https://vulnerability.circl.lu/sightings/feed 2026-09-28T05:28:07.276212+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/2e809211-b521-4b27-85eb-d6e3a7989217/export 2026-09-28T05:28:07.303146+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "2e809211-b521-4b27-85eb-d6e3a7989217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26", "content": "~Cisa~\nThreat actors are globally exploiting two critical NetScaler zero-days enabling remote code execution.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "creation_timestamp": "2026-09-28T04:04:23.148825Z"} 2026-09-28T04:04:23.148825+00:00 https://vulnerability.circl.lu/sighting/aa53e811-fe14-4839-83e0-d2f04fffb281/export 2026-09-28T05:28:07.305549+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "aa53e811-fe14-4839-83e0-d2f04fffb281", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 27\uff09\n\nCVE-2026-88771 Citrix NetScaler \u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\nCVE-2026-88772 Citrix NetScaler\u306b\u304a\u3051\u308b\u30e1\u30e2\u30ea\u30d0\u30c3\u30d5\u30a1\u306e\u7bc4\u56f2\u5185\u3067\u306e\u64cd\u4f5c\u306e\u4e0d\u9069\u5207\u306a\u5236\u9650\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-28T03:24:17.900852Z"} 2026-09-28T03:24:17.900852+00:00 https://vulnerability.circl.lu/sighting/24eca138-b129-4c85-9853-9c2a6c98b3d9/export 2026-09-28T05:28:07.305845+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "24eca138-b129-4c85-9853-9c2a6c98b3d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mwjycask222o", "content": "CISA added Citrix NetScaler flaw CVE-2026-88772 to its Known Exploited Vulnerabilities catalog.\n\n\u2022 Memory buffer bug in NetScaler ADC and Gateway, RCE or DoS\n\nhttps://thecircuitry.to/article/cisa-adds-citrix-netscaler-cve-2026-88772-to-kev-catalog-mukcx3d4", "creation_timestamp": "2026-09-27T23:46:55.681356Z"} 2026-09-27T23:46:55.681356+00:00 https://vulnerability.circl.lu/sighting/02f4897b-6568-413e-940d-7315df121422/export 2026-09-28T05:28:07.306063+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "02f4897b-6568-413e-940d-7315df121422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l", "content": "Emergency Citrix Patch and the $2.2M Vendor Liability Lesson\n\nFirst, Citrix has confirmed that two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and NetScaler Gateway are being actively exploited by attackers.\n\nhttps://youtu.be/ean43KG9b1g", "creation_timestamp": "2026-09-27T23:16:13.679672Z"} 2026-09-27T23:16:13.679672+00:00 https://vulnerability.circl.lu/sighting/127abcbd-f200-4b65-9512-7b78cc19fdba/export 2026-09-28T05:28:07.306263+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "127abcbd-f200-4b65-9512-7b78cc19fdba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w", "content": "Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.\n\nwww.deyda.net/index.php/en...\n\n#DeydaConsulting #NetScaler #Citrix", "creation_timestamp": "2026-09-27T23:03:26.982064Z"} 2026-09-27T23:03:26.982064+00:00 https://vulnerability.circl.lu/sighting/7938bc4b-f8c7-4e2c-ad24-50b1513f31b4/export 2026-09-28T05:28:07.306458+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7938bc4b-f8c7-4e2c-ad24-50b1513f31b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"} 2026-09-27T23:00:40+00:00 https://vulnerability.circl.lu/sighting/160b7eb5-9877-422c-9757-81986047d995/export 2026-09-28T05:28:07.306708+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "160b7eb5-9877-422c-9757-81986047d995", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44635", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability\nCVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-27T23:00:38.000000Z"} 2026-09-27T23:00:38+00:00 https://vulnerability.circl.lu/sighting/a886ab4c-709e-4070-b7fd-0bd5e7711a40/export 2026-09-28T05:28:07.306926+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a886ab4c-709e-4070-b7fd-0bd5e7711a40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44631", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-27T23:00:31.000000Z"} 2026-09-27T23:00:31+00:00 https://vulnerability.circl.lu/sighting/0fe93264-4990-4f0d-b5b0-79aef737fe8d/export 2026-09-28T05:28:07.307031+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0fe93264-4990-4f0d-b5b0-79aef737fe8d", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25ce362a-a184-4ea6-83c7-64bb2a2242a3", "content": "", "creation_timestamp": "2026-09-27T22:00:02.520287Z"} 2026-09-27T22:00:02.520287+00:00 https://vulnerability.circl.lu/sighting/e1f359ea-b17b-4155-9585-243c75edf0c2/export 2026-09-28T05:28:07.307132+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e1f359ea-b17b-4155-9585-243c75edf0c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6q65g32l", "content": "\ud83d\uded1 CVE-2026-88772\nCitrix NetScaler\nCVSS 9.5 / KEV: No\nTL;DR: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 1\u2026\nhttps://cvesentinel.com/report/CVE-2026-88772?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-27T21:57:34.718026Z"} 2026-09-27T21:57:34.718026+00:00