026-88772 exploit\u00e9 en zero-day\n\nCet article constitue la deuxi\u00e8me partie d'une s\u00e9rie d'analyses portant sur un bulletin Citrix (CTX697096) corrigeant huit\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#CitrixNetScaler #DTLS #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwtf4sa6472x"}, {"timestamp": "2026-10-01T20:00:16.709Z", "date_only": false, "value": "2026-10-01T20:00:16.709157Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwtnioo5cz2q", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "c7245827-69a9-4c9f-9cf2-632ed029026a", "content": "Citrix NetScaler zero-days are actively exploited in the wild affecting 50K+ instances. Critical RCE vulnerabilities\u2026\n\nhttps://dev.to/mark0_617b45cda9782a/threat-brief-netscaler-zero-days-cve-2026-88771-and-cve-2026-88772-exploited-in-the-wild-2c30\n\n#networking #infrastructure", "url": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwtnioo5cz2q"}, {"timestamp": "2026-10-01T21:00:04Z", "date_only": false, "value": "2026-10-01T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "4d92c3da-bb91-4762-9591-265a756be496"}, {"timestamp": "2026-10-01T21:00:04Z", "date_only": false, "value": "2026-10-01T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "fd9237f4-10bb-4a6d-86b7-70128b944d89"}, {"timestamp": "2026-10-02T00:30:00Z", "date_only": false, "value": "2026-10-02T00:30:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/cert-se-veckobrev-v40.html", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3b75f475-ad10-443c-977e-181be3fe9de5", "url": "https://www.cert.se/2026/10/cert-se-veckobrev-v40.html"}, {"timestamp": "2026-10-02T14:17:27.056Z", "date_only": false, "value": "2026-10-02T14:17:27.056844Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkslebtp24", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "281379a0-5059-4865-bc05-5ba6fba15b54", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkslebtp24"}, {"timestamp": "2026-10-02T15:00:09Z", "date_only": false, "value": "2026-10-02T15:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104081", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "85a7fdaa-cfde-4a13-b354-6da18e887815", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler_threat_hunt_helper\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a orjanj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 14:50:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104081"}, {"timestamp": "2026-10-02T15:01:29Z", "date_only": false, "value": "2026-10-02T15:01:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sec_post/1563", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "459a072d-d417-4f5d-b8ac-5f7f3cc0d979", "content": "\ud83d\udea8 \u00ab\u0412\u0437\u043b\u043e\u043c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438\u00bb: \u0432 Citrix NetScaler \u043d\u0430\u0448\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9,5 \u2014 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0446\u0435\u043d\u0438\u043b\u0438 \u0443\u0433\u0440\u043e\u0437\u0443 \u0434\u043b\u044f \u0420\u043e\u0441\u0441\u0438\u0438\n\n\u25b6\ufe0f\u0412 NetScaler \u043e\u0442 Citrix \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 zero-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 RCE (CVE-2026-88771) \u0438 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 (CVE-2026-88772). \u041e\u0431\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043e\u0446\u0435\u043d\u043a\u0443 9,5 \u043f\u043e CVSS, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 NetScaler ADC \u0438 Gateway \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430, DDoS-\u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b. \n\n\u25b6\ufe0f\u0412 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0431\u043e\u043b\u0435\u0435 200 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0439 Citrix NetScaler, \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u2014 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442: 200 \u2014 \u00ab\u043d\u0438\u0447\u0442\u043e\u0436\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u00bb, \u043d\u043e \u044d\u0442\u043e \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f. \u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043e\u043f\u0430\u0441\u043d\u0435\u0435 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e NetScaler \u0434\u043e\u043b\u0436\u0435\u043d \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u2014 \u0435\u0433\u043e \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u043f\u0440\u044f\u0442\u0430\u0442\u044c.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 SecPost\ud83d\ude0d", "url": "https://t.me/sec_post/1563"}, {"timestamp": "2026-10-02T16:51:47.608Z", "date_only": false, "value": "2026-10-02T16:51:47.608409Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117372348454854312", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "118961c9-b6e7-4539-a287-e844555aa32f", "content": "\ud83d\udea8 Reports of NetScaler Incidents After Latest Patch Raise Concerns Over Continued Exploitation\nMultiple Citrix administrators are reporting suspicious activity affecting NetScaler appliances even after updating to version 14.1-73.37.\nThe reports surfaced on Reddit, where one administrator said multiple customers experienced incidents that caused externally accessible NetScaler appliances to repeatedly reboot.\nOther administrators reported similar behavior on newly rebuilt appliances, including systems where Enhanced ISN Generation had already been enabled. Several affected organizations said they collected forensic data and opened cases with Citrix.\nIt is currently unclear whether the activity represents successful exploitation of a new or existing vulnerability, residual compromise, vulnerability scanning, or an issue with the updated firmware.\nThe reports come days after Citrix disclosed active exploitation of CVE-2026-88771 and CVE-2026-88772, two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway.\nThe latest post-patch activity has not yet been confirmed by Citrix as exploitation.\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing\nSource: https://www.reddit.com/r/Citrix/comments/1wvwva9/netscaler_active_exploit_after_patch/?rdt=60164", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117372348454854312"}, {"timestamp": "2026-10-03T00:07:06.823Z", "date_only": false, "value": "2026-10-03T00:07:06.823786Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwwlqxqf3n2x", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "88dbaae3-a109-4c52-ad85-083a5c7705f1", "content": "\ud83d\udccc Here We Go Again: Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772 https://www.cyberhub.blog/article/32760-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772", "url": "https://bsky.app/profile/cyberhub.blog/post/3mwwlqxqf3n2x"}, {"timestamp": "2026-10-03T05:29:04.528Z", "date_only": false, "value": "2026-10-03T05:29:04.528530Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/royans.bsky.social/post/3mwx5qoxn3g2w", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "7a5cdc01-96d8-4621-acf1-b2a76c5bfe20", "content": "Bitget $388M Breach via Citrix NetScaler ADC Zero-Day Exploit\n\nhttps://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772\nhttps://flagthis.com/tldr/8192\n\n##Bitget ##ZeroDay ##LazarusGroup ##DataBreach ##Citrix", "url": "https://bsky.app/profile/royans.bsky.social/post/3mwx5qoxn3g2w"}, {"timestamp": "2026-10-03T07:03:23.218Z", "date_only": false, "value": "2026-10-03T07:03:23.218228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwxcz4x2cr2v", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "633765cf-db76-44c8-b3ad-5f5755fcc8fe", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 112 interactions\nCVE-2026-88772: 106 interactions\nCVE-2026-86950: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-5715: 12 interactions\nCVE-2026-104286: 11 interactions\nCVE-2026-93698: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwxcz4x2cr2v"}, {"timestamp": "2026-10-03T08:40:53.313Z", "date_only": false, "value": "2026-10-03T08:40:53.313040Z", "kind": "sighting", "label": "Seen", "source": "https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "252c9dc2-75ff-4944-9e36-24ce57a0d92e", "url": "https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html"}, {"timestamp": "2026-10-03T13:31:26.274Z", "date_only": false, "value": "2026-10-03T13:31:26.274710Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/rcinghio.bsky.social/post/3mwxyp75esk2j", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "c133b708-aa5a-4947-864d-cc96e9ea5b2c", "content": "Researchers at Mandiant and Google Threat Intelligence Group (GTIG) say that a critical memory overflow vulnerability in #Citrix NetScaler ADC and Citrix NetScaler Gateway (CVE-2026-88772, CVSS score 9.5) was exploited weeks before it was disclosed.\nwww.theregister.com/security/202...", "url": "https://bsky.app/profile/rcinghio.bsky.social/post/3mwxyp75esk2j"}, {"timestamp": "2026-10-03T19:05:05.901Z", "date_only": false, "value": "2026-10-03T19:05:05.901801Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117378534840533079", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "2c2149bd-c59f-4458-ad12-0a8f9f8fb087", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117378534840533079"}, {"timestamp": "2026-10-03T19:05:29.583Z", "date_only": false, "value": "2026-10-03T19:05:29.583110Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwylekl2bf2b", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "747aa47a-87ed-4d7d-aa3a-2c86250b8696", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwylekl2bf2b"}, {"timestamp": "2026-10-03T20:19:19.892Z", "date_only": false, "value": "2026-10-03T20:19:19.892443Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pylos.co/post/3mwypidhmpc2c", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3385df8a-0f98-4b40-9400-14991a64fadb", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.cyber.gov.au/about-us/vie...", "url": "https://bsky.app/profile/pylos.co/post/3mwypidhmpc2c"}, {"timestamp": "2026-10-03T20:19:20.626Z", "date_only": false, "value": "2026-10-03T20:19:20.626274Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mwypim3wqu2w", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "237b3e28-ca3f-4a34-85f1-173dbd47f65c", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.potato.gov.au/about-us/vie...", "url": "https://bsky.app/profile/potato.software/post/3mwypim3wqu2w"}, {"timestamp": "2026-10-04T00:00:00Z", "date_only": true, "value": "2026-10-04", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-10-04T01:00:04.277Z", "date_only": false, "value": "2026-10-04T01:00:04.277457Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybermaster77.bsky.social/post/3mwz76kqbyx2t", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "8a1765b9-8e2c-4b72-a673-b9a08b9f64d7", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nhttps://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html\n\n#CyberSecurity #InfoSec", "url": "https://bsky.app/profile/cybermaster77.bsky.social/post/3mwz76kqbyx2t"}, {"timestamp": "2026-10-04T04:01:44.702Z", "date_only": false, "value": "2026-10-04T04:01:44.702354Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwzjdgiytl23", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "6ef7d813-2d90-4650-8392-14f6f6052554", "content": "~Cybergcca~\nActively exploited NetScaler flaws enable remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwzjdgiytl23"}, {"timestamp": "2026-10-04T07:21:43.574Z", "date_only": false, "value": "2026-10-04T07:21:43.574104Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwzuizzpzn2j", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9c698cc2-b2ed-4a7f-83af-b49c4848b72c", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 122 interactions\nCVE-2026-88772: 118 interactions\nCVE-2026-86950: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 12 interactions\nCVE-2026-88771: 10 interactions\nCVE-2026-104286: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwzuizzpzn2j"}, {"timestamp": "2026-10-04T18:12:35.094Z", "date_only": false, "value": "2026-10-04T18:12:35.094299Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mx2yurda4h2r", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "2fdf9d91-e121-4b62-ba99-83c33dcb5fe9", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-88772", "url": "https://bsky.app/profile/csirts.com/post/3mx2yurda4h2r"}, {"timestamp": "2026-10-05T00:00:00Z", "date_only": false, "value": "2026-10-05T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "last_revision_date"}, {"timestamp": "2026-10-05T00:00:00Z", "date_only": false, "value": "2026-10-05T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "revisions.4.revision_date"}, {"timestamp": "2026-10-05T02:15:35Z", "date_only": false, "value": "2026-10-05T02:15:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-10-05/Ny-Citrix-0-dag-rammer-selv-nyopdaterede-NetScaler-enheder", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e548ec07-d91a-4c8f-9954-34828ed2e2e9", "url": "https://www.cert.dk/news/2026-10-05/Ny-Citrix-0-dag-rammer-selv-nyopdaterede-NetScaler-enheder"}, {"timestamp": "2026-10-05T07:38:39.687Z", "date_only": false, "value": "2026-10-05T07:38:39.687831Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx4fwaoq6x2e", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9adab1de-b842-486f-9a6f-3393cd620cd6", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 72 interactions\nCVE-2026-88772: 70 interactions\nCVE-2026-104286: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 23 interactions\nCVE-2026-61500: 4 interactions\nCVE-2026-105123: 3 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mx4fwaoq6x2e"}, {"timestamp": "2026-10-05T13:48:41.109Z", "date_only": false, "value": "2026-10-05T13:48:41.109973Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mx52lvb3um2y", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "9a103e0a-090d-4100-b0d7-af54591287eb", "content": "Citrix NetScaler customers report repeated reboots after installing emergency update 14.1-73.37, addressing two zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772). The reboots are linked to crafted SAML traffic crashing the nsaaad service.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mx52lvb3um2y"}, {"timestamp": "2026-10-05T16:15:51.336Z", "date_only": false, "value": "2026-10-05T16:15:51.336989Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mx5ct2ofjp2u", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "961e7479-ab4e-457f-9ef7-c39983080097", "content": "\ud83d\udce1 Citrix NetScaler Zero-Days (CVE-2026-88771 and CVE-2026-88772): A Skeleton Key at the Network Edge", "url": "https://bsky.app/profile/insomnisec.bsky.social/post/3mx5ct2ofjp2u"}, {"timestamp": "2026-10-06T08:04:34.682Z", "date_only": false, "value": "2026-10-06T08:04:34.682546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx6xths6tr2u", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e0737677-0aed-489b-a268-697a3de8a7af", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88772: 57 interactions\nCVE-2026-88771: 52 interactions\nCVE-2026-104286: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 12 interactions\nCVE-2026-17989: 7 interactions\nCVE-2026-19556: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mx6xths6tr2u"}, {"timestamp": "2026-10-06T13:45:12.111Z", "date_only": false, "value": "2026-10-06T13:45:12.111602Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theravenfile.bsky.social/post/3mx7kv34hsk2z", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "0a274de9-3a2f-43d3-8e77-e45a20547eb7", "content": "Today, I just dropped an article which might be useful while hunting ongoing #0day #exploit of #citrix #netscalar!\n\ntheravenfile.com/2026/10/06/cit\nrix-0-day-exploits-cve-2026-88771-cve-2026-88772-in-the-wild/\n\n#ZeroDay #Malware #Slapshot #Whipshot #Python #infosec #security #OSINT #ThreatIntel #CVE", "url": "https://bsky.app/profile/theravenfile.bsky.social/post/3mx7kv34hsk2z"}, {"timestamp": "2026-10-06T15:46:13.730Z", "date_only": false, "value": "2026-10-06T15:46:13.730886Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jshannonquest.bsky.social/post/3mx7rmyf26q2s", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "7bacfcc8-a735-47c9-af2f-880215ed664e", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution http://my.sociabble.com/Bav1mJMsqVeD", "url": "https://bsky.app/profile/jshannonquest.bsky.social/post/3mx7rmyf26q2s"}, {"timestamp": "2026-10-06T21:51:48.456Z", "date_only": false, "value": "2026-10-06T21:51:48.456172Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tier1solutionsllc.bsky.social/post/3mxag2p77m42y", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "3bcf9ac8-58d1-4ee4-9dd8-39ffa87a16e0", "content": "\ud835\uddd6\ud835\uddf6\ud835\ude01\ud835\uddff\ud835\uddf6\ud835\ude05 \ud835\udde1\ud835\uddf2\ud835\ude01\ud835\udde6\ud835\uddf0\ud835\uddee\ud835\uddf9\ud835\uddf2\ud835\uddff \ud835\uddd6\ud835\udde9\ud835\uddd8-\ud835\udfee\ud835\udfec\ud835\udfee\ud835\udff2-\ud835\udff4\ud835\udff4\ud835\udff3\ud835\udff3\ud835\udfee \ud835\uddd8\ud835\ude05\ud835\uddfd\ud835\uddf9\ud835\uddfc\ud835\uddf6\ud835\ude01 \ud835\uddd7\ud835\uddf2\ud835\ude01\ud835\uddee\ud835\uddf6\ud835\uddf9\ud835\ude00 \ud835\udde6\ud835\uddf5\ud835\uddfc\ud835\ude04 \ud835\udde3\ud835\uddff\ud835\uddf2-\ud835\uddd4\ud835\ude02\ud835\ude01\ud835\uddf5 \ud835\udde3\ud835\uddee\ud835\ude01\ud835\uddf5 \ud835\ude01\ud835\uddfc \ud835\udde6\ud835\uddf5\ud835\uddf2\ud835\uddf9\ud835\uddf9\ud835\uddf0\ud835\uddfc\ud835\uddf1\ud835\uddf2 \ud835\uddd8\ud835\ude05\ud835\uddf2...\nhttps://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html\nCall us for a FREE IT Assessment! (888) 999-2709", "url": "https://bsky.app/profile/tier1solutionsllc.bsky.social/post/3mxag2p77m42y"}, {"timestamp": "2026-10-07T04:01:44.093Z", "date_only": false, "value": "2026-10-07T04:01:44.093911Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxb2q6zcv223", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "09de5045-6eb4-4e14-b1f2-e373518ab676", "content": "~Asec~\nAttackers exploited perimeter devices, poisoned packages, and hijacked identity sessions for persistence and expansion.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772, CVE-2026-20079\n-\n#IdentityAttack #SupplyChain #ThreatIntel #WebShell", "url": "https://bsky.app/profile/cyfar.ca/post/3mxb2q6zcv223"}, {"timestamp": "2026-10-07T11:10:09.610Z", "date_only": false, "value": "2026-10-07T11:10:09.610968Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secpoint.bsky.social/post/3mxbso7hye222", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "82922fd6-614f-48c7-858c-05a6c9905121", "content": "Citrix NetScaler security alert: two actively exploited vulnerabilities\n\nCitrix has confirmed exploitation of CVE-2026-88771 and CVE-2026-88772 in unmitigated NetScaler deployments.\n\nwww.linkedin.com/products/sec...\n\n#NetScaler #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator", "url": "https://bsky.app/profile/secpoint.bsky.social/post/3mxbso7hye222"}, {"timestamp": "2026-10-09T03:25:00Z", "date_only": false, "value": "2026-10-09T03:25:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/cert-se-veckobrev-v41.html", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "10e14c2a-b00c-45d7-aa62-2a6dfe78010a", "url": "https://www.cert.se/2026/10/cert-se-veckobrev-v41.html"}, {"timestamp": "2026-10-09T09:05:55.663Z", "date_only": false, "value": "2026-10-09T09:05:55.663874Z", "kind": "sighting", "label": "Seen", "source": "https://www.nextron-systems.com/2026/10/06/update-on-citrix-netscaler-cve-2026-88771-and-cve-2026-88772-expanded-thor-detection-coverage/", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d321fa55-f7ee-4767-b640-cb95a20fd7ac", "url": "https://www.nextron-systems.com/2026/10/06/update-on-citrix-netscaler-cve-2026-88771-and-cve-2026-88772-expanded-thor-detection-coverage/"}, {"timestamp": "2026-10-12T03:59:53.342Z", "date_only": false, "value": "2026-10-12T03:59:53.342301Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinity.sh/post/3mxnmxibtax2c", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "d8bc4816-042e-4c06-b728-b44a3d95e96b", "content": "Two zero-days. One chain. NetScaler ADC CVE-2026-88772 (DTLS heap overflow) + CVE-2026-88771 (log injection) actively exploited since September. Mandiant found WHIPSHOT PHP shell + SLAPSHOT tunneler. Public PoC. CISA KEV. CVSS 9.5.\nhttps://trinity.sh/posts/2026-10-12-citrix-netscaler-adc-zero-days/", "url": "https://bsky.app/profile/trinity.sh/post/3mxnmxibtax2c"}, {"timestamp": "2026-10-12T15:35:36.345Z", "date_only": false, "value": "2026-10-12T15:35:36.345827Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kimbodo.bsky.social/post/3mxottjnpjt2n", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "e33d2c7f-8028-4142-bfcf-5467a9c6b49f", "content": "Internet-facing appliances and AI agents require urgent attention as new risks emerge.\n\nUnit 42 reports active exploitation of Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772), alongside Zimbra mail server vulnerabilities. These have prompted urgent patching\u2026\n\nRead more on Kimbodo:", "url": "https://bsky.app/profile/kimbodo.bsky.social/post/3mxottjnpjt2n"}, {"timestamp": "2026-10-13T16:02:12.878Z", "date_only": false, "value": "2026-10-13T16:02:12.878106Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mxrfrzcjb225", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "61bd882e-e8b4-4aa9-bec7-82202525299b", "content": "Kwetsbaarheden in Citrix NetScaler leiden tot wereldwijde exploitatie\n\nTwee kritieke zero-day kwetsbaarheden in Citrix NetScaler ADC en NetScaler Gateway worden momenteel wereldwijd actief misbruikt. De kwetsbaarheden, aangeduid als CVE-2026-88771 en CVE-2026-88772, stellen aanval...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mxrfrzcjb225"}, {"timestamp": "2026-10-14T04:04:53.647Z", "date_only": false, "value": "2026-10-14T04:04:53.647004Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxso6bdfhy23", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "725be3ef-bf6e-470a-99b7-9deefcf38843", "content": "~Recordedfuture~\n94 high-impact vulnerabilities surfaced; zero-days and active exploitation targeted NetScaler, PeopleSoft, Cisco FMC, and PaperCut.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772, CVE-2026-35273\n-\n#CVE #ThreatIntel #VulnerabilityManagement", "url": "https://bsky.app/profile/cyfar.ca/post/3mxso6bdfhy23"}, {"timestamp": "2026-10-14T16:56:44.901Z", "date_only": false, "value": "2026-10-14T16:56:44.901670Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggcfs2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "cb88b883-71a2-4b94-9928-753033fe4c6e", "content": "(5/5)\n\nAccording to the manufacturer, attacks on unpatched installations had been observed for CVE-2026-88771 and CVE-2026-88772. The U.S. agency CISA added both to its catalog of exploited vulnerabilities that same day.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggcfs2f"}, {"timestamp": "2026-10-14T16:56:46.336Z", "date_only": false, "value": "2026-10-14T16:56:46.336385Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2k2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "92c0b5c3-7ba4-4941-8173-8be6445e7f0f", "content": "(5/5)\n\nAccording to the manufacturer, attacks on unpatched installations had been observed for CVE-2026-88771 and CVE-2026-88772. The U.S. agency CISA added both to its catalog of exploited vulnerabilities that same day.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2k2f"}, {"timestamp": "2026-10-14T16:56:47.875Z", "date_only": false, "value": "2026-10-14T16:56:47.875047Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2l2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "6bb813fa-4f93-45f6-96cf-07331cbea921", "content": "(5/5)\n\nAccording to the manufacturer, attacks on unpatched installations had been observed for CVE-2026-88771 and CVE-2026-88772. The U.S. agency CISA added both to its catalog of exploited vulnerabilities that same day.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2l2f"}, {"timestamp": "2026-10-14T16:56:49.353Z", "date_only": false, "value": "2026-10-14T16:56:49.353112Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzt2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "3fbc8c2b-621b-4107-a381-b5b198f3418c", "content": "(5/5)\n\nAccording to the manufacturer, attacks on unpatched installations had been observed for CVE-2026-88771 and CVE-2026-88772. The U.S. agency CISA added both to its catalog of exploited vulnerabilities that same day.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzt2f"}, {"timestamp": "2026-10-14T16:56:50.784Z", "date_only": false, "value": "2026-10-14T16:56:50.784148Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzu2f", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "fc379263-31e6-43f1-9371-65a64b6405e1", "content": "(5/5)\n\nAccording to the manufacturer, attacks on unpatched installations had been observed for CVE-2026-88771 and CVE-2026-88772. The U.S. agency CISA added both to its catalog of exploited vulnerabilities that same day.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzu2f"}, {"timestamp": "2026-10-17T07:00:05.808Z", "date_only": false, "value": "2026-10-17T07:00:05.808754Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3my2jecpqkm22", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "2d51d03d-a444-4b71-a9e9-61380cf67413", "content": "New in the known-exploited catalogue: CVE-2026-88772 in netscaler_application_delivery_controller. Exploited in the wild \u2014 the only phrase in this field that still means exactly what it says.\n\nPatch the edge appliance. It is always the edge appliance.", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3my2jecpqkm22"}, {"timestamp": "2026-10-18T02:12:49.930Z", "date_only": false, "value": "2026-10-18T02:12:49.930298Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/imtechboss.bsky.social/post/3my4jrlnoqo26", "record": "cve-2026-88772", "field": "creation_timestamp", "uuid": "e02f1699-9336-444c-adeb-02064745d9df", "content": "\u26a1 Critical Citrix NetScaler Zero-Day CVE-2026-88772 Exploited in Wild with WHIPSHOT Malware\n\nSecurity researchers have war...\n\n\ud83d\udc49 Full Story: https://imtechboss.com/post.html?id=critical-citrix-netscaler-zero-day-cve-2026-88772-whipshot-malware-2026\n#Tech #Cybersecurity #Citrix", "url": "https://bsky.app/profile/imtechboss.bsky.social/post/3my4jrlnoqo26"}, {"timestamp": "2026-10-19T11:34:27Z", "date_only": false, "value": "2026-10-19T11:34:27.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3cfda13f-241d-4c9b-8abd-083f61364496", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "ff6f5d3d-f192-474a-a928-c5de49c5ed42"}, {"timestamp": "2026-10-19T12:04:29Z", "date_only": false, "value": "2026-10-19T12:04:29.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/4d65b53a-fe95-4950-b906-9d3df9a04078", "record": "CVE-2026-88772", "field": "creation_timestamp", "uuid": "94896871-71bf-4135-a50d-5f32459733c2"}]}