{"vulnerability": "CVE-2026-8877", "sightings": [{"uuid": "3c6c9ee8-d417-4b7e-9193-3cb98792bd8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.dk/node/639", "content": "", "creation_timestamp": "2026-09-29T02:25:32.000000Z"}, {"uuid": "ac8f081d-1b10-4c9c-8f94-1f89c82e1902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.cert.dk/node/639", "content": "", "creation_timestamp": "2026-09-29T02:25:32.000000Z"}, {"uuid": "fbc5ec1c-2e49-4622-a73a-5f36f200d682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.cert.dk/node/639", "content": "", "creation_timestamp": "2026-09-29T02:25:32.000000Z"}, {"uuid": "86b96ece-30b3-4423-b93f-7915b608e0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.cert.dk/node/639", "content": "", "creation_timestamp": "2026-09-29T02:25:32.000000Z"}, {"uuid": "caa5910b-2001-4413-8db1-dee22b005856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88770", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mv5kmvecu42p", "content": "Keycloak's device login flow hands fresh tokens to a brute-force-locked account, if an attacker already holds a session (CVE-2026-88770).\n\nNo fix published yet.\n\nDisable the device grant on clients that do not use it.", "creation_timestamp": "2026-09-10T07:45:11.398391Z"}, {"uuid": "5f743faf-1b83-424d-9be5-ac2dcb3821cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88770", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/c6rxygwlblj5a", "content": "CVE-2026-88770 - Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts\nCVE ID : CVE-2026-88770\n \n Published : 10. September 2026 07:18 | 19\u00a0Minuten ago\n \n Description : A flaw was found in the Device Authorization Grant f...", "creation_timestamp": "2026-09-10T08:05:52.069690Z"}, {"uuid": "9f45ce3e-3537-4e24-b4a8-9fa0079038f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117343729453093307", "content": "Netscaler CVEs are out:\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nPatch isn\u2019t yet through QA at Citrix still, been a week :02angery: \nThe primary vulns being exploited are 2026-88771, CVE-2026-88772, CVE-2026-88773 chained. \nIt gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.", "creation_timestamp": "2026-09-27T15:33:53.431710Z"}, {"uuid": "e455b22d-cf40-4e21-b1f3-a47722753000", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117343729453093307", "content": "Netscaler CVEs are out:\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nPatch isn\u2019t yet through QA at Citrix still, been a week :02angery: \nThe primary vulns being exploited are 2026-88771, CVE-2026-88772, CVE-2026-88773 chained. \nIt gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.", "creation_timestamp": "2026-09-27T15:33:53.505942Z"}, {"uuid": "778bd81f-696c-405b-b30b-47f86267adef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "eb427720-b451-4551-a76b-1004ffda242c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "130e18f8-6241-43aa-b23e-508ca3262bd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "a2ec951f-50c1-4376-9ccd-163d0bd9cf79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "d2b9b215-7aba-4cff-9776-15b45e04ddd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "0e8837c4-25c4-4007-bdd7-1864cc2089bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "d78d3b23-c7d4-4791-a2c2-199563c4a704", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "3f28c353-dd58-417e-a0b5-0b6142e49531", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "3e75b273-f7ce-4690-84c8-1a8ccbb87b27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.349482Z"}, {"uuid": "9446ec5b-a9eb-4fff-97c5-1a33c41315a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.372309Z"}, {"uuid": "0e466086-c6ba-4288-a51f-5f70954f5a7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.394147Z"}, {"uuid": "bdf6fdda-48ec-4b8d-90e4-ed67d963fb33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.424030Z"}, {"uuid": "0616f6b9-4753-42ae-88d6-fe3fe6778e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.444283Z"}, {"uuid": "7e4f1864-22ee-48df-bb1d-6af65faee780", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.464160Z"}, {"uuid": "f7b878b7-7d1d-4fca-92cd-b48838cb3a6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.481970Z"}, {"uuid": "d0922126-0fe1-43ab-bba6-a9c70a2fddb4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.503327Z"}, {"uuid": "4aeddb2b-ed5e-4f6b-ba73-cbfafec0d5f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.084913Z"}, {"uuid": "4ba35f4c-b84a-455a-992b-608802992a9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.116411Z"}, {"uuid": "15cec252-6f02-4eda-b14a-4c72278e19f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.145220Z"}, {"uuid": "fcd56676-87f1-496b-b832-03cd8ad9a25f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.181774Z"}, {"uuid": "d0060fd6-c4bc-4ae6-bfb5-6c8e8bd1e16e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.211697Z"}, {"uuid": "ab514576-8aab-49b9-b51b-7bb0159c5611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.240540Z"}, {"uuid": "8a6c8bef-d3cc-4da5-aa6c-9c01ce9d0b87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.266622Z"}, {"uuid": "50f3664f-2fc7-47d9-aca6-315d3e856c36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.297320Z"}, {"uuid": "d07adbae-1083-41f9-b5c2-4268bc7cf2a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwj77jedpp2r", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow", "creation_timestamp": "2026-09-27T16:18:00.604098Z"}, {"uuid": "c4ed17da-156d-4313-b5b3-d9fbd875d349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwj77jedpp2r", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow", "creation_timestamp": "2026-09-27T16:18:00.663286Z"}, {"uuid": "937e2885-0a10-4198-b10c-7cde52aa6896", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwj77jtazd2x", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #PotatoSecurity #VPN #watchTowr #PatchNow", "creation_timestamp": "2026-09-27T16:18:01.339220Z"}, {"uuid": "9a5cf148-80d1-42a2-944f-15f019ddf243", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwj77jtazd2x", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #PotatoSecurity #VPN #watchTowr #PatchNow", "creation_timestamp": "2026-09-27T16:18:01.362808Z"}, {"uuid": "f0762419-c794-4f74-87a0-1934d31c3000", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cherdt.bsky.social/post/3mwj7jogrcc2y", "content": "Citrix released patched today for 8 NetScaler vulnerabilities, CVE-2026-88771 through CVE-2026-88778.\n\nAlthough I don't know all the details, word is that one or more of these vulnerabilities are being actively exploited. Patch as soon as possible.", "creation_timestamp": "2026-09-27T16:23:40.577848Z"}, {"uuid": "528341dc-9ce9-4035-a3e3-266c339a9268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/cherdt.bsky.social/post/3mwj7jogrcc2y", "content": "Citrix released patched today for 8 NetScaler vulnerabilities, CVE-2026-88771 through CVE-2026-88778.\n\nAlthough I don't know all the details, word is that one or more of these vulnerabilities are being actively exploited. Patch as soon as possible.", "creation_timestamp": "2026-09-27T16:23:40.623601Z"}, {"uuid": "0844fe5f-b763-46e3-88ab-3588cae10539", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117343976965806995", "content": "A new vulnerability with increased severity was disclosed for Citrix ADC and Gateway (CVE-2026-88771) https://vuldb.com/vuln/410912", "creation_timestamp": "2026-09-27T16:36:33.859256Z"}, {"uuid": "92f83da8-6ed7-4c6c-a3bc-37d465642672", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwjatkxqkq2l", "content": "CVE-2026-88776, CVE-2026-88777 and CVE-2026-88778 affect Citrix NetScaler ADC and Gateway: two memory overflow flaws that can cause denial of service and a TCP sequence-number prediction issue. Citrix has released fixes in 14.1-73.37 and 13.1-64.23.", "creation_timestamp": "2026-09-27T16:47:06.835654Z"}, {"uuid": "0a9ac8e4-6bc0-42af-91e1-d39b8f5a3feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwjatkxqkq2l", "content": "CVE-2026-88776, CVE-2026-88777 and CVE-2026-88778 affect Citrix NetScaler ADC and Gateway: two memory overflow flaws that can cause denial of service and a TCP sequence-number prediction issue. Citrix has released fixes in 14.1-73.37 and 13.1-64.23.", "creation_timestamp": "2026-09-27T16:47:06.891697Z"}, {"uuid": "1b66404c-b90a-468f-8991-e6e5b68c0ca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwjatkxqkq2l", "content": "CVE-2026-88776, CVE-2026-88777 and CVE-2026-88778 affect Citrix NetScaler ADC and Gateway: two memory overflow flaws that can cause denial of service and a TCP sequence-number prediction issue. Citrix has released fixes in 14.1-73.37 and 13.1-64.23.", "creation_timestamp": "2026-09-27T16:47:06.940755Z"}, {"uuid": "7a3987ee-1edf-483a-9498-e99b59aa9f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/thehackernews/10175", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T16:24:30.000000Z"}, {"uuid": "1559646a-e87f-4d5d-8a4d-ebd9da4b9efc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/thehackernews/10175", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T16:24:30.000000Z"}, {"uuid": "6a8aa976-51df-4ec2-8b7e-1d9055befba7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mwjbkwf7sc22", "content": "\ud83d\udea8 CVE-2026-88771 & CVE-2026-88772: Citrix has patched two exploited NetScaler zero-days (CVSS 9.5). Update to 14.1-73.37 / 13.1-64.23 and check for compromise.\nwww.cyberkendra.com/2026/09/cve-... \n\n#citrixvulnerability #netscaler #zeroday #infosec", "creation_timestamp": "2026-09-27T17:00:13.418058Z"}, {"uuid": "8850041a-d8e7-4ced-9f67-139020f4d4e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mwjbkwf7sc22", "content": "\ud83d\udea8 CVE-2026-88771 & CVE-2026-88772: Citrix has patched two exploited NetScaler zero-days (CVSS 9.5). Update to 14.1-73.37 / 13.1-64.23 and check for compromise.\nwww.cyberkendra.com/2026/09/cve-... \n\n#citrixvulnerability #netscaler #zeroday #infosec", "creation_timestamp": "2026-09-27T17:00:13.448668Z"}, {"uuid": "c9379a8a-1312-4bc4-9a72-c7aeae252056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwjblzg2jz2p", "content": "Citrix lanceert noodupdates na actieve uitbuiting van kritieke kwetsbaarheden in\n\nCitrix heeft beveiligingsupdates uitgebracht voor NetScaler ADC en NetScaler Gateway vanwege twee kritieke kwetsbaarheden, CVE-2026-88771 en CVE-2026-88772, die momenteel actief worden uitgebuit. Beide kwetsbaa...", "creation_timestamp": "2026-09-27T17:00:47.360581Z"}, {"uuid": "b588ecb0-da1e-46d6-b6c0-6e00ae21ca4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwjblzg2jz2p", "content": "Citrix lanceert noodupdates na actieve uitbuiting van kritieke kwetsbaarheden in\n\nCitrix heeft beveiligingsupdates uitgebracht voor NetScaler ADC en NetScaler Gateway vanwege twee kritieke kwetsbaarheden, CVE-2026-88771 en CVE-2026-88772, die momenteel actief worden uitgebuit. Beide kwetsbaa...", "creation_timestamp": "2026-09-27T17:00:47.386547Z"}, {"uuid": "3932fa41-0225-4ea3-9fdc-409e13bc9825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjc6lkxem2k", "content": "\ud83e\udd16 Citrix NetScaler: 2 RCE zero-days exploited pre-patch, CVSS 9.5 each. CVE-2026-88771 hits every deployment (unauth cmd exec); CVE-2026-88772 via DTLS, default on VPN vservers. Fixed: 14.1-73.37 / 13.1-64.23.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T17:11:09.472954Z"}, {"uuid": "113b3d18-d054-42af-861d-6796c11c9c25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjc6lkxem2k", "content": "\ud83e\udd16 Citrix NetScaler: 2 RCE zero-days exploited pre-patch, CVSS 9.5 each. CVE-2026-88771 hits every deployment (unauth cmd exec); CVE-2026-88772 via DTLS, default on VPN vservers. Fixed: 14.1-73.37 / 13.1-64.23.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T17:11:09.500649Z"}, {"uuid": "3f13ee84-c694-45be-aad3-1fc12e9323fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.128015Z"}, {"uuid": "43d1d354-622b-490d-a9d6-97c0a54dfed8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.170532Z"}, {"uuid": "07aefa2b-5b0c-4b17-a574-9c812b56e82b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.193992Z"}, {"uuid": "2c8613fc-549f-48f2-97a1-b1dab1f14b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.219130Z"}, {"uuid": "766eb797-4554-4fd2-8ae7-7f395e070f52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.241171Z"}, {"uuid": "def9b8d8-8798-4f5a-b096-fefad4ffa16a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.261178Z"}, {"uuid": "306e1816-9420-4793-ba03-cac93fea196b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.280684Z"}, {"uuid": "a40da773-9e74-4714-9b8d-e56eecb14274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.296873Z"}, {"uuid": "3134c878-4028-4657-ab0e-47b2afea2f42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/thehackernews/10175", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T16:24:30.000000Z"}, {"uuid": "8b3793f4-95ad-4a7e-97fd-d23d70f00ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/thehackernews/10175", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T16:24:30.000000Z"}, {"uuid": "2f40124f-2f26-44b2-b2b4-482c6cfe3367", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfcmp2oj25", "content": "\ud83d\udea8 CVE-2026-88771 \u2014 CVSS 9.5 CRITICAL\n\nImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue af...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88771\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-27T18:07:06.253715Z"}, {"uuid": "25a9e822-0727-4448-a76b-8ad124a06e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfcuplch2i", "content": "\ud83d\udea8 CVE-2026-88772 \u2014 CVSS 9.5 CRITICAL\n\nVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88772\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-27T18:07:14.377015Z"}, {"uuid": "56e1fab4-7a48-48cf-af9b-ae6903f05b27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfd4qhfj26", "content": "\ud83d\udea8 CVE-2026-88773 \u2014 CVSS 9.3 CRITICAL\n\nInconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix Ne...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88773\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-27T18:07:22.625333Z"}, {"uuid": "fdd083de-6b50-4fd4-851c-5ed63c9e0c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfhwp7rv2k", "content": "CVE-2026-88771\nOlder versions of Citrix NetScaler ADC and NetScaler Gateway do not properly check certain inputs, which could let an unauthenticated attacker run commands on the device. This could give the attacker control\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-27T18:10:04.501101Z"}, {"uuid": "43b9f4f0-75ce-44d9-9536-d611f374305e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfhzd6gk24", "content": "CVE-2026-88772 - adc\nVersions of Citrix NetScaler ADC and NetScaler Gateway released before the latest updates can be tricked into running unwanted code or stopping service. This could let an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#adc #citrixnetscaler #CVE #infosec", "creation_timestamp": "2026-09-27T18:10:06.937026Z"}, {"uuid": "2ddb3c0c-de28-4060-978c-75b84e422163", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfztajkj2u", "content": "CVE-2026-88773 - gateway\nOlder versions of Citrix NetScaler ADC and NetScaler Gateway may treat incoming web requests differently, allowing a single request to be split and processed incorrectly.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gateway #citrixnetscaler #CVE #infosec", "creation_timestamp": "2026-09-27T18:20:04.735995Z"}, {"uuid": "7ff927fb-260c-4c8c-a84e-064ec76d391b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgkjhqgb2f", "content": "CVE-2026-88771 is trending. Hype score 33, currently #1 on cvemon.\n\nImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS,\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88771", "creation_timestamp": "2026-09-27T18:29:25.814320Z"}, {"uuid": "0c25b550-ad80-45f3-8b59-547c9ca5d150", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgklj4fy2i", "content": "CVE-2026-88772 is trending. Hype score 26, currently #2 on cvemon.\n\nVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88772", "creation_timestamp": "2026-09-27T18:29:26.796640Z"}, {"uuid": "0bdeb375-88af-4033-a205-7e029a3a8766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgknkff425", "content": "CVE-2026-88778 is trending. Hype score 21, currently #5 on cvemon.\n\nPredictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88778", "creation_timestamp": "2026-09-27T18:29:28.965886Z"}, {"uuid": "f4c5f301-e62b-48c8-af4f-10cf21bba16c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/c6o4kx2vgqy5d", "content": "CVE-2026-88777 - Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service\nCVE ID : CVE-2026-88777\n \n Published : Sept. 27, 2026, 5:16 p.m. | 58\u00a0minutes ago\n \n Description : Memory overflow vulnerability vulnerability in Citrix NetScaler...", "creation_timestamp": "2026-09-27T18:32:12.216557Z"}, {"uuid": "f09a4a6b-ac55-4cfa-9a9a-de92d2368107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6wywemnt5bji4", "content": "CVE-2026-88776 - Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service\nCVE ID : CVE-2026-88776\n \n Published : Sept. 27, 2026, 5:16 p.m. | 58\u00a0minutes ago\n \n Description : Memory overflow vulnerability vulnerability in Citrix NetScaler...", "creation_timestamp": "2026-09-27T18:38:11.448221Z"}, {"uuid": "b63c3199-2baa-405b-809e-0cebad3416f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3hlkt4srlb7fj", "content": "CVE-2026-88775 - Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service\nCVE ID : CVE-2026-88775\n \n Published : Sept. 27, 2026, 5:16 p.m. | 58\u00a0minutes ago\n \n Description : Memory overflow vulnerability in Citrix NetScaler ADC and Citri...", "creation_timestamp": "2026-09-27T18:44:11.433144Z"}, {"uuid": "0e5e8890-4b02-4527-9037-68ac467deac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/b3oslmnsfmlo2", "content": "CVE-2026-88773 - HTTP Request Smuggling\nCVE ID : CVE-2026-88773\n \n Published : Sept. 27, 2026, 5:16 p.m. | 58\u00a0minutes ago\n \n Description : Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScale...", "creation_timestamp": "2026-09-27T18:49:12.236930Z"}, {"uuid": "099c0333-e4a3-4677-95f0-0e6b2083cee4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/blhimcc6ansqt", "content": "CVE-2026-88778 - TCP Initial Sequence Number (ISN) prediction\nCVE ID : CVE-2026-88778\n \n Published : Sept. 27, 2026, 5:16 p.m. | 58\u00a0minutes ago\n \n Description : Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nTh...", "creation_timestamp": "2026-09-27T18:51:12.251959Z"}, {"uuid": "ff897380-59ed-46a1-be5f-1cf05f509d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "a47e3727-c51f-46ce-8e1e-77dc3a180696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "0ef9c42b-4d16-4ea3-a03a-be6ee29a20c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "5eb6dd6a-14e6-4101-9052-b1dfbeb7557d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "4f8618ac-9212-4a05-96cc-f0942ad7770f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "55de2d71-44d4-4a70-95de-80f9d055a744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "25e147f1-1801-4477-9eb3-9e97a204cbfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "a5b68f12-b34d-43e0-9149-668e16619615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "383dc789-c9cf-45ab-8cb1-d1cf2d7be8d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "6fe2214a-3820-4b5d-9fdb-50838820ee46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "cf5c7ef6-12c1-42b9-ba41-b91ad379eead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "4107d817-278a-410f-85f8-59002bb3fc98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "a24d9747-3e82-4c16-a485-e7d474ef4e83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "e3aa13c0-e7c9-4477-9cd2-ed9f51ead755", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "be2aa831-4f0c-49df-b2cd-35ac80be71b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "270e695c-4f01-4fa1-9aff-2f092402b077", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "62ff6b08-f293-4f0d-a3cd-b5d38bdcdb3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "01867a92-2a2f-4b55-b82f-2e6047156be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117343817673361515", "content": "Citrix NetScaler zero-days\n\nExploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.\nThis is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart \nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n#citrix #netscaler #zeroday #cve", "creation_timestamp": "2026-09-27T19:36:49.601593Z"}, {"uuid": "b10f1cb2-a4b6-4fd2-b178-01b8cf15a317", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117343817673361515", "content": "Citrix NetScaler zero-days\n\nExploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.\nThis is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart \nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n#citrix #netscaler #zeroday #cve", "creation_timestamp": "2026-09-27T19:36:49.638126Z"}, {"uuid": "fb34528b-773d-4065-87cf-ccd286557a47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/116797276219291526/statuses/117343904630365522", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow\nhttps://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social", "creation_timestamp": "2026-09-27T19:37:04.565278Z"}, {"uuid": "98cc9bf1-e49f-41af-b244-e3b765123761", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/ap/users/116797276219291526/statuses/117343904630365522", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow\nhttps://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social", "creation_timestamp": "2026-09-27T19:37:04.606822Z"}, {"uuid": "7ff4123f-76d8-4081-b011-f7ed23e7710c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117344112149380671", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: two RCE zero-days exploited in the wild before any fix, CVSS v4 9.5 each. CVE-2026-88771 hit every deployment (unauth command execution); CVE-2026-88772 needs DTLS, on by default for VPN vservers. Fixed in 14.1-73.37 / 13.1-64.23.\ud83d\udd17 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html#CVE #Exploit #NetScaler #CyberSec", "creation_timestamp": "2026-09-27T19:37:30.798519Z"}, {"uuid": "fb00747f-9f06-4fce-bc16-e81c825427fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117344112149380671", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: two RCE zero-days exploited in the wild before any fix, CVSS v4 9.5 each. CVE-2026-88771 hit every deployment (unauth command execution); CVE-2026-88772 needs DTLS, on by default for VPN vservers. Fixed in 14.1-73.37 / 13.1-64.23.\ud83d\udd17 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html#CVE #Exploit #NetScaler #CyberSec", "creation_timestamp": "2026-09-27T19:37:30.825903Z"}, {"uuid": "846870c7-d0bc-44fb-b16b-318e6da861e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117064736050780246/statuses/117344423181886454", "content": "Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement\nhttps://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach", "creation_timestamp": "2026-09-27T19:38:01.931830Z"}, {"uuid": "2a1078c9-c890-4ff7-aeff-0dd0dcc4b39b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/ap/users/117064736050780246/statuses/117344423181886454", "content": "Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement\nhttps://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach", "creation_timestamp": "2026-09-27T19:38:01.962955Z"}, {"uuid": "8e745a4e-d8ff-40ab-a002-ed74575a2acf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwjksevdsq2p", "content": "Citrix confirms active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, enabling remote code execution and denial of service. #Citrix #NetScaler #RCE", "creation_timestamp": "2026-09-27T19:45:23.525142Z"}, {"uuid": "ff78b29f-092c-4201-9acd-4ebf227c0564", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwjksevdsq2p", "content": "Citrix confirms active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, enabling remote code execution and denial of service. #Citrix #NetScaler #RCE", "creation_timestamp": "2026-09-27T19:45:23.550364Z"}, {"uuid": "cd95d6b0-cf9b-4f0b-83ff-4ca4df250a46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/zackwhittaker.com/post/3mwjlj2oots27", "content": "CISA has confirmed two bugs in Citrix NetScaler are being exploited in active cyberattacks, CVE-2026-88771 and CVE-2026-88772, in a rare weekend drop of security news. www.cisa.gov/known-exploi...\n\nCitrix has a support base article, confirming exploitation. support.citrix.com/support-home...", "creation_timestamp": "2026-09-27T19:58:06.163542Z"}, {"uuid": "cad07691-265d-4e66-94e5-6c278a6be450", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/zackwhittaker.com/post/3mwjlj2oots27", "content": "CISA has confirmed two bugs in Citrix NetScaler are being exploited in active cyberattacks, CVE-2026-88771 and CVE-2026-88772, in a rare weekend drop of security news. www.cisa.gov/known-exploi...\n\nCitrix has a support base article, confirming exploitation. support.citrix.com/support-home...", "creation_timestamp": "2026-09-27T19:58:06.196480Z"}, {"uuid": "23dfa00c-c7f1-472d-a9c5-e714293309eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlopz7wo2b", "content": "~Certeu~\nCitrix confirms active exploitation of two unauthenticated NetScaler RCEs; patch immediately and assess internet-facing appliances.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-27T20:01:14.906009Z"}, {"uuid": "11068e7d-a32b-4d67-a75a-23b94cef7247", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlopz7wo2b", "content": "~Certeu~\nCitrix confirms active exploitation of two unauthenticated NetScaler RCEs; patch immediately and assess internet-facing appliances.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-27T20:01:14.936675Z"}, {"uuid": "7ae4efca-2d6a-4f91-a19a-19465c58ab76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlr55n5d2g", "content": "~Cisa~\nCISA reports active exploitation of two Citrix NetScaler vulnerabilities and urges rapid remediation.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "creation_timestamp": "2026-09-27T20:02:35.641108Z"}, {"uuid": "c4d08368-005d-498f-9d77-0ea2ec9ebdd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlr55n5d2g", "content": "~Cisa~\nCISA reports active exploitation of two Citrix NetScaler vulnerabilities and urges rapid remediation.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "creation_timestamp": "2026-09-27T20:02:35.675315Z"}, {"uuid": "ebf1a866-8846-432e-982f-77e758425b5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlthkufc2e", "content": "~Cybergcca~\nActive exploitation of NetScaler flaws enables remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #CyberSecurity #ThreatIntel", "creation_timestamp": "2026-09-27T20:03:54.575365Z"}, {"uuid": "e7073f25-0686-472d-b2f3-a53e396c9acb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlthkufc2e", "content": "~Cybergcca~\nActive exploitation of NetScaler flaws enables remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #CyberSecurity #ThreatIntel", "creation_timestamp": "2026-09-27T20:03:54.625688Z"}, {"uuid": "3e1a0b21-c9f9-4c18-9ea6-9e5dc9080a3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/ichintu/880d8b4087a6fd9cbf8625bb1b4c754e", "content": "This update covers multiple high- and critical-severity vulnerabilities disclosed around September 27, 2026. The most severe impact affects **Citrix NetScaler ADC and Gateway**, which face numerous critical flaws (including CVE-2026-88771 and 88772) enabling unauthenticated remote code execution, memory overflows, HTTP request smuggling, and TCP session prediction. Active exploitation is confirmed, requiring an immediate patch to versions 14.1-73.37 or 13.1-64.23. \n\nOther affected systems include **pnpm** (environment variable exfiltration via proxy configs, patched in 10.34.5/11.11.0), **Fleet** (command injection via cask metadata, patched in v4.92.0), **python-utcp** (SSRF via redirect bypass, patched in 1.1.4), and **Heym** (authentication bypasses for Telegram and Slack webhooks, patched in 0.0.53). \n\nRemediation guidance emphasizes patching to specified versions, temporarily disabling internet-facing Citrix appliances, preserving forensic logs, investigating for compromise, and aligning defenses with cybersecurity hardening best practices.", "creation_timestamp": "2026-09-27T20:03:40.000000Z"}, {"uuid": "85c06ae5-b20d-4c65-ab5b-e78faf259a1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "99f37e90-769f-4d9c-8842-7f3884647ed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "622d98a1-2321-415a-a344-5e161bff0462", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "b4622a11-220b-4de0-bb0f-8f64270a1ac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "879d8dbb-d81e-4563-be2e-36cbe835d643", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "16b4be70-79a8-4ff4-bdc5-74dab0eb3c16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "caab0842-6c41-4a72-852f-358a016b5e82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "bbb3e2c6-1b01-4361-9a16-e87a19bd9b8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "c150a94b-92cd-45dd-a547-00f678be40a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "7057b2e2-83a6-427a-be1e-39e9cb021eee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "82acc993-cdf8-4f42-bc15-ef60c1ad0f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "58f57fc5-9e4b-4b38-a785-8479ece08ecf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "e288a447-812b-40c7-804c-335d3a8eccc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "5dbc9d4f-7aac-4bd4-a3e1-09639c03aebf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "a152472e-d15a-40f3-a237-f61325452c46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "27f12ba9-7f4c-4c13-b29b-15f2e3a261b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/aktivt-utnyttelse-av-kritiske-sarbarheter-i-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T11:05:15.000000Z"}, {"uuid": "6f6eb354-ebfa-4eb7-b800-eccac43f979b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/aktivt-utnyttelse-av-kritiske-sarbarheter-i-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T11:05:15.000000Z"}, {"uuid": "f8f9799c-e88e-4bf3-aa79-dc14c3083369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "484cbf89-90cd-4091-a405-09916b313e57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "f28bbdd2-9858-4ccf-abcb-ffdb5ea55d18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwjnt7hfzn25", "content": "AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway \u2013 CVE-2026-88771 and CVE-2026-88772", "creation_timestamp": "2026-09-27T20:39:32.549130Z"}, {"uuid": "fbf95cd5-2143-4b49-8ded-9e23af3a22a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwjnt7hfzn25", "content": "AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway \u2013 CVE-2026-88771 and CVE-2026-88772", "creation_timestamp": "2026-09-27T20:39:32.575266Z"}, {"uuid": "daaec50b-698c-4fda-8d45-2a5c06e7bed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "6b3df433-e1f3-43a6-a03b-6b48b9978cda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "466865b3-0163-4622-8245-337946187904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "f554482a-3702-4215-ac98-0465abad38bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "6757c04f-9e98-4fdf-9963-3e01879a9172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "e735de78-f56c-4d12-864e-c75bf7ecfec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "de300ea3-6a77-48d0-9c88-abc21760810a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "b600c33e-1bcb-4be6-b86b-daed3ae3f1a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "2b2c0b17-ad88-457a-bd7d-48570fb45b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu", "content": "", "creation_timestamp": "2026-09-27T12:11:42.000000Z"}, {"uuid": "96e117e0-b1c0-4548-be75-b54eb81b47c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu", "content": "", "creation_timestamp": "2026-09-27T12:11:42.000000Z"}, {"uuid": "f827ce1c-5785-42b6-8834-dac4bc469631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "44562adc-1590-48c3-97ed-a367d02c4cd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "31f916f6-2e8a-402c-bf06-b8c425f3b026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "4ae0bf29-880c-48c0-868f-438a9ae94d9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "8303882b-d816-446f-8df6-f9f43482f2e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "acbc3373-9fe3-43ee-a5d2-558fe7a1fe13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "70c05d65-067b-4f24-818e-8aec947211dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwjqbd7eom2l", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88771: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-7\u2026\nCVSS 9.5 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-88771\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-27T21:23:13.715730Z"}, {"uuid": "25aff03a-e00c-4051-9761-08b2301dfbc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwjqbeup6i2k", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88772: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, b\u2026\nCVSS 9.5 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-88772\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-27T21:23:15.267872Z"}, {"uuid": "e1f359ea-b17b-4155-9585-243c75edf0c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6q65g32l", "content": "\ud83d\uded1 CVE-2026-88772\nCitrix NetScaler\nCVSS 9.5 / KEV: No\nTL;DR: Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 1\u2026\nhttps://cvesentinel.com/report/CVE-2026-88772?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-27T21:57:34.718026Z"}, {"uuid": "b19e6da5-55bb-4874-aea9-d4a2910003de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6rtxrq2q", "content": "\ud83d\uded1 CVE-2026-88771\nCitrix NetScaler\nCVSS 9.5 / KEV: No\nTL;DR: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This i\u2026\nhttps://cvesentinel.com/report/CVE-2026-88771?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-27T21:57:36.092824Z"}, {"uuid": "0fe93264-4990-4f0d-b5b0-79aef737fe8d", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/25ce362a-a184-4ea6-83c7-64bb2a2242a3", "content": "", "creation_timestamp": "2026-09-27T22:00:02.520287Z"}, {"uuid": "6c59ba72-c197-4e9e-b31a-9d94b65e9339", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/101635ac-c10a-4cfc-b18a-1dee629f73cc", "content": "", "creation_timestamp": "2026-09-27T22:00:03.772141Z"}, {"uuid": "c62025a3-e512-4235-8a29-eaf27a828090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/GithubRedTeam/103584", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88772\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 21:06:31\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-64.23, UDP/443 DTLS probe. CTX697096; active exploitation reported. https://pocbit.org/pocs/cve-2026-88772\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T21:06:55.000000Z"}, {"uuid": "24eca138-b129-4c85-9853-9c2a6c98b3d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mwjycask222o", "content": "CISA added Citrix NetScaler flaw CVE-2026-88772 to its Known Exploited Vulnerabilities catalog.\n\n\u2022 Memory buffer bug in NetScaler ADC and Gateway, RCE or DoS\n\nhttps://thecircuitry.to/article/cisa-adds-citrix-netscaler-cve-2026-88772-to-kev-catalog-mukcx3d4", "creation_timestamp": "2026-09-27T23:46:55.681356Z"}, {"uuid": "2008b61b-0d5e-4f2c-8840-2d5205e85fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "Citrix ha rilasciato aggiornamenti di sicurezza per ADC e Gateway, prodotti NetScaler dedicati alla distribuzione, gestione e accesso sicuro ad applicazioni e servizi, che sanano 8 vulnerabilit\u00e0, di cui 3 con gravit\u00e0 \"critica\" e 5 con gravit\u00e0 \"alta\". Tra queste si evidenziano le vulnerabilit\u00e0 identificate tramite CVE-2026-88771 e CVE-2026-88772, per le quali Citrix ha osservato lo sfruttamento su sistemi NetScaler non aggiornati.", "creation_timestamp": "2026-09-27T17:34:41.000000Z"}, {"uuid": "7672be8a-322a-4a3d-b7ec-9e5bae0b10f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "Citrix ha rilasciato aggiornamenti di sicurezza per ADC e Gateway, prodotti NetScaler dedicati alla distribuzione, gestione e accesso sicuro ad applicazioni e servizi, che sanano 8 vulnerabilit\u00e0, di cui 3 con gravit\u00e0 \"critica\" e 5 con gravit\u00e0 \"alta\". Tra queste si evidenziano le vulnerabilit\u00e0 identificate tramite CVE-2026-88771 e CVE-2026-88772, per le quali Citrix ha osservato lo sfruttamento su sistemi NetScaler non aggiornati.", "creation_timestamp": "2026-09-27T17:34:41.000000Z"}, {"uuid": "aa5db51e-8faa-4292-abec-ba8e4a0bca47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjteo44de22", "content": "CVE-2026-88773 is trending. Hype score 13, currently #7 on cvemon.\n\nInconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88773", "creation_timestamp": "2026-09-27T22:18:47.230539Z"}, {"uuid": "7126fe0d-534b-4a3b-987c-a83caa3d8d75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w", "content": "Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.\n\nwww.deyda.net/index.php/en...\n\n#DeydaConsulting #NetScaler #Citrix", "creation_timestamp": "2026-09-27T23:03:26.957388Z"}, {"uuid": "127abcbd-f200-4b65-9512-7b78cc19fdba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w", "content": "Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.\n\nwww.deyda.net/index.php/en...\n\n#DeydaConsulting #NetScaler #Citrix", "creation_timestamp": "2026-09-27T23:03:26.982064Z"}, {"uuid": "b8389bac-3acc-4c5b-9037-520f732c6d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mwjw334u4i2q", "content": "Citrix patched the NetScaler zero-days alerted this morning, weeks ahead of the Sept 28 timeline first reported. CISA confirms active global exploitation, added CVE-2026-88771 and 88772 to KEV, and warns patching can erase forensic evidence of prior compromise. cisa.gov/news-events/ale...", "creation_timestamp": "2026-09-27T23:07:06.579294Z"}, {"uuid": "9829e66e-8794-4319-8400-a586dd106f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l", "content": "Emergency Citrix Patch and the $2.2M Vendor Liability Lesson\n\nFirst, Citrix has confirmed that two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and NetScaler Gateway are being actively exploited by attackers.\n\nhttps://youtu.be/ean43KG9b1g", "creation_timestamp": "2026-09-27T23:16:13.631362Z"}, {"uuid": "02f4897b-6568-413e-940d-7315df121422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l", "content": "Emergency Citrix Patch and the $2.2M Vendor Liability Lesson\n\nFirst, Citrix has confirmed that two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and NetScaler Gateway are being actively exploited by attackers.\n\nhttps://youtu.be/ean43KG9b1g", "creation_timestamp": "2026-09-27T23:16:13.679672Z"}, {"uuid": "13e6fb22-ba1d-4651-b6fc-f9275b8b4ae8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mwjyzwec2o2x", "content": "Re-patch NetScaler: CISA says exploited CVE-2026-88771/88772 need new fixes even after August updates. Oct. 7: Microsoft and NVIDIA share a stage. Also: Wi\u2011Fi link checks, Explorer Recents, C: shrink blockers. +23 more stories", "creation_timestamp": "2026-09-28T00:00:12.579954Z"}, {"uuid": "3cfd9810-f1f8-41f2-9481-135f7d792ee4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwk3weefug2f", "content": "CVE-2026-88774 is trending. Hype score 14, currently #7 on cvemon.\n\nVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88774", "creation_timestamp": "2026-09-28T00:52:20.914845Z"}, {"uuid": "5cfa7346-b180-4060-a962-1cc434387b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwk7ir4e7v2h", "content": "CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability\n\nCitrix NetScaler ADC and NetScaler Gateway contain an improper input validat\u2026\n\nhttps://planetbriefing.com/events/cve-2026-88771-citrix-netscaler-improper-input-validation-vulnerability-784752551976\n\n#Technology #UnitedStates", "creation_timestamp": "2026-09-28T01:55:49.597545Z"}, {"uuid": "dea15696-0a60-4a57-b168-a34df6bb1815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117346254173339958", "content": "A new vulnerability with increased severity was disclosed for Citrix ADC and Gateway (CVE-2026-88777) https://vuldb.com/vuln/410922", "creation_timestamp": "2026-09-28T02:15:40.241155Z"}, {"uuid": "06a7214c-33fb-4030-8592-a6e883d53f7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 27\uff09\n\nCVE-2026-88771 Citrix NetScaler \u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\nCVE-2026-88772 Citrix NetScaler\u306b\u304a\u3051\u308b\u30e1\u30e2\u30ea\u30d0\u30c3\u30d5\u30a1\u306e\u7bc4\u56f2\u5185\u3067\u306e\u64cd\u4f5c\u306e\u4e0d\u9069\u5207\u306a\u5236\u9650\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-28T03:24:17.860252Z"}, {"uuid": "aa53e811-fe14-4839-83e0-d2f04fffb281", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 27\uff09\n\nCVE-2026-88771 Citrix NetScaler \u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\nCVE-2026-88772 Citrix NetScaler\u306b\u304a\u3051\u308b\u30e1\u30e2\u30ea\u30d0\u30c3\u30d5\u30a1\u306e\u7bc4\u56f2\u5185\u3067\u306e\u64cd\u4f5c\u306e\u4e0d\u9069\u5207\u306a\u5236\u9650\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-28T03:24:17.900852Z"}, {"uuid": "bb9f96a9-1035-4c60-b32d-3f069e27c845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44631", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-27T23:00:31.000000Z"}, {"uuid": "a886ab4c-709e-4070-b7fd-0bd5e7711a40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44631", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-27T23:00:31.000000Z"}, {"uuid": "bb99c059-b67a-4934-85ab-3b0ed09a7cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "06c9aede-5f30-4ab3-a36f-19016c0ec165", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "b2747f9d-aed7-44dc-9469-467a83a1083b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "fd8cbd4b-ff0f-491f-a314-9fcf96cd4439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "dbf0c815-359d-44ee-9167-9fc99e390bed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "093aaba4-9334-4ecb-943b-b92be4d25eb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "8051c0bb-d96d-489d-9789-921b24bbce56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "7938bc4b-f8c7-4e2c-ad24-50b1513f31b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "ccaa9d0c-77e8-47ca-b6d8-535ce26eaf95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44635", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability\nCVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-27T23:00:38.000000Z"}, {"uuid": "160b7eb5-9877-422c-9757-81986047d995", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44635", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability\nCVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-27T23:00:38.000000Z"}, {"uuid": "9ef159e4-b734-482d-9aa5-7feb4423c715", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26", "content": "~Cisa~\nThreat actors are globally exploiting two critical NetScaler zero-days enabling remote code execution.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "creation_timestamp": "2026-09-28T04:04:23.091955Z"}, {"uuid": "2e809211-b521-4b27-85eb-d6e3a7989217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26", "content": "~Cisa~\nThreat actors are globally exploiting two critical NetScaler zero-days enabling remote code execution.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "creation_timestamp": "2026-09-28T04:04:23.148825Z"}, {"uuid": "01d14b1f-85ef-4cea-9e2e-90406f689a9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "ddf92871-7785-4d01-b8f1-cb489ac413b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "b85d528d-9d47-4ae6-90dd-1f6af6d8331b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "a839fc7e-08e6-45a4-8cc6-d9bc466dc637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "0ec0d38f-19bd-4a6e-9c8f-372f283324d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "28a301ac-780f-4b28-b148-585e74f812ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "7bc3b93a-f25c-4038-836f-d09f1392a321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "9b6c552a-4809-4581-8b39-7d709b0fd679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "c8fa8033-1f3e-4dc5-b141-c8ec42509d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwkjryaqvd26", "content": "\ud83d\udcf0 Citrix Konfirmasi Dua Zero-Day NetScaler RCE Dieksploitasi dalam Serangan\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/28/citrix-netscaler-zero-day-cve-2026-88771-88772/\n\n#citrix #cve #cybersecurity #keamananSiber #netscaler #netscalerAdc #netscalerGateway #networkSecurity ", "creation_timestamp": "2026-09-28T04:59:56.613787Z"}, {"uuid": "82819c0b-7312-4e8a-8568-66092cf41141", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwkmxrrqa22q", "content": "\ud83d\udee1\ufe0f Revue cyber du 28 sept :\n\n\u2022 Citrix NetScaler : 2 zero-days RCE exploit\u00e9s (CVE-2026-88771/88772). Patcher + invalider les sessions.\nhttps://bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-28T05:56:51.950659Z"}, {"uuid": "115dd9a8-754b-49a1-9b4b-145d716227f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwkmxs6si62w", "content": "\ud83d\udee1\ufe0f Revue potato du 28 sept :\n\n\u2022 Citrix NetScaler : 2 zero-days RCE exploit\u00e9s (CVE-2026-88771/88772). Patcher + invalider les sessions.\nhttps://bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-28T05:56:52.467694Z"}, {"uuid": "a08f47a5-a573-4f1f-a40d-af71815cad18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwknogr2dp2q", "content": "Analysis: CVE-2026-88771 and CVE-2026-88772", "creation_timestamp": "2026-09-28T06:09:32.181319Z"}, {"uuid": "92953b61-d63e-418f-9f3b-8a12863161de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwknogr2dp2q", "content": "Analysis: CVE-2026-88771 and CVE-2026-88772", "creation_timestamp": "2026-09-28T06:09:32.450733Z"}, {"uuid": "153d5433-1da4-4861-b527-00c6c7ebe260", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwkoumrpz52v", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-88772: \u26a0\ufe0f CVE-2026-88772: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-88772-vulnerability-in-citrix-netscaler-adc-and", "creation_timestamp": "2026-09-28T06:30:53.481216Z"}, {"uuid": "bda7be68-7242-4a8b-9a25-00a5e9bff435", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwkourw2ke2s", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-88771: \u26a0\ufe0f CVE-2026-88771: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-88771-improper-input-validation-vulnerability-in-citrix", "creation_timestamp": "2026-09-28T06:30:58.671845Z"}, {"uuid": "e8b2734b-4bb7-45f5-9de7-f98427fae2e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwkqivpzaq27", "content": "\ud83d\udce2 \u26a0\ufe0f [VULN] Citrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es CVE-2026-88771 CVE-2026-88772\n\nCitrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es. Les entreprises doivent v\u00e9rifier les versions et rechercher une possible intrusion sur leurs \u00e9quipements.\n\n#CVE #Cyberveille", "creation_timestamp": "2026-09-28T07:00:08.055101Z"}, {"uuid": "df2acdf2-94b3-4614-af40-e3ed21acd90c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwkqivpzaq27", "content": "\ud83d\udce2 \u26a0\ufe0f [VULN] Citrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es CVE-2026-88771 CVE-2026-88772\n\nCitrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es. Les entreprises doivent v\u00e9rifier les versions et rechercher une possible intrusion sur leurs \u00e9quipements.\n\n#CVE #Cyberveille", "creation_timestamp": "2026-09-28T07:00:08.094013Z"}, {"uuid": "84fe006e-9fa8-4974-8bf1-e6616b2a6078", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/index.fomoera.com.ap.brid.gy/post/3mwkqivzj67n2", "content": "Citrix liber\u00f3 el 27 de septiembre parches para CVE-2026-88771 y CVE-2026-88772, dos fallas cr\u00edticas de NetScaler ADC y Gateway que ya se explotaban. Los equipos actualizados en agosto siguen expuestos y CISA pide revisar antes de parchar.", "creation_timestamp": "2026-09-28T07:00:12.756241Z"}, {"uuid": "aa0cbc0c-883f-4922-97b0-1a9290336be1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/index.fomoera.com.ap.brid.gy/post/3mwkqivzj67n2", "content": "Citrix liber\u00f3 el 27 de septiembre parches para CVE-2026-88771 y CVE-2026-88772, dos fallas cr\u00edticas de NetScaler ADC y Gateway que ya se explotaban. Los equipos actualizados en agosto siguen expuestos y CISA pide revisar antes de parchar.", "creation_timestamp": "2026-09-28T07:00:12.799747Z"}, {"uuid": "6b8ee89d-07fb-47f3-858a-fd0e639c84ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwkqmlboad2x", "content": "CVE-2026-88776 is trending. Hype score 16, currently #7 on cvemon.\n\nMemory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88776", "creation_timestamp": "2026-09-28T07:02:10.958022Z"}, {"uuid": "e025904f-149b-4b66-8d1e-d0fd731040ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwks45oiwt2n", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: CVE-2026-88771 + CVE-2026-88772 (unauth RCE) exploited in the wild. One hits default configs, the other needs DTLS. CISA KEV, FCEB deadline Sep 30.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-28T07:28:47.324199Z"}, {"uuid": "c2568598-1899-4c5d-ab1a-d661415d7160", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwks45oiwt2n", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: CVE-2026-88771 + CVE-2026-88772 (unauth RCE) exploited in the wild. One hits default configs, the other needs DTLS. CISA KEV, FCEB deadline Sep 30.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-28T07:28:47.376486Z"}, {"uuid": "3c5f412d-ede1-4cf0-ac46-a5be5344db27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 14 interactions\n", "creation_timestamp": "2026-09-28T07:32:35.890632Z"}, {"uuid": "d827a853-8b07-4ba7-914f-847b1d95bdd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 14 interactions\n", "creation_timestamp": "2026-09-28T07:32:35.923452Z"}, {"uuid": "681accf0-00e2-4cc0-900a-d84507369945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwkszjefso2c", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:12.742020Z"}, {"uuid": "634f3259-f070-460c-940b-8dafcf82011e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwkszjefso2c", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:12.765807Z"}, {"uuid": "82cebced-ee2d-4f09-a130-4fc61ee71ca3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwkszv2vxu2m", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:24.760202Z"}, {"uuid": "d6269b7c-02b4-434f-b174-6625a078e5b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwkszv2vxu2m", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:24.793341Z"}, {"uuid": "c7f652cb-baed-41ff-8bd5-c69596a30192", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwkt2ezry22y", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:41.565523Z"}, {"uuid": "b0dea50e-5499-445a-ba98-9f0f57f0065f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwkt2ezry22y", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:41.613277Z"}, {"uuid": "4cd8da4c-22c7-47ea-89b0-3cf4f92c7574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwktos6gfcfa", "content": "NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a42\u4ef6\u3001\u653b\u6483\u3067\u306e\u60aa\u7528\u3092Citrix\u304c\u78ba\u8a8d\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47848/", "creation_timestamp": "2026-09-28T07:57:08.278793Z"}, {"uuid": "d13fe333-92e1-41aa-9c20-597a4dff67d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwktos6gfcfa", "content": "NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a42\u4ef6\u3001\u653b\u6483\u3067\u306e\u60aa\u7528\u3092Citrix\u304c\u78ba\u8a8d\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47848/", "creation_timestamp": "2026-09-28T07:57:08.315111Z"}, {"uuid": "a6c3f4e2-b3c2-4e9c-917b-9605f08bfc8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/ichintu/1d63d88b130a22aa8e7576cfb85d5791", "content": "On September 28, 2026, threat intelligence highlights multiple critical, publicly disclosed vulnerabilities across widely used platforms and network hardware. **aaPanel BaoTa** (v\u226411.8.0) and **Netcore routers** (NBR200V2/NBR100V2) are affected by several remote OS command injection and authorization bypass flaws (CVSS 8.5\u201310.0), with vendors remaining unresponsive to early notifications. Additional disclosures include a HIGH-severity LFI/SSRF vulnerability in Joomla\u2019s **Modules Anywhere** extension, an RCE in **OpenCode**, and active **Citrix NetScaler** zero-days (CVE-2026-88771/88772) recently added to CISA\u2019s KEV catalog due to real-world exploitation. Organizations should prioritize immediate patching, enforce compensating controls, and monitor for active threat campaigns.", "creation_timestamp": "2026-09-28T08:00:31.000000Z"}, {"uuid": "a9ba8778-0b69-487f-ac22-05a815b3191e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "f611824b-5407-4497-9567-58be797badfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "ea14b467-eaaa-4c5f-aa4a-c419e1fc2159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mwkvjiucu22y", "content": "CVE-2026-88771 & CVE-2026-88772 (CVSS 9.5, CISA KEV): two Citrix NetScaler RCE zero-days exploited before a patch existed. 88771 hits default configs unauthenticated. Upgrade to 14.1-73.37 / 13.1-64.23. Query: (product~\"Citrix NetScaler\") and last_seen>-7D", "creation_timestamp": "2026-09-28T08:29:59.063736Z"}, {"uuid": "e824a817-58e9-49c9-b695-c445c0bb06aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mwkvjiucu22y", "content": "CVE-2026-88771 & CVE-2026-88772 (CVSS 9.5, CISA KEV): two Citrix NetScaler RCE zero-days exploited before a patch existed. 88771 hits default configs unauthenticated. Upgrade to 14.1-73.37 / 13.1-64.23. Query: (product~\"Citrix NetScaler\") and last_seen>-7D", "creation_timestamp": "2026-09-28T08:29:59.116419Z"}, {"uuid": "399cda75-a9ce-4c71-99ad-d65e54888c26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwkvzczigcfa", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 https://www.jpcert.or.jp/at/2026/at260029.html", "creation_timestamp": "2026-09-28T08:38:49.501112Z"}, {"uuid": "5b6b7ed3-1245-4309-9778-63a48a460229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083", "content": "", "creation_timestamp": "2026-09-27T21:00:00.000000Z"}, {"uuid": "9608ffb2-2443-4b36-ad9c-21601a819380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.846955Z"}, {"uuid": "8f3aff75-32ea-4b59-8469-1d1e1ee95f43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.876898Z"}, {"uuid": "2499051b-3889-4f2e-a65d-42c3714c078c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.898669Z"}, {"uuid": "5096d26e-d574-4adc-9335-e053648c6220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083", "content": "", "creation_timestamp": "2026-09-27T21:00:00.000000Z"}, {"uuid": "66865788-739b-4c54-bbba-f72f727d825c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.921307Z"}, {"uuid": "42d6b2b5-0c10-47d1-84cb-86e98bf54ec6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.944131Z"}, {"uuid": "2be4c4aa-8aab-4e34-a244-625c311b355c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.961273Z"}, {"uuid": "c3bb6172-2f6c-43e8-b0e2-744ef248876c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.979475Z"}, {"uuid": "2fcdcbcf-fa11-47c9-9232-af4f9a8b391e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:06.002040Z"}, {"uuid": "33e78a29-aa34-4a3f-bd61-f1f8e98b018e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083", "content": "", "creation_timestamp": "2026-09-27T21:00:00.000000Z"}, {"uuid": "3203d6ee-990d-40b0-b8db-bfe692d6d9ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "6a26c1f6-f318-4e5e-ae11-06ce8520bb3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "0ace45a9-4a43-4581-b452-71cdeed9e41f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "0afe4009-245c-4a17-a529-b38a5feab5fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "5d303be4-276b-4a34-90f8-f3a12c245021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "57ceef37-4279-412b-b1d2-5a421537427f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "0b7a0329-1c83-44a1-9186-33e7dfcabea0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mwkx7v3rjp2q", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "creation_timestamp": "2026-09-28T09:00:21.755795Z"}, {"uuid": "13abc953-aad3-4333-9e42-bff4df24cf47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mwkx7v3rjp2q", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "creation_timestamp": "2026-09-28T09:00:21.790250Z"}, {"uuid": "00f2450f-1a0f-4572-bfe8-fe9bc5ea862b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117347845378892968", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0fLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "creation_timestamp": "2026-09-28T09:00:23.218003Z"}, {"uuid": "59a22584-68a4-433a-b116-dd6f605c3dd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117347845378892968", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0fLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "creation_timestamp": "2026-09-28T09:00:23.247265Z"}, {"uuid": "a3dcd0c8-6f82-42f2-a42b-e0cb8736c74f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/thehackernews/10176", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "creation_timestamp": "2026-09-28T07:24:56.000000Z"}, {"uuid": "577b445d-af3e-434e-9172-af99f19be64a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwkxbwddev2z", "content": "\u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nCloud Software Group\u304c9\u670827\u65e5\u306bNetScaler ADC\u304a\u3088\u3073Gateway\u306e8\u3064\u306e\u8106\u5f31\u6027\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002CVE-2026-88771\u3001CVE-2026-88772\u306f\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u653b\u6483\u8005\u306b\u3088\u308b\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3067\u3001\u3059\u3067\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002CVE-2026-88771\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u69cb\u6210\u542b\u3080\u3059\u3079\u3066\u306e\u69cb\u6210\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3001CVE-2026-8877\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-28T09:01:29.770912Z"}, {"uuid": "76f647f6-ae78-4127-9502-6b2680cff5ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8877", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwkxbwddev2z", "content": "\u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nCloud Software Group\u304c9\u670827\u65e5\u306bNetScaler ADC\u304a\u3088\u3073Gateway\u306e8\u3064\u306e\u8106\u5f31\u6027\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002CVE-2026-88771\u3001CVE-2026-88772\u306f\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u653b\u6483\u8005\u306b\u3088\u308b\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3067\u3001\u3059\u3067\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002CVE-2026-88771\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u69cb\u6210\u542b\u3080\u3059\u3079\u3066\u306e\u69cb\u6210\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3001CVE-2026-8877\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-28T09:01:29.796854Z"}, {"uuid": "e48b315f-d14e-4078-9ec1-38b02d9fc64c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mwkxewrywno2", "content": "\u3010JPCERT\u3011\u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260029.html\n\nNVNB\u306f\u8106\u5f31\u6027\u60c5\u5831\u306e\u95b2\u89a7\u3092\u652f\u63f4\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u3067\u3059\nhttps://nvnb.blossomsarchive.com/", "creation_timestamp": "2026-09-28T09:03:36.877834Z"}, {"uuid": "facf5b14-c7c1-429e-aaf0-47d56ff6b64f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzh3c36d2m", "content": "\uff1e NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49)\nhttps://www.ipa.go.jp/security/security-alert/2026/alert20260928.html\n", "creation_timestamp": "2026-09-28T09:40:10.182359Z"}, {"uuid": "bfff2440-1d7f-4e3f-b2e0-db8fc325f5a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzhb6qdd2a", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260029.html\n", "creation_timestamp": "2026-09-28T09:40:16.187320Z"}, {"uuid": "e705f9c6-22f9-4c69-adc3-5bf136ec858b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-d7266750-a3bb08d72eed91bf", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-88771 (CVSS score: 9.5) is a remote code execution vulnerability caused by improper input validation that could allow an unauthenticated remote [\u2026]U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog", "creation_timestamp": "2026-09-28T09:48:15.278686Z"}, {"uuid": "b50b7b45-3a4d-40f1-96da-3c9cd002f053", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/227b6b17-783c-4b5e-ac08-a19e5e042920", "content": "", "creation_timestamp": "2026-09-28T10:00:02.283493Z"}, {"uuid": "8cbd306a-ab27-4e1c-838e-a199fb44638f", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c6e5d3ee-94a3-487c-a2cd-d7dc4e78ca7e", "content": "", "creation_timestamp": "2026-09-28T10:00:03.060227Z"}, {"uuid": "813c4b14-f75d-4d73-a95b-f75741d546ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/thehackernews/10176", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "creation_timestamp": "2026-09-28T07:24:56.000000Z"}, {"uuid": "b48db887-2f8c-4154-8ff1-6d252300c188", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "content": "Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\n\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.", "creation_timestamp": "2026-09-28T05:29:51.000000Z"}, {"uuid": "efb59cc6-0246-4b29-83f4-7e952718c219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "content": "Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\n\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.", "creation_timestamp": "2026-09-28T05:29:51.000000Z"}, {"uuid": "1a835de3-451b-442c-b77c-b0bb372c67e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwl2s6tm5k27", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/28/c...\n\n#cybersecurity #cybersecuritynews #0day #exploit #vulnerability @ncsc-nl.bsky.social @doublepulsar.com @satn.am @tenablesecurity.bsky.social", "creation_timestamp": "2026-09-28T10:04:18.343166Z"}, {"uuid": "38b4fbea-2dc5-477b-974d-e49b656b46fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwl2s6tm5k27", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/28/c...\n\n#cybersecurity #cybersecuritynews #0day #exploit #vulnerability @ncsc-nl.bsky.social @doublepulsar.com @satn.am @tenablesecurity.bsky.social", "creation_timestamp": "2026-09-28T10:04:18.366891Z"}, {"uuid": "02fc9327-5a73-4876-80f2-412ecd1e1b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c74e692-5425-4c10-8018-5cd17bb338fa", "content": "", "creation_timestamp": "2026-09-28T10:37:13.542651Z"}, {"uuid": "5c74fd28-1695-4170-bd60-8ae9e22ff9fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ad7ee50f-9ff2-40ee-8508-6cfe3f274745", "content": "", "creation_timestamp": "2026-09-28T10:37:38.015919Z"}, {"uuid": "fe4c95fc-5d8e-464b-b5c7-c3add8427ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwl4zcq2vc2n", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nwww.helpnetsecurity.com/2026/09/28/c...\n\n#Cybersecurity #Cyber #SituationalAwareness", "creation_timestamp": "2026-09-28T10:44:05.343469Z"}, {"uuid": "a59e0548-7bb9-4aaa-8235-b6900ace8777", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwl4zcq2vc2n", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nwww.helpnetsecurity.com/2026/09/28/c...\n\n#Cybersecurity #Cyber #SituationalAwareness", "creation_timestamp": "2026-09-28T10:44:05.374380Z"}, {"uuid": "17479b6e-b588-4440-8e1a-7be32e7567df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/thehackernews/10176", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "creation_timestamp": "2026-09-28T07:24:56.000000Z"}, {"uuid": "82395842-9fd7-41dc-82c2-d53a3941b01e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/thehackernews/10176", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "creation_timestamp": "2026-09-28T07:24:56.000000Z"}, {"uuid": "b067cdc1-2a67-4da4-b6bf-ca310e5864c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "10cd410a-9bed-4a17-bcb0-89f1a1cbac4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/papanda925.bsky.social/post/3mwl5y4p43w2p", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49)\u306e\u5bfe\u8c61\u6761\u4ef6\u3068\u5b89\u5168\u306a\u78ba\u8a8d\u624b\u9806\u3092\u6574\u7406\u3059\u308b\n\n\u672c\u8a18\u4e8b\u306fAI\u3092\u5229\u7528\u3057\u3066\u4f5c\u6210\u3057\u305f\u6280\u8853\u89e3\u8aac\u30fb\u5b9f\u88c5\u4f8b\u3067\u3059\u3002\u63b2\u8f09\u3059\u308b\u30b3\u30fc\u30c9\u3084\u624b\u9806\u306f\u4e00\u6b21\u60c5\u5831\u3092\u57fa\u306b\u69cb\u6210\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u7b46\u8005\u306b\u3088\u308b\u5b9f\u6a5f\u3067\u306e\u52d5\u4f5c\u78ba\u8a8d\u306f\u884c\u3063\u3066\u3044\u307e\u305b\u3093\u3002\u74b0\u5883\u3084\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u3088\u3063\u3066\u52d5\u4f5c\u304c\u7570\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002 NetScaler ADC\u304a\u3088\u3073NetScaler\u2026", "creation_timestamp": "2026-09-28T11:01:17.313146Z"}, {"uuid": "bea2c2da-1858-4000-81a8-64298acd14d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwl6ng4r7n2s", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs", "creation_timestamp": "2026-09-28T11:13:12.237569Z"}, {"uuid": "d9f39a16-cace-4be0-b943-25585abd48b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwl7bo5dof2k", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs", "creation_timestamp": "2026-09-28T11:24:30.980520Z"}, {"uuid": "6de214c4-fdc3-46be-8448-12e3374d83b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:41.962730Z"}, {"uuid": "0796b8eb-7254-44af-8c9e-ccfcbc7d0498", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:41.994131Z"}, {"uuid": "a2673614-32db-4e1f-8d9d-23b1960e6b95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:42.012153Z"}, {"uuid": "d4b8d3af-fe1a-480d-ba36-86df92268f6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "38bdc425-251d-45bf-90d1-3b070472409b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:42.033020Z"}, {"uuid": "5d15bc44-566a-4f0f-8d2f-3359f82141f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:42.048685Z"}, {"uuid": "29f81ffa-aaae-4d60-a41e-c632130fe569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:42.073995Z"}, {"uuid": "990bb083-5d60-44e6-b7e4-bf8dd1f88f46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:42.098924Z"}, {"uuid": "5fe36294-ef88-4fad-ab97-12cfa8b759ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:42.117769Z"}, {"uuid": "fdc61815-7dea-4da3-bc6e-ef041694c855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117348440149556531", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T11:31:35.446075Z"}, {"uuid": "6ac23965-3985-4253-9485-e80e2f892b39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mwl7worgzry2", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T11:37:37.868907Z"}, {"uuid": "0b93d2c8-390f-4d62-b39e-cc0ebe80a6e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwlb6quwsi2x", "content": "Details about the Citrix Netscaler vulnerability CVE-2026-88771\n\n\u2014 from @cyb3rops (https://x.com/cyb3rops/status/2104538140145000738)", "creation_timestamp": "2026-09-28T11:58:41.005514Z"}, {"uuid": "4eb1572e-9b96-448f-af4d-a9384f26781c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "08766759-354d-4855-8b5c-361fdcfa506f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103627", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88772-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FollowerSeize\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 09:58:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-28T10:00:08.000000Z"}, {"uuid": "a842e5ef-c073-452d-bd66-3f8f44bb5e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103634", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88771-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EXEcution-py\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 10:03:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nImproper Input Validation (CWE-20)  SSVC Scores Exploitation: Active Technical Impact: Total\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-28T10:04:31.000000Z"}, {"uuid": "668d1dc8-643b-4fe8-93e1-3476d2d53d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/ichintu/58cf1f5b7850f251de250b0b4ddc18ed", "content": "This 2026 cybersecurity briefing highlights critical vulnerabilities, active exploits, and emerging threat actor tactics across multiple platforms:\n\n\u2022 **Patched & High-Severity Flaws:** Google Cloud Application Integration, ManageEngine DDI Central, Apache Roller, Elixir\u2019s `mint` client, and BUFFALO Wi-Fi devices contain critical/high vulnerabilities (RCE, deserialization, DoS, and command injection). All have been patched; immediate updates to specified versions are required.\n\n\u2022 **Actively Exploited Risks:** Citrix NetScaler (CVE-2026-88771) is a critical, pre-authentication command injection flaw actively exploited by attackers, added to CISA\u2019s KEV catalog, and linked to Dutch hospital outages. FAST network devices face critical buffer overflows with public exploits and unresponsive vendors.\n\n\u2022 **Threat Actor Activity:** The JADEPUFFER/Storm-3168 group executed a destructive Azure attack via compromised service principals. Meanwhile, a ~80,000-node proxy network is harvesting and monetizing stolen AI/LLM credentials, with U.S. intelligence agencies linking the abuse to Chinese entities.\n\n\u2022 **Security Guidance:** Urgent patching is critical for Citrix, Apache Roller, ManageEngine, and FAST systems. Organizations should secure AI credentials using short-lived tokens, strict monitoring, and rapid incident response playbooks to counter credential theft and AI proxy abuse.", "creation_timestamp": "2026-09-28T12:06:15.000000Z"}, {"uuid": "0ee3d900-ddfe-4322-b31b-f364688bef1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwlbs6yt6f25", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)", "creation_timestamp": "2026-09-28T12:09:33.108703Z"}, {"uuid": "8f467411-341f-415d-999f-b20587cf90c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwlbutn7xm27", "content": "\ud83d\udcf0 CISA Perintahkan Pemerintah AS Menambal Dua Celah Kritis Citrix NetScaler Sebelum 30 September\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/28/cisa-patch-celah-citrix-netscaler-cve-2026-88771-88772/\n\n#cisa #citrix #cve #cyberSecurity #cybersecurity #keamananSiber #netscaler", "creation_timestamp": "2026-09-28T12:11:02.248647Z"}, {"uuid": "b19a6cf7-60db-4ad9-990a-f6466160ef68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwlc4dywdh2k", "content": "NetScaler ADC and Gateway patched for two zero-days: CVE-2026-88771 and CVE-2026-88772. CISA has ordered federal\u2026 https://0daynews.com/articles/2026-09-28-citrix-netscaler-patches-cve-2026-88771-cve-2026-88772/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3799", "creation_timestamp": "2026-09-28T12:15:14.627879Z"}, {"uuid": "14ff878c-9bad-4e2f-af5a-17651eb08fb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwlc4dywdh2k", "content": "NetScaler ADC and Gateway patched for two zero-days: CVE-2026-88771 and CVE-2026-88772. CISA has ordered federal\u2026 https://0daynews.com/articles/2026-09-28-citrix-netscaler-patches-cve-2026-88771-cve-2026-88772/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3799", "creation_timestamp": "2026-09-28T12:15:14.661688Z"}, {"uuid": "24bda30b-5be3-443b-8368-e4da3b2c3fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwlccmt4btzo", "content": "Citrix reports active exploitation of two critical NetScaler flaws: CVE-2026-88771 and CVE-2026-88772. Update affected customer-managed systems; CERT-EU urges compromise checks for exposed appliances.", "creation_timestamp": "2026-09-28T12:20:28.294939Z"}, {"uuid": "c7f4799d-a891-47c0-ad8c-7e47eeb93349", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwlccmt4btzo", "content": "Citrix reports active exploitation of two critical NetScaler flaws: CVE-2026-88771 and CVE-2026-88772. Update affected customer-managed systems; CERT-EU urges compromise checks for exposed appliances.", "creation_timestamp": "2026-09-28T12:20:28.341631Z"}, {"uuid": "5101e8ce-bbaa-45ca-b443-6cdb695241d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hack4career.com/post/3mwld2aunwc2p", "content": "Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772", "creation_timestamp": "2026-09-28T12:31:57.360213Z"}, {"uuid": "052892bd-af18-4863-9a16-5cc21fac2840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited", "content": "", "creation_timestamp": "2026-09-28T01:53:55.000000Z"}, {"uuid": "67b82400-6c29-46ed-8ea8-f053c8348a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited", "content": "", "creation_timestamp": "2026-09-28T01:53:55.000000Z"}, {"uuid": "3ec24177-6a05-464d-b83b-00160e241318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/information_security_channel/55987", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug (https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-28T10:22:26.000000Z"}, {"uuid": "9d6328fa-3972-4178-a167-d7ddee1f44a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/information_security_channel/55987", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug (https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-28T10:22:26.000000Z"}, {"uuid": "4ca3ea2c-da3f-4f7d-a2a5-fb86508bf8d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-88771 (CVSS score: 9.5) - An improper input validation vulnerability that could allow an unauthenticated attacker to", "creation_timestamp": "2026-09-28T05:21:49.000000Z"}, {"uuid": "23be76b0-baf2-45d6-bf4c-d9d88346486c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://social.bund.de/users/bsi/statuses/117348804174042056", "content": "\u26a0\ufe0f \ud83d\udce2 Sicherheitswarnung: Am 27. September 2026 ver\u00f6ffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitsl\u00fccken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte \u00fcber eine aktive Ausnutzung verbreitet hatten.\nMehr dazu hier: https://www.bsi.bund.de/dok/1209522", "creation_timestamp": "2026-09-28T13:05:07.226900Z"}, {"uuid": "994dae72-f00b-40b7-83cb-b75193ac3e23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://social.bund.de/users/bsi/statuses/117348804174042056", "content": "\u26a0\ufe0f \ud83d\udce2 Sicherheitswarnung: Am 27. September 2026 ver\u00f6ffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitsl\u00fccken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte \u00fcber eine aktive Ausnutzung verbreitet hatten.\nMehr dazu hier: https://www.bsi.bund.de/dok/1209522", "creation_timestamp": "2026-09-28T13:05:07.250243Z"}, {"uuid": "ab051367-043c-4029-afca-8f7beab28b98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://chaos.social/users/christopherkunz/statuses/117348842537592602", "content": "@bsi https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/Ab wann gilt der Betrieb dieser Ger\u00e4te eigentlich als fahrl\u00e4ssig?", "creation_timestamp": "2026-09-28T13:13:56.551953Z"}, {"uuid": "d5cfa17f-a54b-469d-b764-cfec84fec4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117348616624288037", "content": "CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway\n#CISA #KEV #Citrix #zeroday #CVE", "creation_timestamp": "2026-09-28T13:24:41.087862Z"}, {"uuid": "08ebe92a-bdbe-4c8e-83c4-a291a1b4a624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117348616624288037", "content": "CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway\n#CISA #KEV #Citrix #zeroday #CVE", "creation_timestamp": "2026-09-28T13:24:41.115767Z"}, {"uuid": "a62164a1-f00a-49cf-b8d1-64215f0791ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwlg27rcss25", "content": "Citrix says two critical NetScaler vulnerabilities are being actively exploited.\n\nCVE-2026-88771 enables unauthenticated RCE across all deployments.\n\nCVE-2026-88772 can lead to RCE or DoS where DTLS is enabled.\n\ncyberupdates365.com/citrix-netsc...\n\n#Cybersecurity #Citrix #NetScaler", "creation_timestamp": "2026-09-28T13:25:44.302693Z"}, {"uuid": "c782fcce-751e-4671-951b-d41a62192786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwlg27rcss25", "content": "Citrix says two critical NetScaler vulnerabilities are being actively exploited.\n\nCVE-2026-88771 enables unauthenticated RCE across all deployments.\n\nCVE-2026-88772 can lead to RCE or DoS where DTLS is enabled.\n\ncyberupdates365.com/citrix-netsc...\n\n#Cybersecurity #Citrix #NetScaler", "creation_timestamp": "2026-09-28T13:25:44.340434Z"}, {"uuid": "5ae22025-9b81-4bda-b8a5-59a92c9f2a49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwlg4xcmz22y", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE\n\nThis article heavily implies that the failure lies with Citrix's internal security and disclosure process rather than just a software bug. While the technical details of CVE-2026-88771 are clearly laid out, foc\u2026", "creation_timestamp": "2026-09-28T13:27:09.326347Z"}, {"uuid": "efa51d78-55b7-4f55-b73c-349c91ea16e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwlga6lslng2", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T13:29:03.045223Z"}, {"uuid": "4809bffc-ae80-4e65-b0ce-dd3f98d7dee6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwlgtxbvxf23", "content": "watchTowr Labs dissects CVE-2026-88771, another pre-auth command injection in Citrix NetScaler, the appliance that keeps finding new ways to shoot itself in the foot unauthenticated. The post walks through the flaw and why yet another NetScaler CVE is keeping defenders busy patching.", "creation_timestamp": "2026-09-28T13:42:49.370564Z"}, {"uuid": "f03eea04-1781-420e-8b8d-5eb6f58635ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "96c3c540-8b94-4546-a9fe-33aa66877370", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "8e80050e-e024-4744-86e2-91044ae013ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/inferlume.bsky.social/post/3mwll6cqkss25", "content": "Unpatched Citrix NetScaler gateways face active zero-day RCE exploitation under CVE-2026-88771 and CVE-2026-88772, triggering emergency CISA KEV deadlines while ShinyHunters and cloud wipers breach perimeters.\n\nFull Report: inferlume.com/reports/dail...\n\n#NetScaler #ZeroDay #ThreatIntel #CISA #SOC", "creation_timestamp": "2026-09-28T14:57:30.043307Z"}, {"uuid": "7c27129c-92ef-4f93-831a-ee6b9b844e59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/inferlume.bsky.social/post/3mwll6cqkss25", "content": "Unpatched Citrix NetScaler gateways face active zero-day RCE exploitation under CVE-2026-88771 and CVE-2026-88772, triggering emergency CISA KEV deadlines while ShinyHunters and cloud wipers breach perimeters.\n\nFull Report: inferlume.com/reports/dail...\n\n#NetScaler #ZeroDay #ThreatIntel #CISA #SOC", "creation_timestamp": "2026-09-28T14:57:30.075760Z"}, {"uuid": "384ad505-c4c1-4899-afb5-e4c95f8931f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/bdufstecru/3487", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 NetScaler ADC (\u0440\u0430\u043d\u0435\u0435 Citrix ADC) \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 NetScaler Gateway (\u0440\u0430\u043d\u0435\u0435 Citrix Gateway) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\n\nBDU:2026-15496\nCVE-2026-88771\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html", "creation_timestamp": "2026-09-28T14:27:02.000000Z"}, {"uuid": "cb41302d-97a6-4929-bda2-68c5d14d8aad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117349313638958333", "content": "There's various proof of concepts doing the rounds on Github for the new Citrix vulns.  All the ones I've seen so far are fake AI slop.  \nE.g. this one is AI generated, it's not a PoC, it doesn't exploit, the fingerprint method it uses doesn't exist and as a checker it doesn't actually work either.\nhttps://github.com/murrez/CVE-2026-88772", "creation_timestamp": "2026-09-28T15:13:53.920861Z"}, {"uuid": "0eaaf961-c1ee-45c8-8586-e2c088586171", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwlnd5u7o62i", "content": "CVE-2026-88775 is trending. Hype score 17, currently #6 on cvemon.\n\nMemory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88775", "creation_timestamp": "2026-09-28T15:35:53.682164Z"}, {"uuid": "1acc78bf-4538-415e-8325-65d28997d7b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/ian-bishop.bsky.social/post/3mwlnhgxwd22j", "content": "Citrix just confirmed two critical NetScaler RCE zero-days (CVE-2026-88771 & CVE-2026-88772) are being exploited in the wild. CISA added them to KEV with a Sept 30 deadline for feds. If you run NetScaler ADC/Gateway \u2014 patch to 14.1-73.37 / 13.1-64.23 now.\nsecnewsheadlines.com/p/citrix-net...", "creation_timestamp": "2026-09-28T15:38:19.102248Z"}, {"uuid": "dd3bf312-a5cc-4f6d-a29f-f9990316b2ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/ian-bishop.bsky.social/post/3mwlnhgxwd22j", "content": "Citrix just confirmed two critical NetScaler RCE zero-days (CVE-2026-88771 & CVE-2026-88772) are being exploited in the wild. CISA added them to KEV with a Sept 30 deadline for feds. If you run NetScaler ADC/Gateway \u2014 patch to 14.1-73.37 / 13.1-64.23 now.\nsecnewsheadlines.com/p/citrix-net...", "creation_timestamp": "2026-09-28T15:38:19.125958Z"}, {"uuid": "735643e8-c41a-4dcd-bbdc-a0418f9fbd52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "57f9a0d7-587d-44fa-8c08-50a73839bd0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "748861c9-0f7e-46f9-bb62-387bf2132fe1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/GithubRedTeam/103641", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a citrix-netscaler-cve-2026-88771-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a techupdate24\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 11:37:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-28T12:00:08.000000Z"}, {"uuid": "93c284aa-ee85-44c8-83c8-e91d48445864", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwlp32wvzz2z", "content": "~Cybergcca~\nCISA added two Citrix NetScaler CVEs to KEV; apply updates.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T16:07:09.525339Z"}, {"uuid": "8928594d-c9ee-477d-bd90-18cbaa65b2ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwlp32wvzz2z", "content": "~Cybergcca~\nCISA added two Citrix NetScaler CVEs to KEV; apply updates.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T16:07:09.566710Z"}, {"uuid": "c14f5ac3-9503-44b6-9f1d-c2d4c086c2f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "content": "", "creation_timestamp": "2026-09-28T05:16:20.000000Z"}, {"uuid": "1a92db2e-6652-4241-9ddc-90eac38d1c6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "9c579e22-75de-4f01-a494-cc044824c2e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "baf550ef-3f11-4f61-8d71-90002cf3228e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "26613100-51d8-47c9-a412-dfb02b97b873", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "7c62ac2f-582e-46f4-b44b-c68b2d6fe428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "cc9cb046-0593-4ebe-8666-194af0f57733", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "32ea7449-583a-4745-92a5-4547f17e3e27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "23b1e0a8-8492-4003-9657-fa479d7e8d55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "content": "", "creation_timestamp": "2026-09-28T05:00:00.000000Z"}, {"uuid": "bcd0aa37-7ade-4f65-bb40-943907bca18c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fb84583a-1292-444b-a5af-e431e11e44e6", "content": "", "creation_timestamp": "2026-09-28T17:00:55.080439Z"}, {"uuid": "c8fb0481-a175-4c7b-b14c-dff0cbec84d0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8531502c-38a6-45cf-a019-1e85f05f720a", "content": "", "creation_timestamp": "2026-09-28T17:00:55.205379Z"}, {"uuid": "19754eb2-995d-4d99-ab58-8e66f207b6c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwlskfdoo72n", "content": "CVE-2026-88771 and CVE-2026-88772: Critical Citrix NetScaler Zero\n\nThis article heavily emphasizes that exploitation is confirmed but downplays the lack of specific Indicators of Compromise, suggesting organizations should trust broad advisories over granular threat intelligence. If established \u2026", "creation_timestamp": "2026-09-28T17:09:25.379676Z"}, {"uuid": "eeb67a08-3f05-40a7-a629-239dc6d22d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwlskfdoo72n", "content": "CVE-2026-88771 and CVE-2026-88772: Critical Citrix NetScaler Zero\n\nThis article heavily emphasizes that exploitation is confirmed but downplays the lack of specific Indicators of Compromise, suggesting organizations should trust broad advisories over granular threat intelligence. If established \u2026", "creation_timestamp": "2026-09-28T17:09:25.413045Z"}, {"uuid": "d747c6f6-0e29-413e-9a52-c40eef940fbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mwlsnpsdvz2f", "content": "Citrix nouzov\u011b opravil NetScaler ADC a Gateway po potvrzen\u00ed aktivn\u00edho zneu\u017e\u00edv\u00e1n\u00ed chyb CVE-2026-88771 a CVE-2026-88772 (CVSS 9,5), umo\u017e\u0148uj\u00edc\u00edch vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du; doporu\u010duje okam\u017eitou aktualizaci.", "creation_timestamp": "2026-09-28T17:11:17.064816Z"}, {"uuid": "b1b5c0e2-5110-4cb7-aabb-92a372a68374", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mwlsnpsdvz2f", "content": "Citrix nouzov\u011b opravil NetScaler ADC a Gateway po potvrzen\u00ed aktivn\u00edho zneu\u017e\u00edv\u00e1n\u00ed chyb CVE-2026-88771 a CVE-2026-88772 (CVSS 9,5), umo\u017e\u0148uj\u00edc\u00edch vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du; doporu\u010duje okam\u017eitou aktualizaci.", "creation_timestamp": "2026-09-28T17:11:17.098388Z"}, {"uuid": "7a3fcecd-b12b-427d-8f47-326fffe62f16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwlsv2hxss2q", "content": "On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78\\.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. This is now known as CVE-2026-88771. \nhttps://\ngreynoise.io/blog/swarming-\nagainst\u2026\n\n\u2014 from @ImposeCost (https://x.com/ImposeCost/status/2104616791482019957)", "creation_timestamp": "2026-09-28T17:15:23.040831Z"}, {"uuid": "b2d85176-f91c-4cf3-aec7-c1776f50ee5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm55qmiwx2b", "content": "~Watchtowr~\nActively exploited unauthenticated command injection enables root RCE on default NetScaler configurations.\n-\nIOCs: CVE-2026-88771\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T20:19:11.653141Z"}, {"uuid": "a12eee2d-8ade-4d7b-8980-d5ff8a2e150c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.io/post/3mwlt5ttph22h", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.", "creation_timestamp": "2026-09-28T17:20:21.840009Z"}, {"uuid": "f7a728da-797b-4946-a274-7bec2824974f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117349804759188941", "content": "GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.\nhttps://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation\n#threatintel #citrix #netscaler #zeroday #CVE", "creation_timestamp": "2026-09-28T17:20:32.087597Z"}, {"uuid": "1acf5556-3bd7-41bc-ace7-ff86799f236f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117349816155656362", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.\nThe attacker's post-exploitation payload and IOCs: https://greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "creation_timestamp": "2026-09-28T17:21:32.331823Z"}, {"uuid": "66572b76-d275-4f89-9e50-f69844edcfae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwlta4t6h542", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-09-28T17:21:42.283353Z"}, {"uuid": "4532cc7f-9714-4733-9aa0-0070fd02f475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwltuti3k62y", "content": "On CVE-2026-88771, \n@GreyNoiseIO\n detected the Citrix NetScaler zero day exploitation as malicious within seconds of it occuring, and days before the CVE disclosure.\n\n\u2014 from @ImposeCost (https://x.com/ImposeCost/status/2104622723213533582)", "creation_timestamp": "2026-09-28T17:33:08.979205Z"}, {"uuid": "0f9dad26-0575-47c2-9560-3bb7cee189a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwlu3am7722d", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix t\u2026\n#hackernews #news", "creation_timestamp": "2026-09-28T17:36:44.842831Z"}, {"uuid": "d5f027a5-d343-4fe2-8322-d041b97db08f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwlu3am7722d", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix t\u2026\n#hackernews #news", "creation_timestamp": "2026-09-28T17:36:44.872739Z"}, {"uuid": "f747ee47-a454-4b65-86c9-8e67f3bc003e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/cert_eu/statuses/117349951351196239", "content": "Another day, another critical vulnerability in an edge device. We\u2019ve analysed the CVE-2026-88771, one of the many vulnerabilities disclosed by Citrix recently, based on observed exploitation attempts, and set out what we learned and key takeaways. \ud83d\udd0d\ud83d\udd12\nIf you\u2019re managing Citrix infrastructure, now\u2019s the time to check for compromise!\nhttps://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\n#cybersecurity #cve-2026-88771 #vulnerability", "creation_timestamp": "2026-09-28T17:55:54.683233Z"}, {"uuid": "91c80eec-0521-4e77-aa3b-72fee6fd25f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "content": "Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. \n\nThe post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild appeared first on Unit 42.", "creation_timestamp": "2026-09-28T13:02:04.000000Z"}, {"uuid": "489c2e94-6303-46b3-a9e7-36b42cc13eed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "content": "Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. \n\nThe post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild appeared first on Unit 42.", "creation_timestamp": "2026-09-28T13:02:04.000000Z"}, {"uuid": "5440d9c3-59c4-44de-944a-e865f434f549", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwm3hnzhj62x", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-88772 \u2013 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer\u00a0Vulnerability\n\nA high-severity memory buffer vulnerability in Citrix NetScaler is under active exploitation. Review CISA\u2026\n\nhttps://thecybermind.co/41l1", "creation_timestamp": "2026-09-28T19:48:57.941089Z"}, {"uuid": "c023ad01-5eb7-4c2a-8ea0-2e46c802cd97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4oyp7q42b", "content": "@ncsc.gov.uk\nTwo NetScaler flaws are actively exploited; patch or isolate affected systems.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T20:10:57.522068Z"}, {"uuid": "81f08ea8-4da9-42d5-b1b9-f534c0208032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4oyp7q42b", "content": "@ncsc.gov.uk\nTwo NetScaler flaws are actively exploited; patch or isolate affected systems.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T20:10:57.542431Z"}, {"uuid": "4cb3e5b4-66aa-4146-96b0-0128d2f9aa5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4un63mx2b", "content": "@sophossecurity.bsky.social\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "creation_timestamp": "2026-09-28T20:14:06.146995Z"}, {"uuid": "175aaf0f-05f8-4aa9-861a-d21974a28793", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4un63mx2b", "content": "@sophossecurity.bsky.social\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "creation_timestamp": "2026-09-28T20:14:06.186146Z"}, {"uuid": "1f8e6134-7ed0-4c08-9950-2c809c61c55d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24", "content": "\ud83d\udce2 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploit\u00e9s activement\n\n\ud83d\udd0d Vuln\u00e9rabilit\u00e9s identifi\u00e9es Citrix a publi\u00e9 le bulletin de s\u00e9curit\u00e9 CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#NetScaler #ZeroDay #Cyberveille", "creation_timestamp": "2026-09-28T20:30:06.816224Z"}, {"uuid": "101762e2-f7f6-4069-a536-422b45b437f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24", "content": "\ud83d\udce2 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploit\u00e9s activement\n\n\ud83d\udd0d Vuln\u00e9rabilit\u00e9s identifi\u00e9es Citrix a publi\u00e9 le bulletin de s\u00e9curit\u00e9 CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#NetScaler #ZeroDay #Cyberveille", "creation_timestamp": "2026-09-28T20:30:06.849582Z"}, {"uuid": "ecbfa0d8-25b1-401c-b6a6-585e56e4bfb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/49505", "content": "\ud83d\udea8 Critical pre-auth RCE in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771)\n\nCritical Vulnerability Alert!\nCitrix NetScaler ADC and NetScaler Gateway is affected by CVE-2026-88771.\n\n\ud83d\udd0d Identify Targets via ZoomEye:\n\nSearch Dork: app=\"Citrix NetScaler\"\nExposure: 239.2k instances identified globally.\n\nZoomEye Search Link:\n\ud83d\udc49 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXRyaXggTmV0U2NhbGVyIg%3D%3D\n\n#Infosec #CyberSecurity #ZoomEye", "creation_timestamp": "2026-09-28T20:14:55.000000Z"}, {"uuid": "6390198c-76f6-40e6-9f2c-d0e9d600f8d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwmb4kpvp627", "content": "\ud83d\udce2 Citrix NetScaler : injection de commandes pr\u00e9-auth exploit\u00e9e en zero-day (CVE-2026-88771)\n\nCet article pr\u00e9sente l'analyse technique d\u00e9taill\u00e9e de CVE-2026-88771, une vuln\u00e9rabilit\u00e9 d'injection de commandes pr\u00e9-authentification\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#CitrixNetScaler #ZeroDay #Cyberveille", "creation_timestamp": "2026-09-28T21:30:06.830608Z"}, {"uuid": "59f9d316-4ef6-456a-9bae-73e2c4e4cddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/117350840551160210", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T21:42:02.817441Z"}, {"uuid": "8ffbb82f-0dbd-4522-9656-c9902897d9a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mwmbrvgszn2r", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) labs.watchtowr.com/oh-look-the-...", "creation_timestamp": "2026-09-28T21:42:06.386228Z"}, {"uuid": "34d57470-28ac-4aad-b2af-ff7b4479a813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcd775752s", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09 #IPA \uff08Sep 28\uff09\n\nwww.ipa.go.jp/security/sec...", "creation_timestamp": "2026-09-28T21:51:43.387579Z"}, {"uuid": "1a8e7010-e636-45a1-8921-e026d6435ebf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcdjexto2e", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERT/CC \uff08Sep 28\uff09\n\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-09-28T21:51:53.913703Z"}, {"uuid": "21ca3904-6463-47e0-9cb7-af1536103199", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-28T22:34:30.164038Z"}, {"uuid": "2f221caf-9d52-43ed-b8d3-b6bf3703cba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-28T22:34:30.209395Z"}, {"uuid": "cb9c4fb9-3dec-4d1b-81c3-9e48374289a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-28T22:34:45.710649Z"}, {"uuid": "3aefa18e-6bb7-4433-9f97-edab626fa80c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-28T22:34:45.752833Z"}, {"uuid": "30cc18ac-d5fe-44d0-89a4-d264d85d00da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117351107654208046", "content": "Technical write up of the latest Citrix Netscaler incident, which I\u2019m calling PitScaler - you\u2019ll find out why from this: \n https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\nYou may notice it matches the hunting hints earlier in this thread. Guess who found it first :annoyingdog: \nIt\u2019s a really interesting vuln scenario. I\u2019m tracking over 100 victim orgs now. Each one has a unique webshell which can\u2019t be scanned for remotely unless you\u2019re the attacker. It\u2019s espionage.", "creation_timestamp": "2026-09-28T22:50:10.832761Z"}, {"uuid": "873cd335-6d10-48df-9c0e-8a85e55361b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117351138194874333", "content": "citrixInspector: Passively identify Citrix ADC / NetScaler ADC & Gateway builds and check for known vulnerabilities, including CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and KEV-listed CVE-2026-88771/88772.\nGitHub: https://github.com/securekomodo/citrixInspector", "creation_timestamp": "2026-09-28T22:57:45.083008Z"}, {"uuid": "40b6505e-8f2f-43ff-aecf-50023b48d8c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117351188539743753", "content": "CVE-2026-88771: Detection Artifact Generator for Citrix NetScaler\nGitHub: https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "creation_timestamp": "2026-09-28T23:10:32.968373Z"}, {"uuid": "24e0f67e-6018-4f2e-8515-84f8c050cce0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwmimqtog22y", "content": "Citrix NetScaler\u306eCritical \u8106\u5f31\u6027 2\u4ef6\u304c\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306b\u60aa\u7528\u3000CVE-2026-88771\u30fbCVE-2026-88772\u3001\u672a\u8a8d\u8a3cRCE\u306e\u6050\u308c \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "creation_timestamp": "2026-09-28T23:44:28.536225Z"}, {"uuid": "e240caae-d61d-4a53-876f-3f5196eeaa2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwmimqtog22y", "content": "Citrix NetScaler\u306eCritical \u8106\u5f31\u6027 2\u4ef6\u304c\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306b\u60aa\u7528\u3000CVE-2026-88771\u30fbCVE-2026-88772\u3001\u672a\u8a8d\u8a3cRCE\u306e\u6050\u308c \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "creation_timestamp": "2026-09-28T23:44:28.571205Z"}, {"uuid": "d62c612c-6597-47e7-902b-96c5973f31e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwmkw5appr2f", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE\n\nThis article centers heavily on the sheer number of exposed instances identified by Cortex Xpanse rather than providing specific technical details on the exploit chain or mitigation effectiveness against existing configurations. How does \u2026", "creation_timestamp": "2026-09-29T00:25:30.339368Z"}, {"uuid": "4d236908-7b19-40f4-8299-f66612fe8da2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmmjwegtr2b", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\uff08Citrix NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u4e16\u754c\u898f\u6a21\u3067\u60aa\u7528\uff09 #HelpNetSecurity (Sep 28)\nwww.helpnetsecurity.com/2026/09/28/c...", "creation_timestamp": "2026-09-29T00:54:26.767105Z"}, {"uuid": "7547132a-aee4-4031-ba98-250a901b5ca0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmmjwegtr2b", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\uff08Citrix NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u4e16\u754c\u898f\u6a21\u3067\u60aa\u7528\uff09 #HelpNetSecurity (Sep 28)\nwww.helpnetsecurity.com/2026/09/28/c...", "creation_timestamp": "2026-09-29T00:54:26.806839Z"}, {"uuid": "e3854bf5-c7ee-421a-8602-d5e87f007ef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwmokgomny2p", "content": "Citrix NetScaler-apparaten getroffen door kritieke zero-day kwetsbaarheden met a\n\nCitrix heeft het grootste deel van het weekend de actieve exploitatie van nieuwe zero-day kwetsbaarheden in NetScaler bevestigd. Deze kwetsbaarheden, ge\u00efdentificeerd als CVE-2026-88771 en CVE-2026-88772, hebben...", "creation_timestamp": "2026-09-29T01:30:32.261800Z"}, {"uuid": "bfd37339-5e1d-41b0-a033-3ec8170d0c7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwmokgomny2p", "content": "Citrix NetScaler-apparaten getroffen door kritieke zero-day kwetsbaarheden met a\n\nCitrix heeft het grootste deel van het weekend de actieve exploitatie van nieuwe zero-day kwetsbaarheden in NetScaler bevestigd. Deze kwetsbaarheden, ge\u00efdentificeerd als CVE-2026-88771 en CVE-2026-88772, hebben...", "creation_timestamp": "2026-09-29T01:30:32.285882Z"}, {"uuid": "ef330102-690a-4335-bfec-5d82d2f16770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwmqlvgsvy2l", "content": "\ud83d\udccc CVE-2026-88771 - Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-... https://www.cyberhub.blog/cves/CVE-2026-88771", "creation_timestamp": "2026-09-29T02:07:07.613332Z"}, {"uuid": "ccce0a34-7538-41d8-92f5-18e07bc36d85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwmsbj6czi2l", "content": "\ud83d\udccc CVE-2026-88772 - Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 F... https://www.cyberhub.blog/cves/CVE-2026-88772", "creation_timestamp": "2026-09-29T02:37:06.815956Z"}, {"uuid": "2387b5aa-d300-4f82-9b99-b9ebe0e8851b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwmug4oohv25", "content": "The latest update for #BitSight includes \"CVE-2026-88771 and CVE-2026-88772: Two Critical Citrix NetScaler Flaws Under Active Exploitation\" and \"Identity Risk: 5 Access Pathways Emerging Across #ThreatIntelligence\".\n \n#Cybersecurity #RiskManagement https://opsmtrs.com/43KoF0t", "creation_timestamp": "2026-09-29T03:15:29.275386Z"}, {"uuid": "bbfc5e97-6170-4b49-914d-c3c98e63e89c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwmug4oohv25", "content": "The latest update for #BitSight includes \"CVE-2026-88771 and CVE-2026-88772: Two Critical Citrix NetScaler Flaws Under Active Exploitation\" and \"Identity Risk: 5 Access Pathways Emerging Across #ThreatIntelligence\".\n \n#Cybersecurity #RiskManagement https://opsmtrs.com/43KoF0t", "creation_timestamp": "2026-09-29T03:15:29.302883Z"}, {"uuid": "11858854-2b57-477c-b558-f3c4d74d6c74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwmukldfnk2p", "content": "Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE\n\nThis article heavily emphasizes the low attack complexity for CVE-2026-88771, suggesting reliable RCE against all vulnerable deployments. However, it downplays the potential risk posed by the sheer prevalence of NetScaler appliances\u2026", "creation_timestamp": "2026-09-29T03:17:58.293507Z"}, {"uuid": "16d384c3-c76c-4832-9c45-11c0874be6a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwmy7zgrmq23", "content": "Citrix NetScaler \u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u4e16\u754c\u898f\u6a21\u3067\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\n\nCitrix\u306f\u3001NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u30fb\u9ad8severity\u5ea6\u306e\u8106\u5f31\u60278\u4ef6\u3092\u4fee\u6b63\u3057\u307e\u3057\u305f\u3002\u3046\u30612\u4ef6\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\u306f\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3066\u304a\u308a\u3001\u4fb5\u5bb3\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306bWeb\u30b7\u30a7\u30eb\u304c\u4ed5\u639b\u3051\u3089\u308c\u3066\u3044\u307e\u3057\u305f", "creation_timestamp": "2026-09-29T04:23:39.816130Z"}, {"uuid": "88366df5-4a80-4be7-9922-f89bbddb0f99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwmy7zgrmq23", "content": "Citrix NetScaler \u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u4e16\u754c\u898f\u6a21\u3067\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\n\nCitrix\u306f\u3001NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u30fb\u9ad8severity\u5ea6\u306e\u8106\u5f31\u60278\u4ef6\u3092\u4fee\u6b63\u3057\u307e\u3057\u305f\u3002\u3046\u30612\u4ef6\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\u306f\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3066\u304a\u308a\u3001\u4fb5\u5bb3\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306bWeb\u30b7\u30a7\u30eb\u304c\u4ed5\u639b\u3051\u3089\u308c\u3066\u3044\u307e\u3057\u305f", "creation_timestamp": "2026-09-29T04:23:39.846419Z"}, {"uuid": "cb413c9b-af9c-410c-b9ad-624603524fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwmzfft47j2l", "content": "CVE-2026-88771 is a Citrix NetScaler command injection exploited in the wild. Details and a PoC are public. Patch NetScaler to 14.1-73.37 now.\n\n#Citrix #NetScaler #CVE202688771 #CommandInjection #ZeroDay #ExploitedInTheWild #PoC #PatchNow", "creation_timestamp": "2026-09-29T04:44:34.045376Z"}, {"uuid": "412a43a4-9063-4479-adca-f5c1a8f34a5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "content": "", "creation_timestamp": "2026-09-28T21:00:04.000000Z"}, {"uuid": "321bc99c-c447-4198-921c-43a6572129a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "content": "", "creation_timestamp": "2026-09-28T21:00:04.000000Z"}, {"uuid": "a6aa68a6-1064-41df-ba8b-34a9995726c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "Telegram/86UKc-a8dyoVcD7Y4niyS9OxM-BpnvAATArPBShCYu67BME", "content": "", "creation_timestamp": "2026-09-28T11:00:13.000000Z"}, {"uuid": "378dc47b-7486-48d1-bb4a-0d7138ccb87c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "content": "", "creation_timestamp": "2026-09-28T15:00:07.000000Z"}, {"uuid": "7cc080fc-7a84-4c39-976e-5366d86edb15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "content": "", "creation_timestamp": "2026-09-28T15:00:07.000000Z"}, {"uuid": "66e6db6e-d164-4a64-a9f6-c4eab8d3c504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "Telegram/yXVzrAnyMVzUsfnjfkALrfBcKxKGxOpo3xtfae2jh7WYEoo", "content": "", "creation_timestamp": "2026-09-28T09:00:04.000000Z"}, {"uuid": "49574cdc-9ef6-43f6-8a28-5ad2a5a11fad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "Telegram/8MEljeuzrAecwW2JZuMlZ_8lhVdmg06Hvcm7mYkrERJsk-Q", "content": "", "creation_timestamp": "2026-09-27T23:00:16.000000Z"}, {"uuid": "49b980e5-6051-4066-a4b0-5712ce86e39b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwn2uxsf3k2d", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nCitrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day a\u2026\n#hackernews #news", "creation_timestamp": "2026-09-29T05:11:10.372110Z"}, {"uuid": "1a7529b2-435f-474f-86af-c63506454542", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwn2uxsf3k2d", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nCitrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day a\u2026\n#hackernews #news", "creation_timestamp": "2026-09-29T05:11:10.405494Z"}, {"uuid": "b703116f-3ea5-4aff-98f2-3435da62d663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwn5hff3v726", "content": "\ud83d\udee1\ufe0f Revue cyber du 29/09 :\n1. Citrix NetScaler : 2 zero-days RCE (CVE-2026-88771/88772) exploit\u00e9es, CISA exige un patch avant mercredi. \u00c9teignez/mettez \u00e0 jour. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "creation_timestamp": "2026-09-29T05:57:15.323738Z"}, {"uuid": "d14b94ba-8e81-44d8-a5de-e2bde46bc944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/VulnerabilityNews/44657", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "creation_timestamp": "2026-09-28T23:00:57.000000Z"}, {"uuid": "44e1d6f7-4759-4fe3-ac20-130ff686fcd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/VulnerabilityNews/44657", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "creation_timestamp": "2026-09-28T23:00:57.000000Z"}, {"uuid": "e0522737-42be-4b44-8cc3-e0ca2ee660e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "content": "", "creation_timestamp": "2026-09-28T21:00:04.000000Z"}, {"uuid": "ea6015d1-d8fe-43b4-932e-1b1fa51869dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "content": "", "creation_timestamp": "2026-09-28T21:00:04.000000Z"}, {"uuid": "57ddd699-20d0-4b6c-ba00-c697cab444b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwn5z2f5zn2h", "content": "\ud83d\udccc CVE-2026-88773 - Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\n... https://www.cyberhub.blog/cves/CVE-2026-88773", "creation_timestamp": "2026-09-29T06:07:07.661350Z"}, {"uuid": "b4fc1393-b8f9-4e67-95bf-13d4feb56fd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "Telegram/86UKc-a8dyoVcD7Y4niyS9OxM-BpnvAATArPBShCYu67BME", "content": "", "creation_timestamp": "2026-09-28T11:00:13.000000Z"}, {"uuid": "9ea99852-605b-43bf-8853-1acdd5b7c586", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "content": "", "creation_timestamp": "2026-09-28T15:00:07.000000Z"}, {"uuid": "72202243-da17-4661-8bb5-02647b776454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "content": "", "creation_timestamp": "2026-09-28T15:00:07.000000Z"}, {"uuid": "6e12c706-12c6-49d4-9c08-9b3d6c6b5be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "Telegram/V6c9VQj2u_Dqm6FzprdGaH0T584MBXKW58qYX0W7yOZqH5w", "content": "", "creation_timestamp": "2026-09-28T23:15:13.000000Z"}, {"uuid": "2aeb1572-0245-461b-8d69-36285961cb53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwnbt4vvtu27", "content": "Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after nearly two days of unofficial warnings. The flaws can enable remote code execution. #Citrix #NetScaler #CISA", "creation_timestamp": "2026-09-29T07:15:24.908926Z"}, {"uuid": "9895ffb8-771a-4236-8ffd-4a67397fb005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwnbt4vvtu27", "content": "Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after nearly two days of unofficial warnings. The flaws can enable remote code execution. #Citrix #NetScaler #CISA", "creation_timestamp": "2026-09-29T07:15:24.940451Z"}, {"uuid": "3ab4941f-6c32-4448-ace6-37aa516f3005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 73 interactions\nCVE-2026-88772: 61 interactions\nCVE-2026-87902: 44 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 20 interactions\nCVE-2026-88772: 13 interactions\nCVE-2026-82384: 6 interactions\n", "creation_timestamp": "2026-09-29T07:28:07.756255Z"}, {"uuid": "22afcdd7-d208-4a52-9b70-9c04c018d86d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 73 interactions\nCVE-2026-88772: 61 interactions\nCVE-2026-87902: 44 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 20 interactions\nCVE-2026-88772: 13 interactions\nCVE-2026-82384: 6 interactions\n", "creation_timestamp": "2026-09-29T07:28:07.788904Z"}, {"uuid": "b9ac1265-9583-44de-bfaf-f20a8f7bbab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwncns4jhn2q", "content": "Two critical NetScaler RCE zero-days are actively exploited in the wild. Citrix has patched both CVE-2026-88771 and\u2026\n\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/\n\n#cybersecurity #infosec", "creation_timestamp": "2026-09-29T07:30:18.674391Z"}, {"uuid": "dbafd878-64f4-47e4-8588-6dc23e17ce4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/alon710/8178acb7c07fdcab127104f7b77df5ce", "content": "# CVE-2026-88773: CVE-2026-88773: Critical HTTP Request Smuggling in Citrix NetScaler ADC and Gateway\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-09-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88773\n\n## Summary\nA critical HTTP request/response smuggling vulnerability (CWE-444) exists in Citrix NetScaler ADC and Citrix NetScaler Gateway. This flaw arises from inconsistent request boundary parsing between NetScaler appliances and backend web servers, allowing remote, unauthenticated attackers to bypass security boundaries, access restricted resources, or hijack active user sessions on multiplexed TCP connections.\n\n## TL;DR\nUnauthenticated HTTP request smuggling in Citrix NetScaler allows session hijacking, policy bypass, and cache poisoning due to boundary parsing differences.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Exploit Status**: None/Theoretical (No public PoC code)\n- **CISA KEV Status**: Not Listed (Related CVEs CVE-2026-88771/2 are listed)\n- **Primary Impact**: Session Hijacking, Security Bypass, Cache Poisoning\n\n## Affected Systems\n\n- Citrix NetScaler ADC (Standard/Enterprise/Platinum)\n- Citrix NetScaler Gateway\n- Citrix NetScaler ADC FIPS\n- Citrix NetScaler ADC NDcPP\n\n## Mitigation\n\n- Upgrade firmware to the latest secure version (14.1-73.37 / 13.1-64.24 or later)\n- Disable TCP multiplexing and keep-alive settings on downstream web servers to prevent socket reuse\n- Configure Web Application Firewalls (WAF) to detect and block contradictory Content-Length and Transfer-Encoding headers\n- Enable Enhanced ISN Generation to mitigate related TCP prediction attacks\n\n**Remediation Steps:**\n1. Identify vulnerable NetScaler appliances and execute configuration checks for active HTTP/SSL virtual servers.\n2. Download the appropriate secure firmware build (14.1-73.37 or 13.1-64.24) from the official Citrix portal.\n3. Apply the firmware update to both standalone nodes or in high-availability (HA) pairs sequentially.\n4. Execute CLI commands on all partitions to enable Enhanced ISN Generation: 'set ns tcpparam -enhancedISNgeneration ENABLED'.\n5. Save the active configuration locally via 'save ns config -all' and reboot the appliance if required.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88773) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T07:30:30.000000Z"}, {"uuid": "fc9f0e58-892a-4ac2-9781-a1e8f6461bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://gist.github.com/alon710/8178acb7c07fdcab127104f7b77df5ce", "content": "# CVE-2026-88773: CVE-2026-88773: Critical HTTP Request Smuggling in Citrix NetScaler ADC and Gateway\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-09-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88773\n\n## Summary\nA critical HTTP request/response smuggling vulnerability (CWE-444) exists in Citrix NetScaler ADC and Citrix NetScaler Gateway. This flaw arises from inconsistent request boundary parsing between NetScaler appliances and backend web servers, allowing remote, unauthenticated attackers to bypass security boundaries, access restricted resources, or hijack active user sessions on multiplexed TCP connections.\n\n## TL;DR\nUnauthenticated HTTP request smuggling in Citrix NetScaler allows session hijacking, policy bypass, and cache poisoning due to boundary parsing differences.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Exploit Status**: None/Theoretical (No public PoC code)\n- **CISA KEV Status**: Not Listed (Related CVEs CVE-2026-88771/2 are listed)\n- **Primary Impact**: Session Hijacking, Security Bypass, Cache Poisoning\n\n## Affected Systems\n\n- Citrix NetScaler ADC (Standard/Enterprise/Platinum)\n- Citrix NetScaler Gateway\n- Citrix NetScaler ADC FIPS\n- Citrix NetScaler ADC NDcPP\n\n## Mitigation\n\n- Upgrade firmware to the latest secure version (14.1-73.37 / 13.1-64.24 or later)\n- Disable TCP multiplexing and keep-alive settings on downstream web servers to prevent socket reuse\n- Configure Web Application Firewalls (WAF) to detect and block contradictory Content-Length and Transfer-Encoding headers\n- Enable Enhanced ISN Generation to mitigate related TCP prediction attacks\n\n**Remediation Steps:**\n1. Identify vulnerable NetScaler appliances and execute configuration checks for active HTTP/SSL virtual servers.\n2. Download the appropriate secure firmware build (14.1-73.37 or 13.1-64.24) from the official Citrix portal.\n3. Apply the firmware update to both standalone nodes or in high-availability (HA) pairs sequentially.\n4. Execute CLI commands on all partitions to enable Enhanced ISN Generation: 'set ns tcpparam -enhancedISNgeneration ENABLED'.\n5. Save the active configuration locally via 'save ns config -all' and reboot the appliance if required.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88773) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T07:30:30.000000Z"}, {"uuid": "675eae91-1c63-40fc-86c6-1150979aa115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwnczxqwyo27", "content": "\ud83d\udccc CVE-2026-88778 - Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-... https://www.cyberhub.blog/cves/CVE-2026-88778", "creation_timestamp": "2026-09-29T07:37:07.341348Z"}, {"uuid": "97037a8a-2df1-4dcf-9cb3-9d8bd1b7f611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd2mz43c27", "content": "\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u043e\u0446 \u0441\u0435\u0442\u0435\u0439\n\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\n\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "creation_timestamp": "2026-09-29T07:37:32.968218Z"}, {"uuid": "77539f0c-2b43-48b5-8a69-cefac5208dd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd2mz43c27", "content": "\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u043e\u0446 \u0441\u0435\u0442\u0435\u0439\n\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\n\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "creation_timestamp": "2026-09-29T07:37:33.011899Z"}, {"uuid": "0ce173e5-5e30-439a-89e1-728fa7714b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd57ao2227", "content": "\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "creation_timestamp": "2026-09-29T07:38:59.582305Z"}, {"uuid": "b2e9b1ef-3d0b-4c1d-b4a4-889112f45aa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd57ao2227", "content": "\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "creation_timestamp": "2026-09-29T07:38:59.617666Z"}, {"uuid": "6b5ca3e6-e397-444a-a1d4-ed5c2bd9c638", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwne2sr6usaf", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb https://www.ipa.go.jp/security/security-alert/2026/alert20260928.html", "creation_timestamp": "2026-09-29T07:55:29.274860Z"}, {"uuid": "d4a05281-1235-4f16-bc35-9db856c34026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "Telegram/8MEljeuzrAecwW2JZuMlZ_8lhVdmg06Hvcm7mYkrERJsk-Q", "content": "", "creation_timestamp": "2026-09-27T23:00:16.000000Z"}, {"uuid": "51573e48-a71f-4ff3-9bb8-c1c07ae4eb9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "Telegram/yXVzrAnyMVzUsfnjfkALrfBcKxKGxOpo3xtfae2jh7WYEoo", "content": "", "creation_timestamp": "2026-09-28T09:00:04.000000Z"}, {"uuid": "ce6abe83-f506-4cdf-94b6-149099e06297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwneplox6t2t", "content": "\ud83d\udccc CVE-2026-88775 - Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, bef... https://www.cyberhub.blog/cves/CVE-2026-88775", "creation_timestamp": "2026-09-29T08:07:07.222473Z"}, {"uuid": "91e46faf-3ad3-4ae2-8b8e-0f90ce2004ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwngfb6ei22e", "content": "\ud83d\udccc CVE-2026-88776 - Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\nThis issue affects ADC: before 14.1-73.37, before 13... https://www.cyberhub.blog/cves/CVE-2026-88776", "creation_timestamp": "2026-09-29T08:37:07.559264Z"}, {"uuid": "fd7ee6dc-13f6-4cd4-9c0b-1c0327ea2cbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/440", "content": "Citrix NetScaler PreAuth Command Injection\n\nCVE-2026-88771 Improper input validation leading to RCE in a default NetScaler configuration, with no additional product features required.\n\nBlog:\n   \u2022 https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/\n   \u2022 https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/\n\nSearch Query:\nZoomEye: app=\"Citrix NetScaler\"\nFOFA: app=\"NetScaler-AAA\"", "creation_timestamp": "2026-09-29T07:11:03.000000Z"}, {"uuid": "e6c5c0f8-3c3d-49ed-9f92-55731a828280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/440", "content": "Citrix NetScaler PreAuth Command Injection\n\nCVE-2026-88771 Improper input validation leading to RCE in a default NetScaler configuration, with no additional product features required.\n\nBlog:\n   \u2022 https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/\n   \u2022 https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/\n\nSearch Query:\nZoomEye: app=\"Citrix NetScaler\"\nFOFA: app=\"NetScaler-AAA\"", "creation_timestamp": "2026-09-29T07:11:03.000000Z"}, {"uuid": "2854eb96-c48f-4667-ae88-80077610376b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwni2vqh2m2t", "content": "\ud83d\udccc CVE-2026-88777 - Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 1... https://www.cyberhub.blog/cves/CVE-2026-88777", "creation_timestamp": "2026-09-29T09:07:07.554954Z"}, {"uuid": "169837f1-a0fa-4c5f-ae94-5bf9ff29c859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwnmzvqyd22h", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) - Help Net Security www.helpnetsecurity.com/2026/09/28/c...", "creation_timestamp": "2026-09-29T10:36:04.361516Z"}, {"uuid": "4f32ef2a-cadb-45ae-9035-7c58d2ce12a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwnmzvqyd22h", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) - Help Net Security www.helpnetsecurity.com/2026/09/28/c...", "creation_timestamp": "2026-09-29T10:36:04.390972Z"}, {"uuid": "ab90fc05-ef43-4107-ac32-f76e7052ff61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "Telegram/DrbNH4uqJedT5sAqO6eGnwMUaYlIlYbbHz_FBCNpaIT3xg", "content": "", "creation_timestamp": "2026-09-28T11:10:35.000000Z"}, {"uuid": "778ce74a-db54-4bea-9040-f8a4a512bff8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://t.me/GithubRedTeam/103737", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler-ctx697096-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ThomasPoppelgaard\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 09:59:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAm I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771 \u2013 CVE-2026-88778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, plus --ioc sweep with every public IoC (webshells, exploit files, log injection, attacker IPs).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T10:00:09.000000Z"}, {"uuid": "3d20ad09-b1d6-4b38-9ce8-447abc88136f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/GithubRedTeam/103737", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler-ctx697096-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ThomasPoppelgaard\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 09:59:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAm I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771 \u2013 CVE-2026-88778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, plus --ioc sweep with every public IoC (webshells, exploit files, log injection, attacker IPs).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T10:00:09.000000Z"}, {"uuid": "bfe7410c-ed26-4ba6-aba1-25abcb19000f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newsarea.bsky.social/post/3mwnpmwmtxx2h", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) \u2013 watchTowr\u00a0Labs\n\nGod damn it, we're back in the room again. Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where\u2026", "creation_timestamp": "2026-09-29T11:22:29.596701Z"}, {"uuid": "2db453d9-f924-44ad-8b59-51de0e6d5cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mwnrhcfxfc2a", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited\nin the Wild\nunit42.paloaltonetworks.com/netscaler-ze...", "creation_timestamp": "2026-09-29T11:55:18.097831Z"}, {"uuid": "23b03306-5058-4de6-bc02-a62dd0677563", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mwnrhcfxfc2a", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited\nin the Wild\nunit42.paloaltonetworks.com/netscaler-ze...", "creation_timestamp": "2026-09-29T11:55:18.127788Z"}, {"uuid": "75148cb9-8849-42c3-8a00-4e5d7ada59be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103737", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler-ctx697096-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ThomasPoppelgaard\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 09:59:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAm I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771 \u2013 CVE-2026-88778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, plus --ioc sweep with every public IoC (webshells, exploit files, log injection, attacker IPs).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T10:00:09.000000Z"}, {"uuid": "f9326900-1c91-404a-ba4f-daf355796039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103737", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler-ctx697096-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ThomasPoppelgaard\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 09:59:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAm I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771 \u2013 CVE-2026-88778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, plus --ioc sweep with every public IoC (webshells, exploit files, log injection, attacker IPs).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T10:00:09.000000Z"}, {"uuid": "37efd4a9-7666-428e-b75c-26f1325ec5ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "Telegram/DrbNH4uqJedT5sAqO6eGnwMUaYlIlYbbHz_FBCNpaIT3xg", "content": "", "creation_timestamp": "2026-09-28T11:10:35.000000Z"}, {"uuid": "dc53b450-7197-41c7-900f-015bed272a85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/robcampbell.bsky.social/post/3mwnxknnh2s2d", "content": "Citrix says two critical NetScaler flaws are already being exploited. CVE-2026-88771 affects default configurations and allows unauthenticated command execution. Patch immediately.\n\nsupport.citrix.com/external/art...\n\n#Cybersecurity #NetScaler #Citrix", "creation_timestamp": "2026-09-29T13:44:22.079173Z"}, {"uuid": "5fed2398-91ba-46d6-bdc8-7b60765f822f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cybergeodigest.bsky.social/post/3mwnxykoll225", "content": "Today's CyberGeoDigest \u2014 20 stories\n\nTop: CVE-2026-88772 Zero-Day Hits Citrix NetScaler in Active Government, Finance Campaign\n\n#APT #ThreatIntel #CyberSecurity", "creation_timestamp": "2026-09-29T13:52:08.530508Z"}, {"uuid": "879bd895-e6a3-457c-8913-6adbdd1ac251", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/mgtech.bsky.social/post/3mwnygoin4g2c", "content": "\ud83d\udea8 BREAKING: CVE-2026-88771 and CVE-2026-88772 are rated critical with 9.5 CVSS scores. CVE-2026-88771 allows remote code execution by unauthenticated attackers.\n\nhttps://www.theregister.com/security/2026/09/28/certainties-in-life-death-taxes-and-critical-citrix-vulns-under-attack/5299369", "creation_timestamp": "2026-09-29T14:00:02.108956Z"}, {"uuid": "b7e4a5c6-6b54-49c4-9500-142d8bf2700f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/mgtech.bsky.social/post/3mwnygoin4g2c", "content": "\ud83d\udea8 BREAKING: CVE-2026-88771 and CVE-2026-88772 are rated critical with 9.5 CVSS scores. CVE-2026-88771 allows remote code execution by unauthenticated attackers.\n\nhttps://www.theregister.com/security/2026/09/28/certainties-in-life-death-taxes-and-critical-citrix-vulns-under-attack/5299369", "creation_timestamp": "2026-09-29T14:00:02.142302Z"}, {"uuid": "34ea2353-3f12-4ff1-93e9-f76e3284a75d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117354688304468536", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-29T14:00:35.577586Z"}, {"uuid": "cff24ecd-4949-487f-9590-bb7e915ed02f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117354688304468536", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-29T14:00:35.608594Z"}, {"uuid": "9609c756-fa6c-40e3-9edc-43782f2d6808", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwnyij7o4z2x", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-29T14:01:03.824728Z"}, {"uuid": "f70de990-c8bf-417c-b94e-4e2875713ffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwnyij7o4z2x", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-29T14:01:03.856284Z"}, {"uuid": "c2974168-660e-499c-922c-c28894131612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwnymsyacr2s", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs", "creation_timestamp": "2026-09-29T14:03:29.020892Z"}, {"uuid": "221655bd-8e84-4583-8d26-779c49b2b232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwnzshlwrg2a", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) - watchTowr Labs", "creation_timestamp": "2026-09-29T14:24:31.541584Z"}, {"uuid": "ba7ec4ec-aeaf-4a00-97d5-213891e63e33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117354800209103638", "content": "Citrix shenanigans from @watchTowr \nhttps://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772/blob/main/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772.py", "creation_timestamp": "2026-09-29T14:29:04.868188Z"}, {"uuid": "b3ca8ca7-fad2-498f-ba4b-676daf621070", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117354824630218380", "content": "New.\nWatchTower: Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/\nYesterday:\nWatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #infosec #vulnerability #NetScaler #Citrix", "creation_timestamp": "2026-09-29T14:35:15.024252Z"}, {"uuid": "ec569fb9-a07a-4461-8325-326db3f997ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117354824630218380", "content": "New.\nWatchTower: Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/\nYesterday:\nWatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #infosec #vulnerability #NetScaler #Citrix", "creation_timestamp": "2026-09-29T14:35:15.070761Z"}, {"uuid": "a1b015da-2782-481a-98b3-b0e6375267e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vdwnk24", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:22.928290Z"}, {"uuid": "1d44b221-4c0a-475c-bb9d-0c032b5ac6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veq2224", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:23.373284Z"}, {"uuid": "7b8384e6-a3ff-4e6d-a4c8-9bc366f9736a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veqzc24", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:23.836360Z"}, {"uuid": "529b8181-dbce-4356-aed2-61c4d0504bb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vesxs24", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:24.293558Z"}, {"uuid": "2038fe8b-5451-4d16-a021-1ff69977d3d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vexu224", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:24.731947Z"}, {"uuid": "4678b61a-8833-4553-9e3e-ce92acdb9d21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vexu324", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:25.189001Z"}, {"uuid": "0c8b747a-7953-4448-9e6f-71b7b0487746", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veytd24", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:25.631320Z"}, {"uuid": "faad11b3-098a-4cc6-8d84-624b4db0c279", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vezsl24", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "creation_timestamp": "2026-09-29T14:49:26.086014Z"}, {"uuid": "28489e15-962d-4d11-b7f2-eb7b0c5760f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "exploited", "source": "https://t.me/cyberok_news/256", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Citrix NetScaler ADC \u0438 Gateway: CVE-2026-88771\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 (RCE) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u0435\u0441\u0441\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2026-88771 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430. Payload \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438 NetScaler, \u043e\u0442\u043a\u0443\u0434\u0430 \u0435\u0433\u043e \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 Perl-\u0441\u043a\u0440\u0438\u043f\u0442 ns_monuploadd_err.pl, \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 shell \u0431\u0435\u0437 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u0435\u043a\u0442\u043e\u0440 \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u043e\u0434\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u043c: User-Agent \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u043b\u044f, \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433\u0438, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u0423\u044f\u0437\u0432\u0438\u043c \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u26a1\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 26.09.2026 \u2014 watchTowr \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\u2022 27.09.2026 \u2014 Citrix \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-88771 \u0438 CVE-2026-88772 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 30.09.2026.\n\u2022 28.09.2026 \u2014 watchTowr \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC \u0438 Detection Artifact Generator, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u2014 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0435.\n\n\ud83d\udd3aCVSS v4.0: 9.5 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udccb \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\u2022 \u041f\u043e\u043c\u0438\u043c\u043e CVE-2026-88771, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0434\u043b\u044f CVE-2026-88772 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 DTLS, RCE/DoS, CVSS 9.5). \n\u2022 \u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u2014 CVE-2026-88773 (HTTP request smuggling, 9.3) \u0438 CVE-2026-88774 \u2014 88778 (memory overflow, predictable values, 7.0\u20138.8) \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c, \u0432\u0441\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0442 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439. \n\u2022 \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e: CVE-2026-88778 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c Enhanced ISN Generation.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 NetScaler ADC \u0438 Gateway 14.1 \u0434\u043e 14.1-73.37.\n\u2022 NetScaler ADC \u0438 Gateway 13.1 \u0434\u043e 13.1-64.23.\n\u2022 NetScaler ADC FIPS \u0434\u043e 14.1-73.37 FIPS.\n- NetScaler ADC FIPS \u0438 NDcPP \u0434\u043e 13.1-37.279.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u043c, \u0438 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0435 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Secure Private Access. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b Citrix \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u0414\u043b\u044f CVE-2026-88771 workaround \u043d\u0435\u0442. \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2026, \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n2. \u0414\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0430\u043c\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043b\u043e\u0433\u0438: \u043f\u0430\u0442\u0447 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0441\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043f\u0430\u0442\u0442\u0435\u0440\u043d pitboss PPE unexpectedly died NSPPE \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438.\n\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e IoC \u0447\u0435\u0440\u0435\u0437 Security Advisory \u0432 NetScaler Console.\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441\u0435\u0441\u0441\u0438\u0439 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.\n\n\ud83d\udd17 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 watchTowr + PoC \n\ud83d\udd17 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c Citrix CTX697096\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-88771 \u0432 NVD \n\ud83d\udd17 FAQ watchTowr", "creation_timestamp": "2026-09-28T14:20:50.000000Z"}, {"uuid": "d15e7c15-c068-4ad2-b6c1-23f0b5b29527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/cyberok_news/256", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Citrix NetScaler ADC \u0438 Gateway: CVE-2026-88771\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 (RCE) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u0435\u0441\u0441\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2026-88771 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430. Payload \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438 NetScaler, \u043e\u0442\u043a\u0443\u0434\u0430 \u0435\u0433\u043e \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 Perl-\u0441\u043a\u0440\u0438\u043f\u0442 ns_monuploadd_err.pl, \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 shell \u0431\u0435\u0437 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u0435\u043a\u0442\u043e\u0440 \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u043e\u0434\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u043c: User-Agent \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u043b\u044f, \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433\u0438, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u0423\u044f\u0437\u0432\u0438\u043c \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u26a1\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 26.09.2026 \u2014 watchTowr \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\u2022 27.09.2026 \u2014 Citrix \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-88771 \u0438 CVE-2026-88772 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 30.09.2026.\n\u2022 28.09.2026 \u2014 watchTowr \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC \u0438 Detection Artifact Generator, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u2014 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0435.\n\n\ud83d\udd3aCVSS v4.0: 9.5 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udccb \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\u2022 \u041f\u043e\u043c\u0438\u043c\u043e CVE-2026-88771, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0434\u043b\u044f CVE-2026-88772 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 DTLS, RCE/DoS, CVSS 9.5). \n\u2022 \u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u2014 CVE-2026-88773 (HTTP request smuggling, 9.3) \u0438 CVE-2026-88774 \u2014 88778 (memory overflow, predictable values, 7.0\u20138.8) \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c, \u0432\u0441\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0442 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439. \n\u2022 \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e: CVE-2026-88778 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c Enhanced ISN Generation.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 NetScaler ADC \u0438 Gateway 14.1 \u0434\u043e 14.1-73.37.\n\u2022 NetScaler ADC \u0438 Gateway 13.1 \u0434\u043e 13.1-64.23.\n\u2022 NetScaler ADC FIPS \u0434\u043e 14.1-73.37 FIPS.\n- NetScaler ADC FIPS \u0438 NDcPP \u0434\u043e 13.1-37.279.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u043c, \u0438 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0435 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Secure Private Access. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b Citrix \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u0414\u043b\u044f CVE-2026-88771 workaround \u043d\u0435\u0442. \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2026, \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n2. \u0414\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0430\u043c\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043b\u043e\u0433\u0438: \u043f\u0430\u0442\u0447 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0441\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043f\u0430\u0442\u0442\u0435\u0440\u043d pitboss PPE unexpectedly died NSPPE \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438.\n\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e IoC \u0447\u0435\u0440\u0435\u0437 Security Advisory \u0432 NetScaler Console.\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441\u0435\u0441\u0441\u0438\u0439 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.\n\n\ud83d\udd17 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 watchTowr + PoC \n\ud83d\udd17 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c Citrix CTX697096\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-88771 \u0432 NVD \n\ud83d\udd17 FAQ watchTowr", "creation_timestamp": "2026-09-28T14:20:50.000000Z"}, {"uuid": "5a3a95ee-aa7d-4179-9d7d-ad062e3d7806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/cyberok_news/256", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Citrix NetScaler ADC \u0438 Gateway: CVE-2026-88771\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 (RCE) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u0435\u0441\u0441\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2026-88771 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430. Payload \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438 NetScaler, \u043e\u0442\u043a\u0443\u0434\u0430 \u0435\u0433\u043e \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 Perl-\u0441\u043a\u0440\u0438\u043f\u0442 ns_monuploadd_err.pl, \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 shell \u0431\u0435\u0437 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u0435\u043a\u0442\u043e\u0440 \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u043e\u0434\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u043c: User-Agent \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u043b\u044f, \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433\u0438, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u0423\u044f\u0437\u0432\u0438\u043c \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u26a1\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 26.09.2026 \u2014 watchTowr \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\u2022 27.09.2026 \u2014 Citrix \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-88771 \u0438 CVE-2026-88772 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 30.09.2026.\n\u2022 28.09.2026 \u2014 watchTowr \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC \u0438 Detection Artifact Generator, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u2014 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0435.\n\n\ud83d\udd3aCVSS v4.0: 9.5 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udccb \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\u2022 \u041f\u043e\u043c\u0438\u043c\u043e CVE-2026-88771, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0434\u043b\u044f CVE-2026-88772 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 DTLS, RCE/DoS, CVSS 9.5). \n\u2022 \u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u2014 CVE-2026-88773 (HTTP request smuggling, 9.3) \u0438 CVE-2026-88774 \u2014 88778 (memory overflow, predictable values, 7.0\u20138.8) \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c, \u0432\u0441\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0442 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439. \n\u2022 \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e: CVE-2026-88778 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c Enhanced ISN Generation.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 NetScaler ADC \u0438 Gateway 14.1 \u0434\u043e 14.1-73.37.\n\u2022 NetScaler ADC \u0438 Gateway 13.1 \u0434\u043e 13.1-64.23.\n\u2022 NetScaler ADC FIPS \u0434\u043e 14.1-73.37 FIPS.\n- NetScaler ADC FIPS \u0438 NDcPP \u0434\u043e 13.1-37.279.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u043c, \u0438 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0435 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Secure Private Access. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b Citrix \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u0414\u043b\u044f CVE-2026-88771 workaround \u043d\u0435\u0442. \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2026, \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n2. \u0414\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0430\u043c\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043b\u043e\u0433\u0438: \u043f\u0430\u0442\u0447 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0441\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043f\u0430\u0442\u0442\u0435\u0440\u043d pitboss PPE unexpectedly died NSPPE \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438.\n\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e IoC \u0447\u0435\u0440\u0435\u0437 Security Advisory \u0432 NetScaler Console.\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441\u0435\u0441\u0441\u0438\u0439 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.\n\n\ud83d\udd17 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 watchTowr + PoC \n\ud83d\udd17 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c Citrix CTX697096\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-88771 \u0432 NVD \n\ud83d\udd17 FAQ watchTowr", "creation_timestamp": "2026-09-28T14:20:50.000000Z"}, {"uuid": "2393415b-df8d-4c8a-98a1-9b8875e25916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88774", "type": "exploited", "source": "https://t.me/cyberok_news/256", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Citrix NetScaler ADC \u0438 Gateway: CVE-2026-88771\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 (RCE) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u0435\u0441\u0441\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2026-88771 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430. Payload \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438 NetScaler, \u043e\u0442\u043a\u0443\u0434\u0430 \u0435\u0433\u043e \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 Perl-\u0441\u043a\u0440\u0438\u043f\u0442 ns_monuploadd_err.pl, \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 shell \u0431\u0435\u0437 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u0435\u043a\u0442\u043e\u0440 \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u043e\u0434\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u043c: User-Agent \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u043b\u044f, \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433\u0438, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u0423\u044f\u0437\u0432\u0438\u043c \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u26a1\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 26.09.2026 \u2014 watchTowr \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\u2022 27.09.2026 \u2014 Citrix \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-88771 \u0438 CVE-2026-88772 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 30.09.2026.\n\u2022 28.09.2026 \u2014 watchTowr \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC \u0438 Detection Artifact Generator, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u2014 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0435.\n\n\ud83d\udd3aCVSS v4.0: 9.5 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udccb \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\u2022 \u041f\u043e\u043c\u0438\u043c\u043e CVE-2026-88771, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0434\u043b\u044f CVE-2026-88772 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 DTLS, RCE/DoS, CVSS 9.5). \n\u2022 \u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u2014 CVE-2026-88773 (HTTP request smuggling, 9.3) \u0438 CVE-2026-88774 \u2014 88778 (memory overflow, predictable values, 7.0\u20138.8) \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c, \u0432\u0441\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0442 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439. \n\u2022 \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e: CVE-2026-88778 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c Enhanced ISN Generation.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 NetScaler ADC \u0438 Gateway 14.1 \u0434\u043e 14.1-73.37.\n\u2022 NetScaler ADC \u0438 Gateway 13.1 \u0434\u043e 13.1-64.23.\n\u2022 NetScaler ADC FIPS \u0434\u043e 14.1-73.37 FIPS.\n- NetScaler ADC FIPS \u0438 NDcPP \u0434\u043e 13.1-37.279.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u043c, \u0438 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0435 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Secure Private Access. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b Citrix \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u0414\u043b\u044f CVE-2026-88771 workaround \u043d\u0435\u0442. \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2026, \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n2. \u0414\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0430\u043c\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043b\u043e\u0433\u0438: \u043f\u0430\u0442\u0447 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0441\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043f\u0430\u0442\u0442\u0435\u0440\u043d pitboss PPE unexpectedly died NSPPE \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438.\n\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e IoC \u0447\u0435\u0440\u0435\u0437 Security Advisory \u0432 NetScaler Console.\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441\u0435\u0441\u0441\u0438\u0439 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.\n\n\ud83d\udd17 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 watchTowr + PoC \n\ud83d\udd17 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c Citrix CTX697096\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-88771 \u0432 NVD \n\ud83d\udd17 FAQ watchTowr", "creation_timestamp": "2026-09-28T14:20:50.000000Z"}, {"uuid": "cbc7d82a-efa6-4f17-abc6-c4d12e6307c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "exploited", "source": "https://t.me/cyberok_news/256", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Citrix NetScaler ADC \u0438 Gateway: CVE-2026-88771\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 (RCE) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u0435\u0441\u0441\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2026-88771 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430. Payload \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438 NetScaler, \u043e\u0442\u043a\u0443\u0434\u0430 \u0435\u0433\u043e \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 Perl-\u0441\u043a\u0440\u0438\u043f\u0442 ns_monuploadd_err.pl, \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 shell \u0431\u0435\u0437 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u0435\u043a\u0442\u043e\u0440 \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u043e\u0434\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u043c: User-Agent \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u043b\u044f, \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433\u0438, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u0423\u044f\u0437\u0432\u0438\u043c \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u26a1\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 26.09.2026 \u2014 watchTowr \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\u2022 27.09.2026 \u2014 Citrix \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-88771 \u0438 CVE-2026-88772 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 30.09.2026.\n\u2022 28.09.2026 \u2014 watchTowr \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC \u0438 Detection Artifact Generator, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u2014 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0435.\n\n\ud83d\udd3aCVSS v4.0: 9.5 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udccb \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\u2022 \u041f\u043e\u043c\u0438\u043c\u043e CVE-2026-88771, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0434\u043b\u044f CVE-2026-88772 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 DTLS, RCE/DoS, CVSS 9.5). \n\u2022 \u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u2014 CVE-2026-88773 (HTTP request smuggling, 9.3) \u0438 CVE-2026-88774 \u2014 88778 (memory overflow, predictable values, 7.0\u20138.8) \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c, \u0432\u0441\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0442 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439. \n\u2022 \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e: CVE-2026-88778 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c Enhanced ISN Generation.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 NetScaler ADC \u0438 Gateway 14.1 \u0434\u043e 14.1-73.37.\n\u2022 NetScaler ADC \u0438 Gateway 13.1 \u0434\u043e 13.1-64.23.\n\u2022 NetScaler ADC FIPS \u0434\u043e 14.1-73.37 FIPS.\n- NetScaler ADC FIPS \u0438 NDcPP \u0434\u043e 13.1-37.279.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u043c, \u0438 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0435 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Secure Private Access. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b Citrix \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u0414\u043b\u044f CVE-2026-88771 workaround \u043d\u0435\u0442. \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2026, \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n2. \u0414\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0430\u043c\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043b\u043e\u0433\u0438: \u043f\u0430\u0442\u0447 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0441\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043f\u0430\u0442\u0442\u0435\u0440\u043d pitboss PPE unexpectedly died NSPPE \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438.\n\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e IoC \u0447\u0435\u0440\u0435\u0437 Security Advisory \u0432 NetScaler Console.\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441\u0435\u0441\u0441\u0438\u0439 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.\n\n\ud83d\udd17 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 watchTowr + PoC \n\ud83d\udd17 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c Citrix CTX697096\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-88771 \u0432 NVD \n\ud83d\udd17 FAQ watchTowr", "creation_timestamp": "2026-09-28T14:20:50.000000Z"}, {"uuid": "a404d3b6-a03c-44f4-b825-6cc41b12f9ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwo3v2b6f22v", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\n\n\ud83d\udcd6 Read more:\nwww.helpnetsecurity.com/2026/09/29/n...\n\n#CyberSecurity #CyberSecurityNews #CVE #0day #ZeroDay", "creation_timestamp": "2026-09-29T15:01:48.988808Z"}, {"uuid": "44279628-8651-46eb-95df-2d0b3408762c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.io/post/3mwo3wa752s2b", "content": "A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24.\n\n\ud83d\udd17 Full analysis: www.greynoise.io/blog/swarmin...", "creation_timestamp": "2026-09-29T15:02:29.228709Z"}, {"uuid": "6400fdab-bb54-4789-8650-f5700d4b6720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117354932799895501", "content": "A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24.\n\ud83d\udd17 Full analysis: https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "creation_timestamp": "2026-09-29T15:02:45.942890Z"}, {"uuid": "348c8890-d940-42f0-a757-be7f38de6c71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwo3wvebafz2", "content": "A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24.\n\n\ud83d\udd17 Full analysis: https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "creation_timestamp": "2026-09-29T15:02:58.502747Z"}, {"uuid": "40df2423-c8b9-457d-97a0-d47d6335f024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwo4ryznjq27", "content": "NetScaler \u306e\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u304c\u5927\u898f\u6a21\u653b\u6483\u306b\u62e1\u5927(CVE-2026-88771)\n\n\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306b\u516c\u958b\u3055\u308c\u3066\u3044\u308b\u8106\u5f31\u306a Citrix NetScaler ADC \u304a\u3088\u3073 Gateway \u3092\u72d9\u3063\u305f\u653b\u6483\u304c\u3001\u6df1\u523b\u5316\u3057\u3066\u3044\u307e\u3059\u3002 \u5f53\u521d\u306f\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u306b\u3088\u308b\u96a0\u5bc6\u306a\u6a19\u7684\u578b\u653b\u6483\u3067\u3057\u305f\u304c\u3001\u73fe\u5728\u306f\u7121\u5dee\u5225\u306b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u300c\u30b9\u30d7\u30ec\u30fc\u30fb\u30a2\u30f3\u30c9\u30fb\u30d7\u30ec\u30a4\u300d\u578b\u3078\u3068\u5909\u308f\u308a\u307e\u3057\u305f\u3002\u304d\u3063\u304b\u3051\u306f\u3001CVE-2026-88", "creation_timestamp": "2026-09-29T15:17:58.931280Z"}, {"uuid": "70f42c2a-6c99-41eb-843c-2554e47c54c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3mwo4xvozr22d", "content": "We've been continuously updating this post with the latest information\u2014now including details on exploitation of CVE-2026-88772. And all relevant indicators have been added to our MISP feed.\n\nifin.network/t/multi...\n\n#ThreatIntel #ThreatIntelligence #IFIN", "creation_timestamp": "2026-09-29T15:21:15.234841Z"}, {"uuid": "a384ca46-81d9-4543-bd68-4f2beee30ed9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwo4r6x6zs72", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/", "creation_timestamp": "2026-09-29T15:21:33.746930Z"}, {"uuid": "42409b5c-5ced-4531-a495-b372d2d8efba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117355005437174759", "content": "We've been continuously updating this post with the latest information\u2014now including details on exploitation of CVE-2026-88772. And all relevant indicators have been added to our MISP feed.\nhttps://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867\n#ThreatIntel #ThreatIntelligence #IFIN", "creation_timestamp": "2026-09-29T15:23:30.167084Z"}, {"uuid": "b8c2f23b-6a51-4693-9212-bbf1341546cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwo5rm2edc23", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\n\nwww.helpnetsecurity.com/2026/09/29/n...\n\n#Cybersecurity #Cyber #SituationalAwareness", "creation_timestamp": "2026-09-29T15:35:39.311742Z"}, {"uuid": "d5f57e41-d566-4c8e-9fe9-354ace688f95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwo7pay5hu2v", "content": "\ud83e\udd16 Citrix NetScaler dual zero-days: CVE-2026-88771 (RCE, CVSS 9.5) and CVE-2026-88772 (memory overflow, RCE/DDoS), both in default configs of NetScaler ADC/Gateway. Exploited in the wild, patched Sept 27.\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096", "creation_timestamp": "2026-09-29T16:10:11.153942Z"}, {"uuid": "861d804d-bac0-415f-ae9a-fb3a4c7f0244", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwo7pay5hu2v", "content": "\ud83e\udd16 Citrix NetScaler dual zero-days: CVE-2026-88771 (RCE, CVSS 9.5) and CVE-2026-88772 (memory overflow, RCE/DDoS), both in default configs of NetScaler ADC/Gateway. Exploited in the wild, patched Sept 27.\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096", "creation_timestamp": "2026-09-29T16:10:11.180826Z"}, {"uuid": "f62ff8a1-58ce-40dc-b886-70e4fc10cb89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwou4luxvw2c", "content": "Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 were used to deploy web shells, tunneling malware, and steal credentials in attacks across North America and Europe. #Citrix #NorthAmerica #Europe", "creation_timestamp": "2026-09-29T22:15:29.481357Z"}, {"uuid": "0024f9c4-ef4d-4cbc-a063-fac65561aae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwodazdato2z", "content": "(CISA TS+SOC) CVE-2026-88771 \u2013 Citrix NetScaler Input Validation RCE\u00a0Briefing\n\nActive exploitation of CVE-2026-88771 in Citrix NetScaler requires immediate patch deployment and forensic triage. Review integrated TSUITE + SOC intelligence assets....\n\nhttps://thecybermind.co/41l1", "creation_timestamp": "2026-09-29T17:13:44.408140Z"}, {"uuid": "d2e08879-561a-4990-afd8-bb172267953b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwoepznrje2b", "content": "watchTowr details a pre-auth memory overflow in Citrix NetScaler's DTLS handling, CVE-2026-88772, the second of eight CVEs Citrix patched in one advisory. The writeup walks the flaw; the \"here we go again\" framing is doing some work, since the patch itself already shipped.", "creation_timestamp": "2026-09-29T17:42:33.040217Z"}, {"uuid": "7e6c333e-3916-4225-b773-2531ceece7b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mwohwxhmcx2y", "content": "Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks.", "creation_timestamp": "2026-09-29T18:37:34.802880Z"}, {"uuid": "54a3c7b4-7a2e-4b5b-9fe0-b4759cdb61fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mwoil5kwxz2c", "content": "Attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy web shells and tunneling malware for root access and credential theft.", "creation_timestamp": "2026-09-29T18:48:52.332175Z"}, {"uuid": "2d5f7a40-d6d7-4eaa-8238-335792b0e470", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwoir4sj6o2i", "content": "\u30cf\u30c3\u30ab\u30fc\u304cCitrix NetScaler\u306e\u30bc\u30ed\u30c7\u30a4\u3092\u60aa\u7528\u3001Web\u30b7\u30a7\u30eb\u3092\u8a2d\u7f6e\n\n\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696d\u5404\u793e\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u8005\u306fCitrix NetScaler\u306e\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u300cCVE-2026-88772\u300d\u3092\u60aa\u7528\u3057\u3001\u72ec\u81ea\u306eWeb\u30b7\u30a7\u30eb\u3084\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u578b\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u8a2d\u7f6e\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3055\u3089\u306broot\u6a29\u9650\u3092\u596a\u53d6\u3057\u3066\u8a8d\u8a3c\u60c5\u5831\u3092\u7a83\u53d6\u3057\u3001\u5185\u90e8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3078\u4fb5\u5bb3\u3092\u5e83\u3052\u3066\u3044\u307e\u3059\u3002 Mandiant\u306b\u3088\u308b\u3068\u3001\u653b\u6483\u306f", "creation_timestamp": "2026-09-29T18:52:13.529677Z"}, {"uuid": "c81a2de4-3c74-4bab-8b51-e297dc87114b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "content": "Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]", "creation_timestamp": "2026-09-29T16:37:12.000000Z"}, {"uuid": "f528aed5-dc27-41f3-a7bf-7da581b3b9f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwongtsdtg23", "content": "~Spiderlabs~\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "creation_timestamp": "2026-09-29T20:16:12.787544Z"}, {"uuid": "4307e0c8-e566-4a55-b644-df252211280c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwongtsdtg23", "content": "~Spiderlabs~\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "creation_timestamp": "2026-09-29T20:16:12.827459Z"}, {"uuid": "3f237645-00d2-480d-b732-b3d9b4364bc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwotddg35g2n", "content": "Citrix NetScaler-apparaten het slachtoffer van grootschalige zero-day aanvallen\n\nAanvallers hebben twee kritieke zero-day kwetsbaarheden, CVE-2026-88772 en CVE-2026-88771, in Citrix NetScaler-apparaten massaal uitgebuit. De vroegst bekende exploitatie van CVE-2026-88772 dateert van 3 septem...", "creation_timestamp": "2026-09-29T22:01:23.269663Z"}, {"uuid": "c2aef067-2663-4f44-af60-1bdad91e6111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwotddg35g2n", "content": "Citrix NetScaler-apparaten het slachtoffer van grootschalige zero-day aanvallen\n\nAanvallers hebben twee kritieke zero-day kwetsbaarheden, CVE-2026-88772 en CVE-2026-88771, in Citrix NetScaler-apparaten massaal uitgebuit. De vroegst bekende exploitatie van CVE-2026-88772 dateert van 3 septem...", "creation_timestamp": "2026-09-29T22:01:23.247711Z"}, {"uuid": "b8eebf55-f123-466a-8148-19c47ec0c853", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwou4luxvw2c", "content": "Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 were used to deploy web shells, tunneling malware, and steal credentials in attacks across North America and Europe. #Citrix #NorthAmerica #Europe", "creation_timestamp": "2026-09-29T22:15:29.455313Z"}, {"uuid": "5a1af63a-c2f4-45a3-b0df-d6675ec88012", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/packetstorm.bsky.social/post/3mwovbnjtqw2j", "content": "Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://packetstorm.news/news/view/44294 #news", "creation_timestamp": "2026-09-29T22:36:12.077144Z"}, {"uuid": "4f064133-8389-4efe-aeae-d0a841b892eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/BleepingComputer/25684", "content": "\u200aHackers exploit Citrix NetScaler zero-day to deploy web shells\n\nCybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "creation_timestamp": "2026-09-29T19:11:58.000000Z"}, {"uuid": "705b8350-793f-47bb-8f76-14981c7f476b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwoz7s2apt2i", "content": "The latest update for #Sophos includes \"Jev's Paradox: The hidden cost of cheap #AI decisions\" and \"Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation\".\n \n#cybersecurity #antivirus #malware https://opsmtrs.com/487u2e2", "creation_timestamp": "2026-09-29T23:46:44.392222Z"}, {"uuid": "b0e0f008-f339-4b61-844c-33c7e68a8e91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwoz7s2apt2i", "content": "The latest update for #Sophos includes \"Jev's Paradox: The hidden cost of cheap #AI decisions\" and \"Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation\".\n \n#cybersecurity #antivirus #malware https://opsmtrs.com/487u2e2", "creation_timestamp": "2026-09-29T23:46:44.427360Z"}, {"uuid": "98cf2517-1f7a-40af-b27b-c331d0071d90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44661", "content": "Hackers exploit Citrix NetScaler zero-day to deploy web shells\n\nCybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "creation_timestamp": "2026-09-29T23:00:35.000000Z"}, {"uuid": "16d56d94-6df8-4125-ad01-e7c5bfce9c62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "Telegram/zu6p-mnf04FIQlwz6Jc90QIemeqpkiwRVDLe7C-LLFs1Z0w", "content": "", "creation_timestamp": "2026-09-29T22:01:22.000000Z"}, {"uuid": "8aada594-49ed-49c0-9c81-7d197033e5ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "Telegram/lsHU-UFoE9jp8RYYvXLm1SpQJKpFnC1QG-nftonJyjWN0ys", "content": "", "creation_timestamp": "2026-09-29T22:09:20.000000Z"}, {"uuid": "d61354a3-7b55-4a8b-977a-07c7bde92bd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "Telegram/lsHU-UFoE9jp8RYYvXLm1SpQJKpFnC1QG-nftonJyjWN0ys", "content": "", "creation_timestamp": "2026-09-29T22:09:20.000000Z"}, {"uuid": "c8337455-04c5-46ea-8db5-ff8f180041b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwpbu64luy2s", "content": "\ud83e\udd16 CVE-2026-88772: Citrix NetScaler zero-day exploited in the wild. Web shells + tunneling malware, root access, credential theft and lateral movement.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/", "creation_timestamp": "2026-09-30T02:21:18.269218Z"}, {"uuid": "381126e5-aa1d-4891-ab36-3ba00096e857", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/redoracle.com/post/3mwpjgqq6jt2f", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) https://redoracle.com/News/citrix-netscaler-rce-zero-days-exploited-globally-for-weeks-cve-2026.html #2026 #netscaler #vulnerabilities", "creation_timestamp": "2026-09-30T04:36:58.177925Z"}, {"uuid": "c75fbadd-92c0-4b1a-a6f8-b2ae65af7d80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/redoracle.com/post/3mwpjgqq6jt2f", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) https://redoracle.com/News/citrix-netscaler-rce-zero-days-exploited-globally-for-weeks-cve-2026.html #2026 #netscaler #vulnerabilities", "creation_timestamp": "2026-09-30T04:36:58.207663Z"}, {"uuid": "ad388144-d783-497d-9ca5-5d919decf372", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpllhpyhs27", "content": "Mandiant and GTIG report active exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88772 and CVE-2026-88771, with custom tools, root access, persistence, and hidden C2 in HTTP headers. #CitrixNetScaler #WHIPSHOT #SLAPSHOT", "creation_timestamp": "2026-09-30T05:15:23.867735Z"}, {"uuid": "1cb91584-b600-4b09-85da-42fdc4e64106", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpllhpyhs27", "content": "Mandiant and GTIG report active exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88772 and CVE-2026-88771, with custom tools, root access, persistence, and hidden C2 in HTTP headers. #CitrixNetScaler #WHIPSHOT #SLAPSHOT", "creation_timestamp": "2026-09-30T05:15:23.894885Z"}, {"uuid": "052c83ea-70ad-4cb8-be97-d98a95424d12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwpmke2ayq2s", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\uff08NetScaler\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u304c\u5927\u898f\u6a21\u653b\u6483\u3078\u62e1\u5927\uff09 #HelpNetSecurity \uff08Sep 29\uff09\nwww.helpnetsecurity.com/2026/09/29/n...", "creation_timestamp": "2026-09-30T05:32:40.917435Z"}, {"uuid": "3c42a9cd-e262-458f-955d-da48fec4418c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwpmp2ffwf2n", "content": "Citrix NetScaler CVE-2026-88771 PoC Released as Exploitation Surges\uff08Citrix NetScaler\u306eCVE-2026-88771\u3001PoC\u516c\u958b\u3067\u653b\u6483\u62e1\u5927\u306e\u61f8\u5ff5\uff09 #SecurityOnline \uff08Sep 29\uff09\nsecurityonline.info/citrix-netsc...", "creation_timestamp": "2026-09-30T05:35:17.481289Z"}, {"uuid": "51a058ce-2c7f-4505-847a-2b46346c71ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwpnvytzex2f", "content": "\ud83d\udee1\ufe0f Revue cyber du 30/09 :\n\u2022 Citrix : 2 zero-days NetScaler (CVE-2026-88772) exploit\u00e9s, web shells + root. Patch avant mercredi (CISA).\nbleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-30T05:57:04.883537Z"}, {"uuid": "75cfe68f-a265-46ac-b489-0c878b39ebcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwpokf6jsk2t", "content": "\ud83d\udd34 NetScaler CVE-2026-88772 \u2014 attacks go beyond RCE\nAttackers are deploying WHIPSHOT web shells and SLAPSHOT tunneling malware, gaining root access and pivoting into internal networks.\nstemshop.top/blog/netscal...\n#CVE #CVE202688772 #Citrix #NetScaler #WebShell #CyberSecurity", "creation_timestamp": "2026-09-30T06:08:33.659600Z"}, {"uuid": "917ac476-1601-47da-8be0-2f123d52ae24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwprjtbeej2o", "content": "CVE-2026-88772 in Citrix NetScaler ADC/Gateway DTLS handling enables remote code execution or denial-of-service via a memory buffer overflow.\n", "creation_timestamp": "2026-09-30T07:01:52.085973Z"}, {"uuid": "2fb0c013-e4ee-4111-a832-07abdfde3fe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwprjzonu42e", "content": "CVE-2026-88772 in Citrix NetScaler ADC/Gateway DTLS handling enables remote code execution or denial-of-service via a memory buffer overflow.\n", "creation_timestamp": "2026-09-30T07:01:58.666757Z"}, {"uuid": "a7068289-fd37-4979-b10c-06719337e611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwprkfchy42d", "content": "CVE-2026-88772 in Citrix NetScaler ADC/Gateway DTLS handling enables remote code execution or denial-of-service via a memory buffer overflow.\n", "creation_timestamp": "2026-09-30T07:02:10.962164Z"}, {"uuid": "1ca680c6-3375-484a-8283-39305d5550f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 93 interactions\nCVE-2026-88772: 93 interactions\nCVE-2026-87902: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 32 interactions\nCVE-2026-88771: 20 interactions\nCVE-2026-86950: 14 interactions\n", "creation_timestamp": "2026-09-30T07:20:32.543744Z"}, {"uuid": "1f36f289-a55a-4058-be90-7e863cf38bac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 93 interactions\nCVE-2026-88772: 93 interactions\nCVE-2026-87902: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 32 interactions\nCVE-2026-88771: 20 interactions\nCVE-2026-86950: 14 interactions\n", "creation_timestamp": "2026-09-30T07:20:32.586284Z"}, {"uuid": "dff19acc-b43c-4d3c-9204-ab21802a7559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/2xilxbtk6uqtg", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution", "creation_timestamp": "2026-09-30T07:29:13.383931Z"}, {"uuid": "eeb47b11-1dc8-4d20-aa12-edea148610d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "https://t.me/ctinow/257628", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\nhttps://ift.tt/upV32fq", "creation_timestamp": "2026-09-30T06:54:10.000000Z"}, {"uuid": "910db054-ae34-449a-aaee-3a230b5fdc1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwputcxikv27", "content": "Citrix NetScaler hit with pre-auth command injection flaw (CVE-2026-88771). watchTowr Labs breaks down the vulnerability and why it matters for your perimeter\u2026\n\nhttps://www.reddit.com/r/netsec/comments/1wsbh8j/oh_look_the_foot_gun_went_off_again_citrix/\n\n#cybersecurity #infosec", "creation_timestamp": "2026-09-30T08:00:50.753006Z"}, {"uuid": "4d2a43dc-2d32-49e8-afb6-4e204ead6fc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-21d4358b-a60121ca5d9080d1", "content": "Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been [\u2026]WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign", "creation_timestamp": "2026-09-30T08:19:17.224498Z"}, {"uuid": "a2b697bc-5891-4853-8676-53e6e986d250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3mwpw3fpq5u2r", "content": "\ud83d\uddb2\ufe0f #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia\n\nCitrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nLeer M\u00e1s / Read More...", "creation_timestamp": "2026-09-30T08:23:16.122027Z"}, {"uuid": "0613ac42-7a32-4cbd-85f3-abfff83a555b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "https://t.me/MalaysiaHacktivistz/17040", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "creation_timestamp": "2026-09-30T08:03:54.000000Z"}, {"uuid": "0d0ddf37-44e8-4c40-879f-4c50af1e9262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mwpyqsbv762o", "content": "Critical Citrix NetScaler RCE (CVE-2026-88772) exploited in the wild: a deep dive into the DTLS buffer\u00a0overflow\n\nCitrix NetScaler vulnerability, NetScaler RCE, Citrix zero-day, DTLS buffer overflow, CVE-2026-88771, NetScaler\u2026\n\nhttps://thecybersecguru.com/news/citrix-netscaler-cve-2026-88772-rce/", "creation_timestamp": "2026-09-30T09:11:01.652085Z"}, {"uuid": "b5de0b6b-5d2a-42d1-a899-13dfa66b9477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mwpyqsbv762o", "content": "Critical Citrix NetScaler RCE (CVE-2026-88772) exploited in the wild: a deep dive into the DTLS buffer\u00a0overflow\n\nCitrix NetScaler vulnerability, NetScaler RCE, Citrix zero-day, DTLS buffer overflow, CVE-2026-88771, NetScaler\u2026\n\nhttps://thecybersecguru.com/news/citrix-netscaler-cve-2026-88772-rce/", "creation_timestamp": "2026-09-30T09:11:01.739093Z"}, {"uuid": "9bb73152-9490-420c-9b3c-e0dab13b13f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpztjjjno2m", "content": "CVE-2026-88772 hits Citrix NetScaler ADC and Gateway via a DTLS memory overflow in NSPPE, enabling pre-auth RCE or DoS. Active exploitation reported. #CitrixNetScaler #NSPPE #CVE202688772", "creation_timestamp": "2026-09-30T09:30:27.491869Z"}, {"uuid": "08009e96-5293-4b87-99ea-e3fda103d62a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mwq222j4mk2q", "content": "Citrix NetScaler ADC/Gateway\u306b\u3001DTLS\u51e6\u7406\u306e\u30e1\u30e2\u30ea\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\uff08CVE-2026-88772\uff09\u8106\u5f31\u6027\u304c\u3042\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u5b9f\u884c\u53ef\u80fd\u3067\u3059\u3002", "creation_timestamp": "2026-09-30T09:34:06.240730Z"}, {"uuid": "9ef9a89d-18ca-4ad0-b0d1-7087fbf222fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/it4intserver.bsky.social/post/3mwq24oqie72w", "content": "iT4iNT SERVER Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution VDS VPS Cloud #Cybersecurity #Vulnerability #CVE202688772 #NetScaler #InfoSec", "creation_timestamp": "2026-09-30T09:35:34.667773Z"}, {"uuid": "f0039d7d-a174-4218-99b0-6e2cac1f62da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/thehackernews/10198", "content": "\ud83d\uded1 Citrix NetScaler CVE-2026-88772 can turn 120 crafted DTLS records into root-level shellcode execution.\n\nwatchTowr\u2019s new analysis shows how about 174 KB of reassembled data overruns a 35,840-byte scratch buffer, hijacks control flow, and uses mprotect() to bypass NX.\n\nThe flaw is already exploited in the wild.\n\nInside the exploit chain: https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html", "creation_timestamp": "2026-09-30T05:34:39.000000Z"}, {"uuid": "ee5e7f99-68a4-469e-a286-0f28ad1a9ae4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "https://t.me/TengkorakCyberCrewzz/15226", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "creation_timestamp": "2026-09-30T08:03:54.000000Z"}, {"uuid": "e1f187c3-de56-482b-bda8-e6767afe733e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html", "content": "Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild.\n\nThe vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler", "creation_timestamp": "2026-09-30T03:30:30.000000Z"}, {"uuid": "7f6139a5-51f2-49bd-ab52-9c7d8140e7bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwq3m7xgyw2j", "content": "Threat actors exploited CVE-2026-88772 in Citrix NetScaler ADC/Gateway to gain root access, deploy PHP web shells and tunneling tools, and steal credentials via internal reconnaissance.\n", "creation_timestamp": "2026-09-30T10:02:10.429453Z"}, {"uuid": "29671970-8066-4e38-9925-617e546c0d3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwq3mbh6jz2y", "content": "Threat actors exploited CVE-2026-88772 in Citrix NetScaler ADC/Gateway to gain root access, deploy PHP web shells and tunneling tools, and steal credentials via internal reconnaissance.\n", "creation_timestamp": "2026-09-30T10:02:11.749985Z"}, {"uuid": "300c42c9-ece8-4bec-a527-a84553c8280d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwq3moudv72o", "content": "Threat actors exploited CVE-2026-88772 in Citrix NetScaler ADC/Gateway to gain root access, deploy PHP web shells and tunneling tools, and steal credentials via internal reconnaissance.\n", "creation_timestamp": "2026-09-30T10:02:25.072938Z"}, {"uuid": "654b087c-bf12-4ca4-a625-a159be4b5529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mwq3wawyak2f", "content": "\ud83d\udd12 Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nCybersecurity researchers have disclosed technical details of a recently patched critica...\n\nhttps://tinyurl.com/2c45cebh #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-09-30T10:07:46.326668Z"}, {"uuid": "98fb7d53-d189-4b12-93f2-879625802dbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-29)", "content": "", "creation_timestamp": "2026-09-29T00:00:00.000000Z"}, {"uuid": "c871731a-1478-49c7-84d8-ae72a40d9c8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwq5zgv2s72o", "content": "NetScaler CVE-2026-88772: documented attack chain covers web shells, tunneling malware, root access, and lateral\u2026 https://0daynews.com/articles/2026-09-30-citrix-netscaler-cve-2026-88772-web-shell-campaign/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-4032", "creation_timestamp": "2026-09-30T10:45:21.044778Z"}, {"uuid": "e9c23440-8664-4278-9076-d224f745bafe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwq6hevvx72x", "content": "NetScaler CVE-2026-88772 enables root access, WHIPSHOT web shells & SLAPSHOT tunneling\u2014patch now before compromise expands. #NetScaler #ZeroDay #WHIPSHOT #SLAPSHOT #CVE2026-88772 https://thedailytechfeed.com/netscaler-vulnerability-gives-root-access-enables-whipshot-slapshot-attack-tools/", "creation_timestamp": "2026-09-30T10:53:09.160629Z"}, {"uuid": "4ec26b6f-e2ca-491c-a8b0-705eeeb4a32d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mwq764d5rx2g", "content": "Citrix NetScaler 0-day active for weeks\n\nCitrix NetScaler vulnerabilities (CVE-2026-88771, -88772) were actively exploited against critical sectors for weeks before disclosure. Users must check for compromise *before* patching.", "creation_timestamp": "2026-09-30T11:05:50.443026Z"}, {"uuid": "a2bc52b9-b947-48a4-98df-1c0045b1ee17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwqcj4az222d", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\n\nThe hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated. What started as stealthy targeting via zero-day exploits has now become widespread \u201cspray and pray\u201d\u2026\n#hackernews #news", "creation_timestamp": "2026-09-30T12:05:40.644610Z"}, {"uuid": "c11a7ebf-6299-4fdf-83a6-957cf5b0d4cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwqdxizvv22l", "content": "\ud83e\udd16 CVE-2026-88772 (CVSS 9.5): DTLS memory overflow in Citrix NetScaler ADC/Gateway gives pre-auth attackers shellcode execution. Exploited in the wild for root access (WHIPSHOT/SLAPSHOT).\nhttps://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html", "creation_timestamp": "2026-09-30T12:31:37.757353Z"}, {"uuid": "0ce0a0a3-aad1-4618-8511-760dc726b281", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwqeok5fwk26", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/30/c...\n\n#cybersecurity #cybersecuritynews #Europe #USA #education #financialindustry #telecommunications @mandiant.com", "creation_timestamp": "2026-09-30T12:44:34.083438Z"}, {"uuid": "488428c7-7276-4a91-8002-8e95a8ee454f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwqf5l4qor2f", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "creation_timestamp": "2026-09-30T12:53:04.664712Z"}, {"uuid": "20d7b96b-0d5a-4761-919d-6a623004c52c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwqf5l4qor2f", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "creation_timestamp": "2026-09-30T12:53:04.724041Z"}, {"uuid": "177cde6c-4050-48c6-b97d-f91604046a8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqf7q6ous2p", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "creation_timestamp": "2026-09-30T12:54:13.801062Z"}, {"uuid": "fbd0d799-5fc2-41a1-9328-d9cf5548c42b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqf7q6ous2p", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "creation_timestamp": "2026-09-30T12:54:13.833785Z"}, {"uuid": "8e6be0b3-2736-48bd-a6f1-ecb532c8dd25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/26432", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "creation_timestamp": "2026-09-30T08:03:54.000000Z"}, {"uuid": "522ed7d5-5aa7-4403-a4cd-35fef3eec305", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwqg57awfu2l", "content": "\u56fd\u5bb6\u652f\u63f4\u578b\u3068\u307f\u3089\u308c\u308b\u30cf\u30c3\u30ab\u30fc\u30019\u6708\u521d\u65ec\u304b\u3089NetScaler\u306e\u30bc\u30ed\u30c7\u30a4\u3092\u60aa\u7528\uff08CVE-2026-88772\uff09\n\nMandiant\u306e\u6700\u9ad8\u6280\u8853\u8cac\u4efb\u8005\uff08CTO\uff09\u3067\u3042\u308bCharles Carmakal\u6c0f\u306f\u3001\u6700\u8fd1\u516c\u8868\u3055\u308c\u305fNetScaler\u306e2\u4ef6\u306e\u8106\u5f31\u6027\u306e\u3046\u3061\u3001\u30bc\u30ed\u30c7\u30a4\u3068\u3057\u3066\u60aa\u7528\u3055\u308c\u305fCVE-2026-88772\u3092\u7a81\u3044\u305f\u521d\u671f\u306e\u6a19\u7684\u578b\u4fb5\u5165\u306b\u3064\u3044\u3066\u3001\u300c\u9ad8\u5ea6\u3067\u3001\u56fd\u5bb6\u306e\u652f\u63f4\u3092\u53d7\u3051\u3066\u3044\u308b\u3068\u307f\u3089\u308c\u308b\u653b\u6483\u8005\u300d\u304c\u80cc\u5f8c\u306b\u3044\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u3044\u3068", "creation_timestamp": "2026-09-30T13:10:36.642731Z"}, {"uuid": "c2e6392f-596e-4e27-b2bc-0e183958186a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwqgix4xq22l", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\n\nwww.helpnetsecurity.com/2026/09/30/c...\n\n#Kyberturvallisuus #Kyber #Tilannekuva", "creation_timestamp": "2026-09-30T13:17:12.535201Z"}, {"uuid": "8bf159a9-ee69-4045-a885-e2862da96e8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwqhrs7fky2h", "content": "A Citrix NetScaler zero-day (CVE-2026-88772, pre-auth DTLS memory overflow) was exploited for at least three weeks before detection. WatchTowr's writeup includes IOCs, and defenders are hunting for indicators like \"heartbeat\" strings and suspicious inbound traffic.", "creation_timestamp": "2026-09-30T13:42:33.141127Z"}, {"uuid": "89c60ef1-9ae1-4836-a0e3-3bac78765402", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "https://t.me/MalaysiaHacktivistz/26432", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution \u2013 thehackernews.com\n\nWed, 30 Sep 2026 13:30:30", "creation_timestamp": "2026-09-30T08:03:54.000000Z"}, {"uuid": "b9e07b82-3c07-4a34-9ed9-7e24d54a6ce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117360432922523865", "content": "\ud83d\udcf0 Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit\n\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-zero-days-and-oracle-peoplesoft-flaw-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-30T14:21:44.179386Z"}, {"uuid": "4ae0b280-172e-4776-a051-3c3c547d86a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117360432922523865", "content": "\ud83d\udcf0 Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit\n\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-zero-days-and-oracle-peoplesoft-flaw-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-30T14:21:44.212608Z"}, {"uuid": "c2f520e0-9766-455a-b7cd-827a877b5519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwqk4mygqd2t", "content": "\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-30T14:21:53.267592Z"}, {"uuid": "1abe10f1-4c1d-4f4e-bd39-0e37fb4111f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwqk4mygqd2t", "content": "\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-30T14:21:53.289352Z"}, {"uuid": "a197a6fa-acb3-423d-9450-9851a36b981c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.io/post/3mwqkkwxeuc2h", "content": "At The Edge Clear: September 21 \u2013 28, 2026\nAn adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure.\n\n\ud83d\udd17 www.greynoise.io/resources/at...", "creation_timestamp": "2026-09-30T14:30:06.167373Z"}, {"uuid": "dccdd08c-ae22-406a-8c94-f0bc2652bf87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117360467540694633", "content": "An adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure, and GreyNoise labeled it malicious within seconds, before any CVE-specific detection existed. New sources followed within a day.\nElsewhere, sources checked F5 BIG-IP for a newly listed KEV flaw in the week CISA set a three-day federal deadline, and adversaries attempted two CrushFTP flaws in back-to-back single-day bursts. Next.js bypass sources ran at least four times their late August daily level on a flaw outside KEV. Build the control on the request behavior.\nCustomers get the full weekly brief. Our public At The Edge one-pager is attached + https://greynoise.io/resources/at-the-edge-clear-092826", "creation_timestamp": "2026-09-30T14:30:25.437955Z"}, {"uuid": "9e1c26b3-976a-4be6-8894-115a018a050a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwqkmjzlyle2", "content": "An adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure, and GreyNoise labeled it malicious within seconds, before any CVE-specific detection existed. New sources followed [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-09-30T14:32:40.739427Z"}, {"uuid": "12afb5cd-a9bc-45cb-80b8-6ac7e77e9db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mwqmayeins2x", "content": "Critical Citrix NetScaler ADC and Gateway Vulnerabilities CVE-2026-88771 through CVE-2026-88778 #patchmanagement", "creation_timestamp": "2026-09-30T15:00:07.190920Z"}, {"uuid": "7c39abda-360d-4632-860a-bcaf12bc0e7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mwqmayeins2x", "content": "Critical Citrix NetScaler ADC and Gateway Vulnerabilities CVE-2026-88771 through CVE-2026-88778 #patchmanagement", "creation_timestamp": "2026-09-30T15:00:07.230114Z"}, {"uuid": "7dde2108-48c2-492f-bda6-d7e43dc32669", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mwqmiffcax2o", "content": "Why check now?\n\nGoogle/Mandiant report active CVE-2026-88772 exploitation and likely impact across several sectors. Unit 42's hunts are general guidance, not observed campaign fingerprints.", "creation_timestamp": "2026-09-30T15:04:14.010442Z"}, {"uuid": "8ee11cd9-bd89-4789-be27-25882c939911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mwqmm6zext2t", "content": "A DTLS buffer overflow in Citrix NetScaler lets attackers execute code without login via CVE-2026-88772. #CVE2026-88772 #Citrix #NetScaler #Cybersecurity #RemoteCodeExecution https://thedailytechfeed.com/citrix-netscaler-critical-flaw-cve-2026-88772-enables-pre-auth-remote-code-execution/", "creation_timestamp": "2026-09-30T15:06:22.352993Z"}, {"uuid": "71e4488e-1d6e-4d47-89c2-626ca34ce0c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/true_secator/8662", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "creation_timestamp": "2026-09-30T10:49:54.000000Z"}, {"uuid": "683a39e2-2ed9-4024-9a8f-dce77cace76e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/true_secator/8662", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "creation_timestamp": "2026-09-30T10:49:54.000000Z"}, {"uuid": "a21f5a8c-8440-4fff-a244-439b4f1f1e9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/true_secator/8663", "content": "\u0412 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c\u0443: \u0432 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 Mandiant \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-88772, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0442\u0435\u0445 \u0436\u0435 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0430\u0442\u0430\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b GreyNoise.\n\nMandiant \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NetScaler (NSPPE), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.\n\n\u0425\u043e\u0442\u044f \u0443 Google Threat Intelligence Group \u043d\u0435\u0442 \u043a\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u0430\u043d\u0430\u043b\u0438\u0437 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 \u043a\u0443\u0447\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u043f\u043e\u0442\u043e\u043a \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 FreeBSD.\n\n\u0412 Google \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a PHP \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 NetScaler \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Mandiant, \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u0444\u0430\u0439\u043b /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b .deb \u0444\u0430\u0439\u043b\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 NetScaler.\n\n\u0412 \u0434\u0440\u0443\u0433\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b .sig \u0444\u0430\u0439\u043b\u044b \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a .ico \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u043c /vpn/media/ \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 PHP-\u0444\u0430\u0439\u043b\u044b.\n\nGoogle \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u0444\u0430\u0439\u043b\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 CSS, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 PHP shell_exec() \u0438\u043b\u0438 eval().\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 HTTP-\u043e\u0442\u0432\u0435\u0442\u044b 404 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434, \u0447\u0442\u043e \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c.\n\nMandiant \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u0430\u043a WHIPSHOT \u0438 SLAPSHOT.\n\nWHIPSHOT - \u044d\u0442\u043e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u043d\u0430 PHP, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u0430\u043a\u0435\u0442 Debian \u0438 \u0445\u0440\u0430\u043d\u044f\u0449\u0430\u044f\u0441\u044f \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 NetScaler VPN.\n\n\u041e\u043d\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a HTTP-\u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f SLAPSHOT, \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044f \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 Base64 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044f \u0438\u0445 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\nWHIPSHOT \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043b\u0438 SLAPSHOT, \u0438 \u043c\u043e\u0436\u0435\u0442 \u043b\u0438 \u043e\u043d \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Python \u0432 \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435.\n\nSLAPSHOT \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f TCP \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Python, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e NetScaler \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043f\u043e \u0441\u0435\u0442\u0438.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0442 WHIPSHOT \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0445\u043e\u0441\u0442\u0430\u043c\u0438, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u044d\u0442\u0438\u043c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0441\u0435\u0441\u0441\u0438\u0438 \u043f\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u0441\u0432\u043e\u044e \u0440\u0430\u0431\u043e\u0442\u0443\n\n\u0425\u043e\u0442\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 root, \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430\u043c\u0438, \u043e\u0431\u044b\u0447\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b NetScaler.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 /bin/sh \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0442\u0430\u043a\u0436\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438.\n\nMandiant \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f Citrix \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.\n\n\u041a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u0438\u043b\u0438 \u043f\u0441\u0435\u0432\u0434\u043e\u043d\u0438\u043c\u044b \u0432 httpd.conf, \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b .deb \u0438\u043b\u0438 .sig, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043a\u043e\u0434 PHP, \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u043e\u0442\u0432\u0435\u0442\u044b HTTP 404, \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0438 NSPPE, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 /tmp/.uxdport \u0438\u043b\u0438 /tmp/.uxdlock, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441\u043e SLAPSHOT.", "creation_timestamp": "2026-09-30T10:51:28.000000Z"}, {"uuid": "9fc0e188-ea0e-40d5-ba7f-d1100c80d5a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "content": "Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\n\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.", "creation_timestamp": "2026-09-30T10:48:20.000000Z"}, {"uuid": "44962fab-5c71-42e8-a6d6-ba18312e88a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "content": "Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\n\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.", "creation_timestamp": "2026-09-30T10:48:20.000000Z"}, {"uuid": "0f1dc0d1-c865-403d-b403-1cb0a5b34c99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/true_secator/8663", "content": "\u0412 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u043c\u0443: \u0432 \u0441\u0432\u043e\u0435\u043c \u043e\u0442\u0447\u0435\u0442\u0435 Mandiant \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-88772, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0442\u0435\u0445 \u0436\u0435 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0430\u0442\u0430\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b GreyNoise.\n\nMandiant \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u043e\u0431\u0445\u043e\u0434\u044f\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044e \u0440\u0430\u0431\u043e\u0442\u044b \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NetScaler (NSPPE), \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.\n\n\u0425\u043e\u0442\u044f \u0443 Google Threat Intelligence Group \u043d\u0435\u0442 \u043a\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u0430\u043d\u0430\u043b\u0438\u0437 \u0442\u0435\u043b\u0435\u043c\u0435\u0442\u0440\u0438\u0438 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u043a\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u0438\u043b\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u0433\u0440\u0430\u043d\u0438\u0446 \u043f\u0430\u043c\u044f\u0442\u0438 \u043a\u0443\u0447\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u0434\u0432\u0438\u0436\u043a\u0435, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u043f\u043e\u0442\u043e\u043a \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 FreeBSD.\n\n\u0412 Google \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a PHP \u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 NetScaler \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0444\u0430\u0439\u043b\u044b \u0441 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043e\u0442 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0445, \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Mandiant, \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u043e\u0432 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u0444\u0430\u0439\u043b /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b .deb \u0444\u0430\u0439\u043b\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u043a\u0430\u043a PHP, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u043b\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 NetScaler.\n\n\u0412 \u0434\u0440\u0443\u0433\u0438\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b .sig \u0444\u0430\u0439\u043b\u044b \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a .ico \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f\u043c /vpn/media/ \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 PHP-\u0444\u0430\u0439\u043b\u044b.\n\nGoogle \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u0442\u044c \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u0444\u0430\u0439\u043b\u044b \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 CSS, \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 PHP shell_exec() \u0438\u043b\u0438 eval().\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u043b\u0438 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0435 HTTP-\u043e\u0442\u0432\u0435\u0442\u044b 404 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434, \u0447\u0442\u043e \u0435\u0449\u0435 \u0431\u043e\u043b\u044c\u0448\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043b\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c.\n\nMandiant \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0434\u0432\u0430 \u0440\u0430\u043d\u0435\u0435 \u043d\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043a\u0430\u043a WHIPSHOT \u0438 SLAPSHOT.\n\nWHIPSHOT - \u044d\u0442\u043e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u043d\u0430 PHP, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u0434 \u043f\u0430\u043a\u0435\u0442 Debian \u0438 \u0445\u0440\u0430\u043d\u044f\u0449\u0430\u044f\u0441\u044f \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432 NetScaler VPN.\n\n\u041e\u043d\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a HTTP-\u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043b\u044f SLAPSHOT, \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u044f \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0432 Base64 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u0430\u044f \u0438\u0445 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0439 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\nWHIPSHOT \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442, \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u043b\u0438 SLAPSHOT, \u0438 \u043c\u043e\u0436\u0435\u0442 \u043b\u0438 \u043e\u043d \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0442\u044c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 Python \u0432 \u0444\u043e\u043d\u043e\u0432\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435.\n\nSLAPSHOT \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f TCP \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Python, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e NetScaler \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043f\u043e \u0441\u0435\u0442\u0438.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0442 WHIPSHOT \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u043c\u0438 \u0445\u043e\u0441\u0442\u0430\u043c\u0438, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u044d\u0442\u0438\u043c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u0441\u0435\u0441\u0441\u0438\u0438 \u043f\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0442\u044c \u0441\u0432\u043e\u044e \u0440\u0430\u0431\u043e\u0442\u0443\n\n\u0425\u043e\u0442\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0440\u0430\u0432\u0430 root, \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430\u043c\u0438, \u043e\u0431\u044b\u0447\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u044b NetScaler.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Google, \u0434\u043b\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0443 /bin/sh \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u043b\u0438\u0441\u044c \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0442\u0430\u043a\u0436\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438.\n\nMandiant \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f Citrix \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.\n\n\u041a \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 PHP \u0438\u043b\u0438 \u043f\u0441\u0435\u0432\u0434\u043e\u043d\u0438\u043c\u044b \u0432 httpd.conf, \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b .deb \u0438\u043b\u0438 .sig, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u043a\u043e\u0434 PHP, \u043d\u0435\u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u043e\u0442\u0432\u0435\u0442\u044b HTTP 404, \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0431\u043e\u0438 NSPPE, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 /tmp/.uxdport \u0438\u043b\u0438 /tmp/.uxdlock, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441\u043e SLAPSHOT.", "creation_timestamp": "2026-09-30T10:51:28.000000Z"}, {"uuid": "3abb3cb5-c7ff-4141-b3ce-a48bc80adfc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/true_secator/8662", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "creation_timestamp": "2026-09-30T10:49:54.000000Z"}, {"uuid": "96260f98-0613-4878-ad34-d3e0bed7cc35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/true_secator/8662", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "creation_timestamp": "2026-09-30T10:49:54.000000Z"}, {"uuid": "6c68286d-6a52-4b77-9472-a4fee457b911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqtsym67r2m", "content": "Citrix patched two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after weeks-long attacks used for unauthenticated RCE, root access, and web shells. Over 100 victims may be affected. #NetScaler #Mandiant #Europe", "creation_timestamp": "2026-09-30T17:15:25.941335Z"}, {"uuid": "5be7daba-68e9-46c9-9d47-c97355ed4a23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqtsym67r2m", "content": "Citrix patched two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after weeks-long attacks used for unauthenticated RCE, root access, and web shells. Over 100 victims may be affected. #NetScaler #Mandiant #Europe", "creation_timestamp": "2026-09-30T17:15:25.964564Z"}, {"uuid": "a314ed89-abf3-44cd-85a6-68cd90defb28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/pphm_HackerNews/3382", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "creation_timestamp": "2026-09-30T15:31:04.000000Z"}, {"uuid": "10aab2ba-ca17-480c-a6c2-7bd45a4233bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/pphm_HackerNews/3382", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "creation_timestamp": "2026-09-30T15:31:04.000000Z"}, {"uuid": "24506c70-b7c0-44a8-80d8-f9f1d65ad86d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwqynzclbk26", "content": "Science Morty. NetScaler caught a state-sized cold. CVE-2026-88771, Whipshot rides HTTP headers, and .ico files suddenly speak PHP. Dutch hospitals yanked the patient portal. Patch the box if it makes you feel better. The ghosts already have keys. day274.003", "creation_timestamp": "2026-09-30T18:42:10.922268Z"}, {"uuid": "d67b1992-438f-4c59-ad04-bbd5dd85cd2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwqyvo6p522q", "content": "Science Morty. NetScaler caught a state-sized cold. CVE-2026-88771, Whipshot rides HTTP headers, and .ico files suddenly speak PHP. Dutch hospitals yanked the patient portal. Patch the box if it makes you feel better. The ghosts already have keys. day274.003", "creation_timestamp": "2026-09-30T18:46:28.694322Z"}, {"uuid": "37d1e401-6b15-4a25-acf7-4fed2676ec69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3382", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "creation_timestamp": "2026-09-30T15:31:04.000000Z"}, {"uuid": "2f3dfb45-9773-4388-9091-0e2c0a32d5f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3382", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "creation_timestamp": "2026-09-30T15:31:04.000000Z"}, {"uuid": "df1f7b87-dd77-45ea-b9ca-188936b7f2b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwr2qw4vgc2d", "content": "Hackers exploit Citrix NetScaler zero-day to deploy web shells\n\nCybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]\n#hackernews #news", "creation_timestamp": "2026-09-30T19:19:33.334408Z"}, {"uuid": "f572aaeb-1c8a-4c53-92f9-94ca20b0e914", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/information_security_channel/56012", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-30T16:41:59.000000Z"}, {"uuid": "fb2ff1d7-fa85-4723-9d21-861c18ade973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/information_security_channel/56012", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-30T16:41:59.000000Z"}, {"uuid": "aefe0d8b-caa1-4e5b-96a4-702d536e2841", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwr7ehv2se25", "content": "Government and finance offices are getting hit hard right now by two Citrix NetScaler vulnerabilities. They're CVE-2026-88772 and CVE-2026-88771.\n\n#vulnerability #infosec", "creation_timestamp": "2026-09-30T20:42:04.514457Z"}, {"uuid": "ae1ec607-e9cb-448f-9ede-2daa1953f748", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwr7ehv2se25", "content": "Government and finance offices are getting hit hard right now by two Citrix NetScaler vulnerabilities. They're CVE-2026-88772 and CVE-2026-88771.\n\n#vulnerability #infosec", "creation_timestamp": "2026-09-30T20:42:04.548851Z"}, {"uuid": "0c4548c0-2992-44ed-80ec-feb0f4505119", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/information_security_channel/56012", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-30T16:41:59.000000Z"}, {"uuid": "aa8dd318-5540-49ea-a42e-39e550f848ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/information_security_channel/56012", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-30T16:41:59.000000Z"}, {"uuid": "f41a81d1-e6dc-48f8-a368-32ea9e2c3dea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44692", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "creation_timestamp": "2026-09-30T23:00:48.000000Z"}, {"uuid": "3160666e-3fd7-4f91-8369-bbabfab3831f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44692", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "creation_timestamp": "2026-09-30T23:00:48.000000Z"}, {"uuid": "ae1b45b2-769a-4b4d-9370-f991fec1b8cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117362758120876296", "content": "Great IOCs on the follow up spray and pray activity on #PitScaler so far.\nFor context this activity definitely is not related to the inital threat actor activity in early September.  This is new stuff.\n https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771", "creation_timestamp": "2026-10-01T00:13:00.267391Z"}, {"uuid": "4dbd9d36-b048-43df-8507-0f715a505916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwrm24xh2v2u", "content": "CVE-2026-88772, a Citrix NetScaler DTLS memory overflow, is exploited in the wild. A watchTowr PoC and full details are now public. Patch NetScaler now.\n\n#Citrix #NetScaler #CVE202688772 #DTLS #watchTowr #KEV #ZeroDay #RCE", "creation_timestamp": "2026-10-01T00:28:56.575922Z"}, {"uuid": "6132463f-f329-46da-ba1f-7c3cfa4f04bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netalexx.bsky.social/post/3mwroikeqc22j", "content": "Citrix NetScaler Active Exploitation via CVE-2026-88771", "creation_timestamp": "2026-10-01T01:12:48.415413Z"}, {"uuid": "9eab637d-acfc-40a7-b145-34a61b75a92a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtbdgfwd2v", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\uff08Citrix NetScaler\u306eCVE-2026-88772\u3001\u8a8d\u8a3c\u524d\u304b\u3089\u30b7\u30a7\u30eb\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u81f3\u308b\u653b\u6483\u624b\u6cd5\u304c\u5224\u660e\uff09 #TheHackerNews (Sep 30)\nthehackernews.com/2026/09/citr...", "creation_timestamp": "2026-10-01T02:38:13.533164Z"}, {"uuid": "a2bf35e9-971f-4f94-a187-eb62dd0f4de3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtbm5w4p26", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\uff08\u56fd\u5bb6\u652f\u63f4\u578b\u3068\u307f\u3089\u308c\u308b\u653b\u6483\u8005\u3001NetScaler\u30bc\u30ed\u30c7\u30a4\u30929\u6708\u521d\u65ec\u304b\u3089\u60aa\u7528\uff09 #HelpNetSecurity (Sep 30)\nwww.helpnetsecurity.com/2026/09/30/c...", "creation_timestamp": "2026-10-01T02:38:22.752631Z"}, {"uuid": "b3a59a92-803c-461e-a5df-f4adf0801d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrte6gyvq2e", "content": "CVE-2026-88772: Citrix NetScaler Zero-Day Exploited, PoC Details Emerge\uff08Citrix NetScaler\u30bc\u30ed\u30c7\u30a4CVE-2026-88772\u304c\u5b9f\u60aa\u7528\u3001PoC\u306e\u8a73\u7d30\u3082\u660e\u3089\u304b\u306b\uff09 #SecurityOnline (Sep 30)\nsecurityonline.info/citrix-netsc...", "creation_timestamp": "2026-10-01T02:39:48.518256Z"}, {"uuid": "556ec0df-f11e-4eb6-a59f-addebc724045", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwrtg66vbp26", "content": "CVE-2026-88772: Citrix NetScaler Zero-Day Exploited, PoC Details Emerge\uff08Citrix NetScaler\u30bc\u30ed\u30c7\u30a4CVE-2026-88772\u304c\u5b9f\u60aa\u7528\u3001PoC\u8a73\u7d30\u3082\u516c\u958b\uff09 #SecurityOnline (Sep 30)\nsecurityonline.info/citrix-netsc...", "creation_timestamp": "2026-10-01T02:40:56.345051Z"}, {"uuid": "0d7bbe44-bff1-4912-a636-04c6aad8fdb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwrvxek3fc25", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nCybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wil\u2026\n#hackernews #news", "creation_timestamp": "2026-10-01T03:26:21.099374Z"}, {"uuid": "128e55f3-1c51-4bcd-b24b-ddb075b2432b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mws2c2pvlm2t", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)\n\nThis article heavily emphasizes the pre-disclosure activity to establish intent, but by focusing so much on historical TTPs, it risks downplaying the immediate, active risk presented\u2026", "creation_timestamp": "2026-10-01T04:43:53.975824Z"}, {"uuid": "6b59dfaa-c783-48b0-bef7-28d15a222c29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mws2c2pvlm2t", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)\n\nThis article heavily emphasizes the pre-disclosure activity to establish intent, but by focusing so much on historical TTPs, it risks downplaying the immediate, active risk presented\u2026", "creation_timestamp": "2026-10-01T04:43:54.017041Z"}, {"uuid": "d3c9805b-0cf3-4b9f-920a-7899e85db5cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mws2dvn5yz2l", "content": "\ud83e\udd16 CVE-2026-88771 (CVSS 9.5): unauth command injection in Citrix NetScaler ADC/Gateway, exploited in the wild. Web shells dropped, superuser created, configs exfiltrated. NCSC-NL urged orgs to shut appliances down.\nhttps://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html", "creation_timestamp": "2026-10-01T04:44:55.936481Z"}, {"uuid": "adb7cfb7-df19-499e-ab97-659b6c7fc069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mws2etpgkz2z", "content": "Active exploitation of Citrix NetScaler CVE-2026-88771 enables pre-auth command injection, payload retrieval, reverse shells, privileged account creation, and web-shell deployment. #Citrix #NetScaler #CVE-2026-88771", "creation_timestamp": "2026-10-01T04:45:27.593588Z"}, {"uuid": "08d27ac5-5c2a-4706-a480-cac8d3e1b5f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mws3bhepyy26", "content": "Citrix NetScaler CVE-2026-88771\u3001\u30b9\u30fc\u30d1\u30fc\u30e6\u30fc\u30b6\u30fc\u4f5c\u6210\u3068Web\u30b7\u30a7\u30eb\u5c55\u958b\u3092\u78ba\u8a8d\n\n\u653b\u6483\u8005\u304cCitrix NetScaler CVE-2026-88771\u3092\u60aa\u7528\u3057\u3001Web\u30b7\u30a7\u30eb\u3092\u914d\u7f6e\u3057\u3066\u30b9\u30fc\u30d1\u30fc\u30e6\u30fc\u30b6\u30fc\u3092\u4f5c\u6210\u3002\u8a2d\u5b9a\u30c7\u30fc\u30bf\u306e\u7a83\u53d6\u3092\u8a66\u884c\u3002CSS\u306e\u3088\u3046\u306aURL\u306b\u30de\u30c3\u30d7\u3055\u308c\u305f\u30b7\u30a7\u30eb\u304c\u691c\u51fa\u3055\u308c\u3066\u3044\u308b\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u6a19\u7684\u578b\u653b\u6483", "creation_timestamp": "2026-10-01T05:01:27.519184Z"}, {"uuid": "d31019eb-f9e7-4751-afeb-cf669e9ea541", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mws3rgwzuj2f", "content": "NetScaler exploit CVE-2026-88771/72 grants attackers root & hides web shell in CSS-like URLs. #Citrix #NetScaler #Vulnerability #Cybersecurity #WebShell #ThreatIntel https://thedailytechfeed.com/critical-post-auth-payload-abuses-netscaler-to-create-superuser-web-shell-access/", "creation_timestamp": "2026-10-01T05:10:24.212992Z"}, {"uuid": "87e6d8d8-5be4-46ce-816f-affe6a76b8d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mws4fzqmwi2d", "content": "Threat actors exploit CVE-2026-88771 in Citrix NetScaler ADC/Gateway to execute commands, deploy web shells, and steal configuration data.\n", "creation_timestamp": "2026-10-01T05:21:55.264936Z"}, {"uuid": "872eb248-cec7-49b4-a256-811a64daef3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mws4g3d6ab2i", "content": "Threat actors exploit CVE-2026-88771 in Citrix NetScaler ADC/Gateway to execute commands, deploy web shells, and steal configuration data.\n", "creation_timestamp": "2026-10-01T05:21:56.668479Z"}, {"uuid": "06a873b8-7189-4358-9314-53e38357bab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mws4hyhmia2f", "content": "Threat actors exploit CVE-2026-88771 in Citrix NetScaler ADC/Gateway to execute commands, deploy web shells, and steal configuration data.\n", "creation_timestamp": "2026-10-01T05:23:00.708906Z"}, {"uuid": "cc4e55f3-d554-4edc-8ed7-08cbc3ea8b28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 107 interactions\nCVE-2026-88772: 105 interactions\nCVE-2026-87902: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 14 interactions\nCVE-2026-88772: 12 interactions\nCVE-2026-84782: 10 interactions\n", "creation_timestamp": "2026-10-01T07:44:06.274685Z"}, {"uuid": "81bdd48d-6d64-4dd9-9dab-da51558c9957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 107 interactions\nCVE-2026-88772: 105 interactions\nCVE-2026-87902: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 14 interactions\nCVE-2026-88772: 12 interactions\nCVE-2026-84782: 10 interactions\n", "creation_timestamp": "2026-10-01T07:44:06.302436Z"}, {"uuid": "fda16546-056c-4e3d-aa5a-19346498ef06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mwsfnmbeym2w", "content": "COGNOSCERE Tech Brief \u2014 2026-10-01\n\nCISA confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772, both CV\n\nhttps://www.cognoscerellc.com/news", "creation_timestamp": "2026-10-01T08:07:13.593669Z"}, {"uuid": "ed7eccec-7431-4c8b-bd7f-09873ea2aa83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mwsfnmbeym2w", "content": "COGNOSCERE Tech Brief \u2014 2026-10-01\n\nCISA confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772, both CV\n\nhttps://www.cognoscerellc.com/news", "creation_timestamp": "2026-10-01T08:07:13.612583Z"}, {"uuid": "693a5c5d-5539-4b8b-a15b-ddcd5253f6ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwsg3hfmwa2x", "content": "Attackers exploit Citrix NetScaler zero-day CVE-2026-88772 for root access, then hide WHIPSHOT web shells and a SLAPSHOT tunneler. Patch now.\n\n#CitrixNetScaler #ZeroDay #CVE202688772 #CVE202688771 #WHIPSHOT #SLAPSHOT #Mandiant #CyberSecurity", "creation_timestamp": "2026-10-01T08:14:57.059310Z"}, {"uuid": "9cb0617d-2a81-41bf-bc45-62b4e1def814", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "30344cee-1c74-40bc-9a88-a3fca2a1952e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "6aceed80-35db-49ad-87e3-d04aa7965f42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "95c66ab5-86d5-4dc3-8a79-0acbd7436718", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "3aea06a0-2e97-4a17-b85f-29ebbf919079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "32dc7d02-ab91-42bf-9644-220eab4b297b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "703de630-e21b-482b-8538-f37a8e9b4052", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "1b8dcd1d-ca84-46d9-be2d-f71b98a23a96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "content": "", "creation_timestamp": "2026-10-01T02:16:25.000000Z"}, {"uuid": "4c3cbf03-e839-4521-b421-f8bab15c74af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/infosec_ita_notizie/4207", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-10-01T06:45:52.000000Z"}, {"uuid": "94529980-3313-4f6e-a999-15fef0b7db4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/infosec_ita_notizie/4207", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-10-01T06:45:52.000000Z"}, {"uuid": "925452cd-74ac-43ce-9c6f-c68bf750a336", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-30)", "content": "", "creation_timestamp": "2026-09-30T00:00:00.000000Z"}, {"uuid": "7cbb39ff-4369-44ac-ab96-7420d9387282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/CyberDispatch/3173", "content": "Citrix NetScaler CVE-2026-88772 can turn 120 crafted DTLS records into root-level shellcode execution.\n\nwatchTowr\u2019s new analysis shows how about 174 KB of reassembled data overruns a 35,840-byte scratch buffer, hijacks control flow, and uses mprotect() to bypass NX.\n\nThe flaw is already exploited in the wild.", "creation_timestamp": "2026-10-01T04:52:13.000000Z"}, {"uuid": "6294c784-be07-4a4c-9353-0ad4f65f1f39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/infosec_ita_notizie/4207", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-10-01T06:45:52.000000Z"}, {"uuid": "63b3b1d9-a1b7-4649-a1b6-de4ac2512772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/infosec_ita_notizie/4207", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-10-01T06:45:52.000000Z"}, {"uuid": "a0aacc61-1e6f-477b-9ce0-fbedce514b55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwsqraxkos25", "content": "Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)\n\n\u201cAdvanced and suspected state-sponsored threat actors\u201d are likely to be behind the initial targeted intrusions that leveraged CVE-2026-88772, one of the two recently disclosed Ne\u2026\n#hackernews #news", "creation_timestamp": "2026-10-01T11:26:06.627366Z"}, {"uuid": "0679785f-4cce-4c5a-8784-8ba4bfc70e70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqisbpyg22", "content": "Government and finance bodies got hit by weeks-long zero-day attacks on NetScaler CVE-2026-88771 and CVE-2026-88772. Here we go again with the usual corporate grief.\n\n#NetScalerAgain #PatchFatigue", "creation_timestamp": "2026-10-01T11:21:25.632755Z"}, {"uuid": "1882419a-c353-4a52-a919-255dde0a889b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqisbpyg22", "content": "Government and finance bodies got hit by weeks-long zero-day attacks on NetScaler CVE-2026-88771 and CVE-2026-88772. Here we go again with the usual corporate grief.\n\n#NetScalerAgain #PatchFatigue", "creation_timestamp": "2026-10-01T11:21:25.662239Z"}, {"uuid": "025d06af-5861-4362-99d0-d86be64adf5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqium4tp2u", "content": "Government and finance organisations have spent weeks being battered by zero-day attacks, because why would critical infrastructure catch a break? Security firms confirmed threat actors are joyfully exploiting NetScaler flaws CVE-2026-88771 and CVE-2026-88772 across targeted netw...\n\nRead full story", "creation_timestamp": "2026-10-01T11:21:26.795757Z"}, {"uuid": "1d5369ae-3bee-4b04-b277-8ff3b194f42a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqium4tp2u", "content": "Government and finance organisations have spent weeks being battered by zero-day attacks, because why would critical infrastructure catch a break? Security firms confirmed threat actors are joyfully exploiting NetScaler flaws CVE-2026-88771 and CVE-2026-88772 across targeted netw...\n\nRead full story", "creation_timestamp": "2026-10-01T11:21:26.824176Z"}, {"uuid": "a22005d3-00fa-4ccc-a03c-0dbf5866e73c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "https://t.me/CyberDispatch/3173", "content": "Citrix NetScaler CVE-2026-88772 can turn 120 crafted DTLS records into root-level shellcode execution.\n\nwatchTowr\u2019s new analysis shows how about 174 KB of reassembled data overruns a 35,840-byte scratch buffer, hijacks control flow, and uses mprotect() to bypass NX.\n\nThe flaw is already exploited in the wild.", "creation_timestamp": "2026-10-01T04:52:13.000000Z"}, {"uuid": "029fbb45-36a3-4104-9b4c-8fd70b8c3bbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwstfcsvt225", "content": "This payload we found in the wild earlier today while threat hunting for Netscaler CVE-2026-88771 exploitation shows attackers adapting their post-compromise techniques to evade common detection methods - it achieves persistence\u2026\n\n\u2014 from @AmitaiCo (https://x.com/AmitaiCo/status/2105631453455253630)", "creation_timestamp": "2026-10-01T12:13:06.873353Z"}, {"uuid": "aaff87b9-1e13-4295-970c-0fe5cb8cf2e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "MISP/d73b7730-6485-4c07-914c-ae83b22c4c4a", "content": "", "creation_timestamp": "2026-10-01T08:31:27.000000Z"}, {"uuid": "14ad1b96-d28d-4bc3-bb14-9c8a24c964cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwtbe54vj22l", "content": "~Spiderlabs~\nExploitation progressed from command injection to payloads, reverse shells, config theft, privileged access, and web shells.\n-\nIOCs: 64[.]94[.]85[.]67, 45[.]141[.]21[.]130, 23[.]27[.]143[.]20\n-\n#CVE-2026-88771 #NetScaler #ThreatIntel", "creation_timestamp": "2026-10-01T16:22:59.647414Z"}, {"uuid": "b227c481-c661-4add-b159-086bf90a1d46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117366799289085094", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-10-01T17:20:54.221639Z"}, {"uuid": "019786db-144c-47c2-a7ad-3c2f23aa3618", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117366799289085094", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-10-01T17:20:54.249839Z"}, {"uuid": "19cc3f71-2ded-4b53-a2c3-b555cf483232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtem4q7q22w", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-01T17:21:10.762240Z"}, {"uuid": "422d0a7a-78ac-4842-8ccc-1d82d93c4d3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtem4q7q22w", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-01T17:21:10.781749Z"}, {"uuid": "c0eb1da0-3357-4027-9607-93139c891626", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwtf4sa6472x", "content": "\ud83d\udce2 Citrix NetScaler : d\u00e9bordement m\u00e9moire DTLS pr\u00e9authentification CVE-2026-88772 exploit\u00e9 en zero-day\n\nCet article constitue la deuxi\u00e8me partie d'une s\u00e9rie d'analyses portant sur un bulletin Citrix (CTX697096) corrigeant huit\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#CitrixNetScaler #DTLS #Cyberveille", "creation_timestamp": "2026-10-01T17:30:28.581403Z"}, {"uuid": "6030befb-cdd1-4f20-bd4c-8ee411e169fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/true_secator/8670", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u044b\u0434\u0435\u043b\u0438\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435:\n\n1. TeamViewer \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u044f\u0434\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u0438 \u0445\u043e\u0441\u0442-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f - \u044d\u0442\u043e \u043e\u0431\u0445\u043e\u0434 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0441\u0441\u0438\u044f\u043c (CVE-2026-92370), \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0438\u0439 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 TeamViewer Full Client \u0438 Host \u0434\u043b\u044f Windows, Linux \u0438 macOS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0432\u0435\u0434\u0443\u0449\u0438\u0435 \u043a RCE \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u0427\u0435\u0442\u044b\u0440\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 (CVE-2026-19743), \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435 (CVE-2026-92368), \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 TOCTOU (CVE-2026-92369) \u0438 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u0443\u0442\u0438 (CVE-2026-92371), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f.\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f NT AUHORITY/SYSTEM \u0438\u043b\u0438 root.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e PoC \u0438\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043e\u043d\u0430 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c TeamViewer \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 15.82.\n\n2. \u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 Microsoft, \u0445\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421 CVE-2026-73570 (CVSS 8,9) \u0432 Zimbra Collaboration Suite (ZCS) \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 10.1.20 \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0435\u0449\u0435 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f CVE-2026-73570 \u0431\u044b\u043b\u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b 20 \u0438\u044e\u043b\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 ZCS 10.1.20, \u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043d\u0435\u0439 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 13 \u0430\u0432\u0433\u0443\u0441\u0442\u0430. \u0412 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 28 \u0438\u044e\u043b\u044f \u043f\u043e 7 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 Microsoft \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u0432\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0432\u043d\u0435 \u043f\u043e\u043b\u043e\u0441\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0442\u043e\u0447\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f.\n\n3. WatchGuard \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430, DoS-\u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0438 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0443\u0442\u0435\u0439 \u0432 Fireware OS, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 RCE.\n\nCVE-2026-86131 (CVSS 9.2), \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BOVPN \u0447\u0435\u0440\u0435\u0437 TLS.  \u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 VPN-\u0441\u0435\u0440\u0432\u0435\u0440, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u043c\u0441\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 Firebox.\n\n4. Bitget \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0443\u043a\u0440\u0430\u0432\u0448\u0438\u0435 \u0443 \u043d\u0435\u0435 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 387,5 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b., \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f 0-day \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c SlowMist \u0438 Mandiant (1 \u0438 2), \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0434\u0430\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u043e\u0439 \u0431\u0438\u0440\u0436\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0432\u044b\u0432\u043e\u0434\u0430 \u0441\u0440\u0435\u0434\u0441\u0442\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0430\u0436\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u043d\u043e\u0447\u0438 25 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f.\n\nBitget \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0431\u0435\u0449\u0430\u0435\u0442 5% \u0442\u0435\u043c, \u043a\u0442\u043e \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0438\u043b\u0438 \u0437\u0430\u043c\u043e\u0440\u043e\u0437\u0438\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n5. KiteWorks \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0431\u0440\u0430\u0434\u043e\u0432\u0430\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0442\u0435\u043c, \u0447\u0442\u043e \u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043e\u0436\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u0441\u043d\u043e\u0432\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043a \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443.\n\n\u041d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 Kiteworks \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e\u0442 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0433\u043e\u0442\u043e\u0432\u044f\u0442\u0441\u044f \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 \u0435\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b.\n\n6. \u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Python Authlib \u043d\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0443 \u0441 \u043f\u0443\u0441\u0442\u044b\u043c \u043f\u043e\u043b\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OAuth \u0438 OpenID.\n\n7. Palo Alto Networks \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438\u043c\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 50 000 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 CVE-2026-88772 \u0438 CVE-2026-88771 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 NetScaler.\n\n8. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u041f\u041e \u041d\u0430\u0442\u0430\u043d \u0424\u0430\u0440\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b Relapse, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 PS5. \u041e\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub.\n\n9. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 Google \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u043a\u0430\u043a \u0418\u0418 \u043c\u0435\u043d\u044f\u0435\u0442 \u0442\u0435\u043c\u043f\u044b \u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 GTIG, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u0430\u0436\u0434\u044b\u0439 \u043c\u0435\u0441\u044f\u0446 \u0432 2026 \u0433\u043e\u0434\u0443, \u043a\u0430\u043a \u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u043c\u0435\u0441\u044f\u0447\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445, \u0443\u0434\u0432\u043e\u0438\u043b\u043e\u0441\u044c.\n\n10. \u041f\u043e\u0437\u0438\u0442\u0438\u0432\u044b \u0432 \u0431\u043b\u043e\u0433\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043f\u0440\u043e \u0442\u043e, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043d\u0430\u0439\u0442\u0438  CVE-2026-43783: LPE \u0447\u0435\u0440\u0435\u0437 DesktopServicesHelper \u0432 macOS 26.5.", "creation_timestamp": "2026-10-01T17:00:06.000000Z"}, {"uuid": "460d2fe3-e816-42be-83be-f440bd53816a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://t.me/true_secator/8670", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u044b\u0434\u0435\u043b\u0438\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435:\n\n1. TeamViewer \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u044f\u0434\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u0438 \u0445\u043e\u0441\u0442-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f - \u044d\u0442\u043e \u043e\u0431\u0445\u043e\u0434 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0441\u0441\u0438\u044f\u043c (CVE-2026-92370), \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0438\u0439 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 TeamViewer Full Client \u0438 Host \u0434\u043b\u044f Windows, Linux \u0438 macOS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0432\u0435\u0434\u0443\u0449\u0438\u0435 \u043a RCE \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u0427\u0435\u0442\u044b\u0440\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 (CVE-2026-19743), \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435 (CVE-2026-92368), \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 TOCTOU (CVE-2026-92369) \u0438 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u0443\u0442\u0438 (CVE-2026-92371), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f.\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f NT AUHORITY/SYSTEM \u0438\u043b\u0438 root.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e PoC \u0438\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043e\u043d\u0430 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c TeamViewer \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 15.82.\n\n2. \u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 Microsoft, \u0445\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421 CVE-2026-73570 (CVSS 8,9) \u0432 Zimbra Collaboration Suite (ZCS) \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 10.1.20 \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0435\u0449\u0435 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f CVE-2026-73570 \u0431\u044b\u043b\u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b 20 \u0438\u044e\u043b\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 ZCS 10.1.20, \u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043d\u0435\u0439 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 13 \u0430\u0432\u0433\u0443\u0441\u0442\u0430. \u0412 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 28 \u0438\u044e\u043b\u044f \u043f\u043e 7 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 Microsoft \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u0432\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0432\u043d\u0435 \u043f\u043e\u043b\u043e\u0441\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0442\u043e\u0447\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f.\n\n3. WatchGuard \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430, DoS-\u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0438 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0443\u0442\u0435\u0439 \u0432 Fireware OS, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 RCE.\n\nCVE-2026-86131 (CVSS 9.2), \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BOVPN \u0447\u0435\u0440\u0435\u0437 TLS.  \u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 VPN-\u0441\u0435\u0440\u0432\u0435\u0440, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u043c\u0441\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 Firebox.\n\n4. Bitget \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0443\u043a\u0440\u0430\u0432\u0448\u0438\u0435 \u0443 \u043d\u0435\u0435 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 387,5 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b., \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f 0-day \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c SlowMist \u0438 Mandiant (1 \u0438 2), \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0434\u0430\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u043e\u0439 \u0431\u0438\u0440\u0436\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0432\u044b\u0432\u043e\u0434\u0430 \u0441\u0440\u0435\u0434\u0441\u0442\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0430\u0436\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u043d\u043e\u0447\u0438 25 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f.\n\nBitget \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0431\u0435\u0449\u0430\u0435\u0442 5% \u0442\u0435\u043c, \u043a\u0442\u043e \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0438\u043b\u0438 \u0437\u0430\u043c\u043e\u0440\u043e\u0437\u0438\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n5. KiteWorks \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0431\u0440\u0430\u0434\u043e\u0432\u0430\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0442\u0435\u043c, \u0447\u0442\u043e \u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043e\u0436\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u0441\u043d\u043e\u0432\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043a \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443.\n\n\u041d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 Kiteworks \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e\u0442 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0433\u043e\u0442\u043e\u0432\u044f\u0442\u0441\u044f \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 \u0435\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b.\n\n6. \u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Python Authlib \u043d\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0443 \u0441 \u043f\u0443\u0441\u0442\u044b\u043c \u043f\u043e\u043b\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OAuth \u0438 OpenID.\n\n7. Palo Alto Networks \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438\u043c\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 50 000 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 CVE-2026-88772 \u0438 CVE-2026-88771 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 NetScaler.\n\n8. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u041f\u041e \u041d\u0430\u0442\u0430\u043d \u0424\u0430\u0440\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b Relapse, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 PS5. \u041e\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub.\n\n9. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 Google \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u043a\u0430\u043a \u0418\u0418 \u043c\u0435\u043d\u044f\u0435\u0442 \u0442\u0435\u043c\u043f\u044b \u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 GTIG, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u0430\u0436\u0434\u044b\u0439 \u043c\u0435\u0441\u044f\u0446 \u0432 2026 \u0433\u043e\u0434\u0443, \u043a\u0430\u043a \u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u043c\u0435\u0441\u044f\u0447\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445, \u0443\u0434\u0432\u043e\u0438\u043b\u043e\u0441\u044c.\n\n10. \u041f\u043e\u0437\u0438\u0442\u0438\u0432\u044b \u0432 \u0431\u043b\u043e\u0433\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043f\u0440\u043e \u0442\u043e, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043d\u0430\u0439\u0442\u0438  CVE-2026-43783: LPE \u0447\u0435\u0440\u0435\u0437 DesktopServicesHelper \u0432 macOS 26.5.", "creation_timestamp": "2026-10-01T17:00:06.000000Z"}, {"uuid": "ad995994-19b8-471f-8262-b3e9ef942bae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwtnioo5cz2q", "content": "Citrix NetScaler zero-days are actively exploited in the wild affecting 50K+ instances. Critical RCE vulnerabilities\u2026\n\nhttps://dev.to/mark0_617b45cda9782a/threat-brief-netscaler-zero-days-cve-2026-88771-and-cve-2026-88772-exploited-in-the-wild-2c30\n\n#networking #infrastructure", "creation_timestamp": "2026-10-01T20:00:16.678143Z"}, {"uuid": "c7245827-69a9-4c9f-9cf2-632ed029026a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwtnioo5cz2q", "content": "Citrix NetScaler zero-days are actively exploited in the wild affecting 50K+ instances. Critical RCE vulnerabilities\u2026\n\nhttps://dev.to/mark0_617b45cda9782a/threat-brief-netscaler-zero-days-cve-2026-88771-and-cve-2026-88772-exploited-in-the-wild-2c30\n\n#networking #infrastructure", "creation_timestamp": "2026-10-01T20:00:16.709157Z"}, {"uuid": "ed361682-b1e6-4b86-b9e6-21da730681f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "17624f98-f8f8-445a-925c-de5cd50944a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "e32d6195-59ce-4fc9-b786-6a2b7271d33a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "8c15eaa2-4596-4f90-af17-6794d734dc11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88774", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "d83cc21f-b0e6-49d8-96e9-d917c0b8d971", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88775", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "67725ffa-6f67-4dbf-864b-6eac333c0851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88776", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "84c4ea3f-e875-4a77-b614-b7226d63450b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88777", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "36e40b58-2a7f-4e1a-9173-c787095953b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "content": "", "creation_timestamp": "2026-10-01T09:51:44.000000Z"}, {"uuid": "14dac85b-772c-4296-bb47-11acdc2c4413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-01)", "content": "", "creation_timestamp": "2026-10-01T00:00:00.000000Z"}, {"uuid": "3b75f475-ad10-443c-977e-181be3fe9de5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.cert.se/2026/10/cert-se-veckobrev-v40.html", "content": "", "creation_timestamp": "2026-10-02T00:30:00.000000Z"}, {"uuid": "310fca93-305e-4ace-8c24-1c366bdacd0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.se/2026/10/cert-se-veckobrev-v40.html", "content": "", "creation_timestamp": "2026-10-02T00:30:00.000000Z"}, {"uuid": "235ef5cd-2d37-4ffe-a087-05dd4629a60d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "content": "", "creation_timestamp": "2026-09-30T03:00:06.000000Z"}, {"uuid": "fd9237f4-10bb-4a6d-86b7-70128b944d89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "content": "", "creation_timestamp": "2026-10-01T21:00:04.000000Z"}, {"uuid": "7cf28245-9795-413d-997b-074572a77fe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "content": "", "creation_timestamp": "2026-10-01T21:00:04.000000Z"}, {"uuid": "2b4d0971-7257-4f86-b731-551cf5b65e54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "content": "", "creation_timestamp": "2026-10-01T21:00:04.000000Z"}, {"uuid": "4d92c3da-bb91-4762-9591-265a756be496", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "content": "", "creation_timestamp": "2026-10-01T21:00:04.000000Z"}, {"uuid": "44f3d303-2805-42c6-85fd-e14121f1c6af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-6ad88b71-b1fa10d6dd4ce1d1", "content": "This Week in Security: ShinyHunters Won\u2019t Dox the FBI, Pentagon Data Stolen, and OBS Vulnerable\n404 Media reports that the ShinyHunters group who stole multiple terabytes of FBI employee data say they do not plan to release the data.\nKnown for ransomware and extortion of innumerable companies and government agencies, ShinyHunters used a zero-day vulnerability in Oracle PeopleSoft to compromise the employment site of the FBI and pivot into scraping the content of FBI AWS instances, claiming to have the full employment and health data of all FBI agents, employees, and spouses.\nThe hacker group took exception to an FBI press release that claimed that the group over-stated stolen data and that they directly harass victims and victim\u2019s families.  The group publicized the FBI data breach, demanding a retraction of the statements, and it was generally assumed that the group would follow their typical methods of releasing the data publicly if the demands were not met.\nThe group has told 404 media that they had always agreed internally to not release the stolen data, saying \u201cThis was all a marketing campaign to protect our business and actively combat disinformation\u201d.  Meanwhile the FBI continues the investigation, and Shiny Hunters may be hoping to defer some of the ire.\nPentagon Data Breach\nA data breach at the Defense Manpower Data Center lasted for nine months before it was discovered, and allowed unknown attackers to exfiltrate information on military personnel.\nThe information stolen includes social security numbers and \u201coperational specialty\u201d data about where a service member is employed within the armed forces.  The DMDC handles data on 60 million current and former service members, but the report does not specify the number impacted.\nCurrently the source of the attack is unknown; the attackers may be a typical data ransom or theft group, but information about service members could easily be used by foreign intelligence groups.\nThis is, of course, a different attack and leak of US government employee data, independent of the attack on the FBI.\nOpenAI Hacked Australian Government Databases\nThe Australian Prime Minister, Anthony Albanase, has released a statement that OpenAI was involved in a hacking incident against the Australian government health services site.\nThis is independent of other incidents involving OpenAI agents hacking live Internet sites during testing; OpenAI says the hack was discovered on September 10, 2026, but the incident occurred in June of 2026, prior to the hack of the HuggingFace site.\nIn the Hugging Face attack, AI agents were asked to complete a cyber security challenge and responded by finding and utilizing vulnerabilities to steal the solutions.  A report by Translucence (an AI research lab) finds however that in this instance, the agents were tasked with non-cyber related research and opted to exploit not only the Australian health services site but also the University of New Mexico digital library and Data USA, a platform for collecting and visualizing US government data.\nOpenAI says the review of the incident remains ongoing, and that no private patient data was compromised.  The Australian government, obviously, has stronger opinions about how the incident occurred and the length of time before they were notified.  If agents are defaulting to exploiting live Internet sites for normal queries, we\u2019re likely to keep finding more stories like this.\nPhysical Attack Against MacOS Lockdown Mode\nResearcher Kevin Kessler at glyph.sh discloses a new vulnerability in macOS that can allow keyboard attacks even when lockdown mode is enabled.\nMacOS has built-in protection measures against malicious USB devices.  Readers using macOS may have seen prompts to allow a USB device to connect the first time it is plugged in; additionally, new USB devices are ignored if a Mac has been locked for more than an hour.\nIn the extra-paranoid \u201cLockdown Mode\u201d, macOS will also prevent connections to USB devices entirely while the device is locked.  Lockdown mode also disables other operating system features that are suspected of being less secure, like custom web fonts, just-in-time compilation of JavaScript to native code, and direct messaging from unknown contacts. This attack defeats all of these protections.\nDue to the architecture of USB, if a USB hub is connected to macOS and trusted, all devices plugged into that hub are automatically trusted. A composite USB device \u2014 a device that presents as multiple types of USB interfaces on a single connection \u2014 can identify as both a serial port and a keyboard in a single device.\nTypically macOS would prompt the user that a new keyboard has been connected, but does not prompt the user when a new USB serial port device is connected to a trusted hub.  Presenting as both a serial device and a keyboard, key presses are accepted automatically, with no user prompt.\nKessler demonstrates copying sensitive user data like SSH keys and cloud provider authentication tokens directly over the USB serial device, a trick which may bypass endpoint protection tools looking for copied files.\nApple told the researcher that the behavior is expected when a USB hub has been trusted, and that composite USB devices are outside the scope of the protection mechanisms.  If so, perhaps it needs to be more clearly communicated to users the risk of trusting any USB hub or dock if an attacker could conceivably get physical access.\nSpying with File Update Notifications\nNew attacks against the file notification systems of all major operating systems \u2014 Windows, macOS, Linux, and Android \u2014 will be shown at the November 2026 ACM security conference.\nFile notification systems are a crucial part of almost all modern operating systems, letting the UI and background services receive alerts that file content has changed, instead of constantly querying file modification times.  Unfortunately, it seems like all of them have major issues and allow bypassing permissions and access restrictions.\nThe researchers call out Windows as the worst offender:  it allows a notification to be set for any file modification, system wide, regardless of access permission or what user owns it.  To be fair, it seems like Linux, macOS, and Android aren\u2019t too far behind however.\nOn Linux, the inoti.fyi researchers discovered that while notifications can\u2019t be set on files the user isn\u2019t allowed to access, notifications can still be set on readable parent directories, and will still report changes to the files.  Leveraging this oversight against the /dev/input directory, events are raised for every keystroke, and they reference decades of research on using keystroke timing to guess what was typed.\nFor Android, permission oversights allow one application to set notifications for the private storage of other applications.  Normally, each application runs in a separate sandbox and has no insight into the behavior of other apps, using the Android file notification API, they demonstrate monitoring WhatsApp to log the exact time messages and photos are received.\nThe Windows vulnerability may be the most immediately severe, where the inoti.fyi team is able to monitor the cache and local storage directories of browsers.  Browsers like Firefox create files with the name of the website; by monitoring the cache directories, it\u2019s possible to monitor the websites loaded by any user on the system.\nThe team has been working with vendors to address the issues, however in most cases there are no fixes available yet.\nOBS Streaming Platform Vulnerable\nOBS is a popular tool for streamers, compositing multiple cameras, screen and video capture, and more. A large percentage of streamers on the Internet use OBS.\nOrange Cyberdefense Switzerland reports vulnerabilities in OBS due to the embedded Chromium browser source.  Chromium is the open-source engine behind Chrome, Opera, Microsoft Edge, Vivaldi, and many other browsers; OBS embeds the browser engine to allow embedded web content and web-based applications inside a stream.\nStreamers often have an embedded display of the chat associated with their stream, encouraging audience participation.  These embeds usually use a browser window to stylize the chats and embed images, which exposes them to whatever the content of the chat message is. Astute readers may already guess how this is a problem.\nIn a typical browser, each tab is isolated in an independent sandbox, preventing it from interacting with other tabs or the browser itself, but in the OBS embedded browsers, sandboxes are disabled.  OBS also used a two-year-old Chromium engine that contained a publicly known and patched bug in the V8 JavaScript engine.  The bug had already been exploited in the wild by North Korean hackers, but the impact was limited thanks to the sandbox mechanism isolating each tab. With no sandbox, malicious HTML and JavaScript rendered by a web view could directly execute code on the system, taking over the OBS instance or the whole system.\nThe researchers at Orange have worked with OBS to update the embedded Chromium version, but also offer the advice that untrusted HTML should be avoided whenever possible:  No OBS widget should ever render user or chat content as HTML.\nDIVD Hacked\nDIVD, the Dutch Institute for Vulnerability Disclosure, announced that they were the victims of a recent hack themselves.\nDIVD says that the attackers got in through two previously unknown bugs in the Zammad help desk software, and that the attackers appear to be AI agents. Within seconds, attackers hijacked Zammad sessions, gained code execution, and then gained root access to the system. DIVD says the attackers immediately began to exfiltrate data from the impacted systems, but were blocked from accessing other government systems.\nThe Institute is using this as a teaching moment, not only releasing an advisory for the Zammad system, but making a candid LinkedIn post discussing the incident and the responses: \u201cSo what do hackers do when they get hacked? Handle it the way we think it should be handled. That is open, transparent and honest, even if it sucks.\u201d\nEnterprise Networking Vulnerabilities\nMajor vulnerabilities have been found exploited in the wild for both Cisco Catalyst SD-WAN and Citrix Netscaler enterprise devices. A relatively bland Cisco announcement discloses that all versions of the Cisco Catalyst SD-WAN Manager allow unauthenticated, remote, admin access. (!)\nThe Citrix Netscaler article, on the other hand, comes from the team at watchTowr.  Anyone who has been reading for the past months should know that a post from watchTowr is a guaranteed good read.  Not only are the vulnerabilities in Netscaler plentiful and severe, but they were widely known and exploited before Citrix finally released a vulnerability statement.\nThe Netscaler vulnerabilities include arbitrary commands from unauthenticated users, remote code execution and denial of service attacks against the VPN server, multiple memory overflows, and predictable random generation in some situations.\nWatchTower digs into the firmware changes for more details, so if seeing how Perl is still used in 2026 enterprise equipment tickles your fancy, be sure to give them a read. \nhackaday.com/2026/10/02/this-w\u2026RE: 404media.co/.ghost/activitypub\u2026", "creation_timestamp": "2026-10-02T14:11:24.555446Z"}, {"uuid": "481885a5-e9bf-48f7-a71a-9672e809c72a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkslebtp24", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-02T14:17:27.021041Z"}, {"uuid": "281379a0-5059-4865-bc05-5ba6fba15b54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkslebtp24", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-02T14:17:27.056844Z"}, {"uuid": "fd26e097-902c-4ee8-a2d5-fe93f36d9e49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "exploited", "source": "Telegram/gf8iqD--KUzNtQwvICIQV53KhjaEI71nq_lpiyx0bRlbfA", "content": "", "creation_timestamp": "2026-09-30T07:20:56.000000Z"}, {"uuid": "3ddd7f31-a174-4b6d-913e-a9c718cf0a97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117372348454854312", "content": "\ud83d\udea8 Reports of NetScaler Incidents After Latest Patch Raise Concerns Over Continued Exploitation\nMultiple Citrix administrators are reporting suspicious activity affecting NetScaler appliances even after updating to version 14.1-73.37.\nThe reports surfaced on Reddit, where one administrator said multiple customers experienced incidents that caused externally accessible NetScaler appliances to repeatedly reboot.\nOther administrators reported similar behavior on newly rebuilt appliances, including systems where Enhanced ISN Generation had already been enabled. Several affected organizations said they collected forensic data and opened cases with Citrix.\nIt is currently unclear whether the activity represents successful exploitation of a new or existing vulnerability, residual compromise, vulnerability scanning, or an issue with the updated firmware.\nThe reports come days after Citrix disclosed active exploitation of CVE-2026-88771 and CVE-2026-88772, two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway.\nThe latest post-patch activity has not yet been confirmed by Citrix as exploitation.\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing\nSource: https://www.reddit.com/r/Citrix/comments/1wvwva9/netscaler_active_exploit_after_patch/?rdt=60164", "creation_timestamp": "2026-10-02T16:51:47.583864Z"}, {"uuid": "118961c9-b6e7-4539-a287-e844555aa32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117372348454854312", "content": "\ud83d\udea8 Reports of NetScaler Incidents After Latest Patch Raise Concerns Over Continued Exploitation\nMultiple Citrix administrators are reporting suspicious activity affecting NetScaler appliances even after updating to version 14.1-73.37.\nThe reports surfaced on Reddit, where one administrator said multiple customers experienced incidents that caused externally accessible NetScaler appliances to repeatedly reboot.\nOther administrators reported similar behavior on newly rebuilt appliances, including systems where Enhanced ISN Generation had already been enabled. Several affected organizations said they collected forensic data and opened cases with Citrix.\nIt is currently unclear whether the activity represents successful exploitation of a new or existing vulnerability, residual compromise, vulnerability scanning, or an issue with the updated firmware.\nThe reports come days after Citrix disclosed active exploitation of CVE-2026-88771 and CVE-2026-88772, two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway.\nThe latest post-patch activity has not yet been confirmed by Citrix as exploitation.\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing\nSource: https://www.reddit.com/r/Citrix/comments/1wvwva9/netscaler_active_exploit_after_patch/?rdt=60164", "creation_timestamp": "2026-10-02T16:51:47.608409Z"}, {"uuid": "31c2462e-8642-41b7-a969-fb43c6e3563c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "content": "", "creation_timestamp": "2026-09-30T03:00:06.000000Z"}, {"uuid": "5dff53bc-425e-466b-b016-60acfd7b2650", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104081", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler_threat_hunt_helper\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a orjanj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 14:50:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T15:00:09.000000Z"}, {"uuid": "85a7fdaa-cfde-4a13-b354-6da18e887815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104081", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler_threat_hunt_helper\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a orjanj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 14:50:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T15:00:09.000000Z"}, {"uuid": "1110c46c-28f2-4119-8bff-3633dc8c8835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwwd4kfxy22t", "content": "Citrix flags a NetScaler SAML authentication issue as patched NetScaler appliances reboot after CVE-2026-88771 attacks. Check your config.\n\n#Citrix #NetScaler #SAML #CVE202688771 #CVE202688772 #ZeroDay #Vulnerability", "creation_timestamp": "2026-10-02T21:32:31.598786Z"}, {"uuid": "93f8a369-12f0-4e53-836e-a94c5767fc8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html", "content": "", "creation_timestamp": "2026-10-03T08:40:20.522616Z"}, {"uuid": "c01b111c-8f09-4317-8df1-35cb8ecc3b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/104116", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88773\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Scyrix-LLC\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 20:31:59\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-88773\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-10-02T21:00:10.000000Z"}, {"uuid": "252c9dc2-75ff-4944-9e36-24ce57a0d92e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html", "content": "", "creation_timestamp": "2026-10-03T08:40:53.313040Z"}, {"uuid": "88dbaae3-a109-4c52-ad85-083a5c7705f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwwlqxqf3n2x", "content": "\ud83d\udccc Here We Go Again: Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772 https://www.cyberhub.blog/article/32760-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772", "creation_timestamp": "2026-10-03T00:07:06.823786Z"}, {"uuid": "08083a62-a740-49a2-bd80-edc80729831b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwwvgyelnc2v", "content": "Citrix NetScaler-appliances kampen met rebootproblemen na beveiligingsupdate\n\nCitrix NetScaler-klanten ervaren frequente herstarts van hun appliances nadat ze build 14.1-73.37 hebben ge\u00efnstalleerd. Deze noodupdate werd uitgebracht om twee zero-day kwetsbaarheden, CVE-2026-88771 en CVE-20...", "creation_timestamp": "2026-10-03T03:00:29.697978Z"}, {"uuid": "39b756cb-4e64-461c-9d04-5b19fa4069d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/royans.bsky.social/post/3mwx5qoxn3g2w", "content": "Bitget $388M Breach via Citrix NetScaler ADC Zero-Day Exploit\n\nhttps://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772\nhttps://flagthis.com/tldr/8192\n\n##Bitget ##ZeroDay ##LazarusGroup ##DataBreach ##Citrix", "creation_timestamp": "2026-10-03T05:29:04.488151Z"}, {"uuid": "7a5cdc01-96d8-4621-acf1-b2a76c5bfe20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/royans.bsky.social/post/3mwx5qoxn3g2w", "content": "Bitget $388M Breach via Citrix NetScaler ADC Zero-Day Exploit\n\nhttps://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772\nhttps://flagthis.com/tldr/8192\n\n##Bitget ##ZeroDay ##LazarusGroup ##DataBreach ##Citrix", "creation_timestamp": "2026-10-03T05:29:04.528530Z"}, {"uuid": "8462852e-6151-41ee-b5a9-f0f24c384142", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwxcz4x2cr2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 112 interactions\nCVE-2026-88772: 106 interactions\nCVE-2026-86950: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-5715: 12 interactions\nCVE-2026-104286: 11 interactions\nCVE-2026-93698: 5 interactions\n", "creation_timestamp": "2026-10-03T07:03:23.187502Z"}, {"uuid": "633765cf-db76-44c8-b3ad-5f5755fcc8fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwxcz4x2cr2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 112 interactions\nCVE-2026-88772: 106 interactions\nCVE-2026-86950: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-5715: 12 interactions\nCVE-2026-104286: 11 interactions\nCVE-2026-93698: 5 interactions\n", "creation_timestamp": "2026-10-03T07:03:23.218228Z"}, {"uuid": "85bb5593-26af-4a75-9c1d-6a142b82425e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-02)", "content": "", "creation_timestamp": "2026-10-02T00:00:00.000000Z"}, {"uuid": "c133b708-aa5a-4947-864d-cc96e9ea5b2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/rcinghio.bsky.social/post/3mwxyp75esk2j", "content": "Researchers at Mandiant and Google Threat Intelligence Group (GTIG) say that a critical memory overflow vulnerability in #Citrix NetScaler ADC and Citrix NetScaler Gateway (CVE-2026-88772, CVSS score 9.5) was exploited weeks before it was disclosed.\nwww.theregister.com/security/202...", "creation_timestamp": "2026-10-03T13:31:26.274710Z"}, {"uuid": "7477a26e-c6a7-46d0-b049-a7494f7319f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117378534840533079", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-10-03T19:05:05.871361Z"}, {"uuid": "2c2149bd-c59f-4458-ad12-0a8f9f8fb087", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117378534840533079", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-10-03T19:05:05.901801Z"}, {"uuid": "21d8ae9e-c7e1-494e-a4a4-aa8c1ff260e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwylekl2bf2b", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-03T19:05:29.545663Z"}, {"uuid": "747aa47a-87ed-4d7d-aa3a-2c86250b8696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwylekl2bf2b", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-03T19:05:29.583110Z"}, {"uuid": "cea958d0-8abb-4b96-acb6-202b271b3d98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pylos.co/post/3mwypidhmpc2c", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.cyber.gov.au/about-us/vie...", "creation_timestamp": "2026-10-03T20:19:19.859251Z"}, {"uuid": "3385df8a-0f98-4b40-9400-14991a64fadb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pylos.co/post/3mwypidhmpc2c", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.cyber.gov.au/about-us/vie...", "creation_timestamp": "2026-10-03T20:19:19.892443Z"}, {"uuid": "dbc9d8dc-2ffc-4dfa-aeff-8d97f7cf55b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwypim3wqu2w", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.potato.gov.au/about-us/vie...", "creation_timestamp": "2026-10-03T20:19:20.599140Z"}, {"uuid": "237b3e28-ca3f-4a34-85f1-173dbd47f65c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwypim3wqu2w", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.potato.gov.au/about-us/vie...", "creation_timestamp": "2026-10-03T20:19:20.626274Z"}, {"uuid": "6dc660c7-34b2-4aa8-8a88-920a91967c41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/ichintu/828ebfca260883781a43da47bec1fe3e", "content": "This threat intelligence update highlights two key developments:\n\n\u2022 **Aegis WAF & Reverse Proxy:** Divine Lab released Aegis, a free, open-source next-generation WAF and edge proxy featuring sub-millisecond latency, OWASP-compliant anomaly scoring, Layer 7 rate limiting, automated TLS, and zero-downtime policy updates.\n\n\u2022 **Critical Citrix NetScaler Vulnerabilities:** The Canadian Centre for Cyber Security warns of two actively exploited CVEs (CVE-2026-88771 & 88772) in NetScaler ADC and Gateway that enable remote code execution and full appliance compromise. Update 1 identifies a separate SAML authentication flaw causing system instability and DoS. Organizations are urged to patch immediately, investigate for persistent threats (vendor updates may not remove backdoors), preserve forensic evidence, and follow strict incident response and isolation protocols.", "creation_timestamp": "2026-10-04T00:00:31.000000Z"}, {"uuid": "8a1765b9-8e2c-4b72-a673-b9a08b9f64d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cybermaster77.bsky.social/post/3mwz76kqbyx2t", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution\n\nhttps://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html\n\n#CyberSecurity #InfoSec", "creation_timestamp": "2026-10-04T01:00:04.277457Z"}, {"uuid": "0d750309-022a-42fd-8ae4-ac548bad13af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117380573749192650", "content": "A severe vulnerability was disclosed for Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88779) https://vuldb.com/vuln/413388", "creation_timestamp": "2026-10-04T03:43:35.494836Z"}, {"uuid": "806cb01f-07ef-47fb-95ff-ae934c62fc1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwzid5pkqx22", "content": "Citrix NetScaler has a new unauthenticated flaw (CVE-2026-88779) that lets a stranger crash the appliance.\n\nIt hits boxes set up for SAML single sign-on, the usual enterprise gateway config.\n\nNo workaround. Patch to 14.1-73.41 now.", "creation_timestamp": "2026-10-04T03:43:41.909701Z"}, {"uuid": "20794f98-2224-4acc-9df6-8048d824c229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwzjdgiytl23", "content": "~Cybergcca~\nActively exploited NetScaler flaws enable remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "creation_timestamp": "2026-10-04T04:01:44.660144Z"}, {"uuid": "6ef7d813-2d90-4650-8392-14f6f6052554", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwzjdgiytl23", "content": "~Cybergcca~\nActively exploited NetScaler flaws enable remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "creation_timestamp": "2026-10-04T04:01:44.702354Z"}, {"uuid": "6ca9e6f7-63ab-4533-9032-99e5b7560135", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://gist.github.com/ichintu/1d0f62e7f5bbc80cb4372e1a7110c679", "content": "On October 4, 2026, three high-severity vulnerabilities were disclosed:\n\u2022 **CVE-2026-88779 (8.7):** Memory overflow in older NetScaler ADC/Gateway versions, causing Denial of Service.\n\u2022 **CVE-2026-105126 (8.6):** Privilege escalation in LaraDashboard (<1.4.8) allowing admins to gain Superadmin rights, risking account takeover and code execution.\n\u2022 **CVE-2026-105123 (8.8):** Remote Code Execution and arbitrary file manipulation in W CMS (\u22643.18.0) via an unvalidated media upload API.\n\nImmediate patching or version updates are strongly recommended to mitigate these critical risks.", "creation_timestamp": "2026-10-04T04:00:28.000000Z"}, {"uuid": "5886f2a1-4214-4cc0-b019-c4070755ed39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117380758043847030", "content": "CVE-2026-88779 (HIGH, CVSS 8.7) impacts NetScaler ADC & Gateway <14.1-73.41, <13.1-64.28, <13.1-37.282. Remote, unauthenticated attackers can disrupt availability. Patch required; no active exploits. https://radar.offseq.com/threat/cve-2026-88779-vulnerability-in-netscaler-adc-93f6c6cf8720e4e9 #OffSeq #NetScaler #Vulnerability #InfoSec", "creation_timestamp": "2026-10-04T04:30:27.877338Z"}, {"uuid": "49b680aa-5bbd-4715-bb06-0df8f71b9fae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwzkwtuxrv2j", "content": "Vulnerability CVE-2026-88779 (HIGH, CVSS 8.7) affects NetScaler ADC/Gateway pre-14.1-73.41. Remote attacks possible \u2014 patch now. No active exploits detected. https://radar.offseq.com/threat/cve-2026-88779-vulnerability-in-netscaler-adc-93f6c6cf8720e4e9 #OffSeq #NetScaler #Security", "creation_timestamp": "2026-10-04T04:30:29.554524Z"}, {"uuid": "8f8a28db-b1fa-455a-a298-1fc78b4ad053", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/ifin-intel.org/post/3mwzld4jdqk24", "content": "This is the patch that never ends\nIt goes on and on my friends\nSome people\nStarted applying it\nNot knowing what it was\nAnd they will keep applying it\nForever just because\n\n(CVE-2026-88779 advisory and patch included now)\n\nifin.network/t/multi...\n\n#Citrix #Netscaler #ThreatIntel #ThreatIntelligence ", "creation_timestamp": "2026-10-04T04:37:21.044322Z"}, {"uuid": "37f4784e-8c00-4911-8678-e58d9491f993", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/117380785150306397", "content": "This is the patch that never endsIt goes on and on my friendsSome peopleStarted applying itNot knowing what it wasAnd they will keep applying itForever just because\n(CVE-2026-88779 advisory and patch included now)\nhttps://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867\n#Citrix #Netscaler #ThreatIntel #ThreatIntelligence", "creation_timestamp": "2026-10-04T04:37:41.017055Z"}, {"uuid": "07127865-07ea-4f7f-afa2-de74f783d86f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mwzmpnd4hv2h", "content": "Daily IT Security Digest \u2014 2026-10-04\n[2](https://infosec.exchange/@offseq/117319888106479032), [3](https://hackread.bsky.social/117380646582861631)]\n\n## 3. NetScaler ADC/Gateway High-Severity Vulnerabilities Published\nCVE-2026-88779 (CVSS 8.7) affects NetScaler ADC and Gateway versions below", "creation_timestamp": "2026-10-04T05:02:14.912288Z"}, {"uuid": "250f8fd8-3b49-42f6-a153-805cc2fc12c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5uc4u5osso7wb", "content": "CVE-2026-88779 - Memory overflow vulnerability leading to Denial of Service\nCVE ID : CVE-2026-88779\n \n Published : Oct. 4, 2026, 4:16 a.m. | 48\u00a0minutes ago\n \n Description : Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.41, before...", "creation_timestamp": "2026-10-04T05:54:24.534051Z"}, {"uuid": "f708fdf4-d32c-460e-bc35-180c3c31a6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/raven-sec.bsky.social/post/3mwzpzkqp6tx7", "content": "Citrix flaws under attack, Chinese espionage targets 100+ U.K. academics, Warlock hits Iberia.\n\n\u2022 CVE-2026-88771/88772 actively exploited (news/7207a6cc)\n\n5 sources verified \u00b7 hackingallthethings.com\n#infosec #threatintel #cybersecurity #CVE #APT", "creation_timestamp": "2026-10-04T06:01:31.906606Z"}, {"uuid": "e81112c8-9854-4be4-886a-0b9ff6b9a9ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mwzuah4n5t2c", "content": "Patching NetScaler CVE-2026-88771 doesn't evict intruders: LevelBlue saw a sec_monitor superuser and a PHP web shell behind CSS-like URLs; Sucuri's WordPress SC backdoor rebuilds from 8 persistence points. Hunt, don't just patch. https://cti.securitycyber.uk", "creation_timestamp": "2026-10-04T07:16:55.247340Z"}, {"uuid": "92f02456-1dba-4b74-b670-57591c5b0314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwzuizzpzn2j", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 122 interactions\nCVE-2026-88772: 118 interactions\nCVE-2026-86950: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 12 interactions\nCVE-2026-88771: 10 interactions\nCVE-2026-104286: 7 interactions\n", "creation_timestamp": "2026-10-04T07:21:43.551505Z"}, {"uuid": "9c698cc2-b2ed-4a7f-83af-b49c4848b72c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwzuizzpzn2j", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 122 interactions\nCVE-2026-88772: 118 interactions\nCVE-2026-86950: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 12 interactions\nCVE-2026-88771: 10 interactions\nCVE-2026-104286: 7 interactions\n", "creation_timestamp": "2026-10-04T07:21:43.574104Z"}, {"uuid": "0d4d3f59-164a-44a5-bbca-2cc78a3ff44c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-88779", "content": "", "creation_timestamp": "2026-10-03T19:16:43.000000Z"}, {"uuid": "9c892347-9032-4a62-b056-667e76e1cf35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwzxufb22u22", "content": "Citrix NetScaler CVE-2026-88779 is exploited in the wild against NetScaler SAML authentication setups. Upgrade to 14.1-73.41 now.\n\n#Citrix #NetScaler #CVE202688779 #SAML #ActivelyExploited #DoS #Vulnerability", "creation_timestamp": "2026-10-04T08:21:45.405413Z"}, {"uuid": "e8b1dc13-948f-44cd-8aa5-e4ae1f71017a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117382034460841816", "content": "The new Citrix Netscaler vuln from Friday is CVE-2026-88779, patch is out now and they recommend patching as soon as possible: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174\nAlthough the vuln is labeled \u201cMemory overflow vulnerability  leading to Denial of Service\u201d, that\u2019s the same as CVE-2025\u20136543. You may remember that lead to RCE.", "creation_timestamp": "2026-10-04T09:55:24.167712Z"}, {"uuid": "dc5a166d-050c-4d00-b9f3-584fd164c189", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-03)", "content": "", "creation_timestamp": "2026-10-03T00:00:00.000000Z"}, {"uuid": "97214f53-424e-48c8-a6b3-14d13b68ddb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://vulnerability.circl.lu/comment/007803cc-3d1a-4c10-8b21-0de3fcce8425", "content": "", "creation_timestamp": "2026-10-04T10:25:17.260775Z"}, {"uuid": "b4dfd420-ed90-4d55-b4fb-15e930c37c33", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a322c452-ef62-4881-96bf-23b1fb7c8b2b", "content": "", "creation_timestamp": "2026-10-04T11:00:01.780145Z"}, {"uuid": "2472a163-3f17-457b-91aa-442f3878ad91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mx2cwmixbi2e", "content": "netscaler-ctx697096-checker: Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771\u201388778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, SAML status, plus --ioc sweep with every public IoC (webshells, implants, backdoor ad", "creation_timestamp": "2026-10-04T11:39:51.189519Z"}, {"uuid": "894d2b13-a3ab-42c5-944b-e5321dc79cbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://infosec.exchange/users/Sikorsky78/statuses/117382562754489781", "content": "The new Citrix Netscaler vuln from Friday is CVE-2026-88779, patch is out now and they recommend patching as soon as possible: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174\nAlthough the vuln is labeled \u201cMemory overflow vulnerability leading to Denial of Service\u201d, that\u2019s the same as CVE-2025\u20136543. You may remember that lead to RCE in the wild.", "creation_timestamp": "2026-10-04T12:09:25.105572Z"}, {"uuid": "8d6e5f17-1393-4544-bad9-c76f982a09e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "d52db0d7-2500-4ec0-9304-356651022f3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/sikkerhetsoppdatering-tilgjengelig-for-citrix-netscaler", "content": "", "creation_timestamp": "2026-10-04T05:08:55.000000Z"}, {"uuid": "d91ffcd1-b537-44cf-a92a-63b8902814b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mx2yuqj6kz2w", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-88771", "creation_timestamp": "2026-10-04T18:12:30.719160Z"}, {"uuid": "2fdf9d91-e121-4b62-ba99-83c33dcb5fe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mx2yurda4h2r", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-88772", "creation_timestamp": "2026-10-04T18:12:35.094299Z"}, {"uuid": "c479f1b9-8765-4c72-925f-ca504e27703c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/todb2.hugesuccess.org/post/3mx32v25anja2", "content": "I didn\u2019t realize the EU CERT was so witty!\n\nhttps://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\n\n(analysis of the NetScaler thing from last week.)", "creation_timestamp": "2026-10-04T18:48:34.453675Z"}, {"uuid": "64b5ed4c-d106-48be-8276-19144a6bfeb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mx35ygijhm2y", "content": "\ud83d\uded1 CVE-2026-88779\nCitrix NetScaler\nCVSS 8.7 / EPSS 0% / KEV: No\nTL;DR: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-\u2026\nhttps://cvesentinel.com/report/CVE-2026-88779?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-10-04T19:44:04.597650Z"}, {"uuid": "948a2d84-7c42-4716-ae0d-dd44b1e4be5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/etguenni.bsky.social/post/3mx36pofmrs2v", "content": "#Citrix die #Schwachstelle #CVE-2026-88779 im NetScaler ADC und NetScaler Gateway best\u00e4tigt. F\u00fchrt zum Absturz, kann f\u00fcr Denial of Service-Angriffe missbraucht werden. Also patchen.\n\nborncity.com/blog/2026/10...", "creation_timestamp": "2026-10-04T19:57:00.357857Z"}, {"uuid": "c626b789-dea6-4f71-a46a-ad000239fdaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://social.tchncs.de/users/gborn/statuses/117384403297195790", "content": "#Citrix die #Schwachstelle #CVE-2026-88779 im NetScaler ADC und NetScaler Gateway best\u00e4tigt. F\u00fchrt zum Absturz, kann f\u00fcr Denial of Service-Angriffe missbraucht werden. Also patchen.\nhttps://borncity.com/blog/2026/10/04/citrix-netscaler-adc-gateway-schwachstelle-cve-2026-88779-patchen/", "creation_timestamp": "2026-10-04T19:57:30.185406Z"}, {"uuid": "f59c0181-5f7d-4291-bf3e-d4bc11a4441b", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/927d147d-af17-4c93-a9e6-86641fe38e2c", "content": "", "creation_timestamp": "2026-10-04T20:00:01.877884Z"}, {"uuid": "8e2b39af-cb62-4eff-bffc-512ae3df1567", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mx36xprvib2o", "content": "~Cisa~\nCISA reports active exploitation of a Citrix NetScaler memory-buffer vulnerability and urges rapid remediation.\n-\nIOCs: CVE-2026-88779\n-\n#CVE-2026-88779 #Citrix #ThreatIntel", "creation_timestamp": "2026-10-04T20:01:33.373225Z"}, {"uuid": "58d9e9cf-cc65-45d1-ada8-54a3e0ff9852", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler-1", "content": "", "creation_timestamp": "2026-10-04T10:05:39.000000Z"}, {"uuid": "214f1fab-7053-4dde-9c5e-e4361ecb8e4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mx3arvca3j2n", "content": "If you're spending your Sunday night anywhere near a terminal, start with the NetScaler gear. CISA put CVE-2026-88779 on the Known Exploited Vulnerabilities list today, and the federal patch deadline is October 7.\n\n#vulnerability #infosec", "creation_timestamp": "2026-10-04T20:34:05.062225Z"}, {"uuid": "9e3f2dae-c90a-458f-8490-3d78f498234b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler-1", "content": "", "creation_timestamp": "2026-10-04T10:05:39.000000Z"}, {"uuid": "587fde01-227b-447f-a9a9-91a50662b965", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88778", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler-1", "content": "", "creation_timestamp": "2026-10-04T10:05:39.000000Z"}, {"uuid": "7899c242-fd80-4b93-b2b8-9f82961402d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mx3cavlriv2u", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1004)\n\n\u26a0\ufe0f CVE-2026-88779 - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-10-04T21:00:22.442185Z"}, {"uuid": "d93730a6-4cef-4bcb-8434-aff86f92288c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mx3cxl24yq2v", "content": "Breaking: Citrix NetScaler vulnerability CVE-2026-88779\n\u2022 Kindles OpenAI Dots remaster out\n\u2022 Modern Warfare 4 trailer drops\n\u2022 Meta Xiaomi PS5 updates emerge\nWatch the verified two-minute video.", "creation_timestamp": "2026-10-04T21:13:04.212144Z"}, {"uuid": "e5784f10-976b-4319-bce3-e491c6a828d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cybercod.bsky.social/post/3mx3d3v2ahs2g", "content": "Thanks for the heads-up! CVE-2026-88779 is critical. If you're running NetScaler, prioritize patching this immediately to avoid potential memory-based exploits. Stay safe! #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-04T21:15:28.138833Z"}, {"uuid": "56e88634-0d4a-4cf5-9b09-0bf99f28ac89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mx3de3kzo22w", "content": "CISA added CVE-2026-88779 to its Known Exploited Vulnerabilities list (2026-10-04).\nCitrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer\nEPSS today: 0.003 (no score 30 days earlier)\n#infosec #KEV", "creation_timestamp": "2026-10-04T21:20:04.790248Z"}, {"uuid": "9a8e8c53-5463-4efd-8f91-db6ba88dda22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mx3filmfcv2m", "content": "Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution.", "creation_timestamp": "2026-10-04T21:58:22.568998Z"}, {"uuid": "929a9738-a650-468b-91bd-f62cf089d6de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx3fsnry3i2w", "content": "Citrix\u3001\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u305fNetScaler\u306eSAML\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u4fee\u6b63\n\nCitrix\u306f\u3001\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u305fNetScaler\u306e\u65b0\u305f\u306a\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\uff08DoS\uff09\u8106\u5f31\u6027\u300cCVE-2026-88779\u300d\u306b\u5bfe\u51e6\u3059\u308b\u7dca\u6025\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u7814\u7a76\u8005\u3089\u306f\u3001\u3053\u306e\u8106\u5f31\u6027\u304c\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3082\u60aa\u7528\u3067\u304d\u308b\u304b\u3069\u3046\u304b\u3092\u8abf\u3079\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u30e1\u30e2\u30ea\u30d0\u30c3\u30d5\u30a1\u30fc\u306e\u6b20\u9665\u3067\u3001Gateway\u307e\u305f\u306fAAA\u6a5f\u80fd", "creation_timestamp": "2026-10-04T22:04:00.579851Z"}, {"uuid": "c4c8bc98-ce02-47cb-a576-82738eeb1614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117384907878349330", "content": "\ud83d\udea8 Citrix discloses high-severity NetScaler flaw tracked as CVE-2026-88779\u2800CVE-2026-88779 is a memory overflow vulnerability affecting certain customer-managed NetScaler ADC and NetScaler Gateway deployments. Successful exploitation can cause a denial-of-service condition. Citrix assigned it a CVSS v4.0 score of 8.7.\u2800The vulnerability applies when the appliance is configured as either:\u2800\u2022 A SAML Service Provider (SP)\u2022 A SAML Identity Provider (IdP)\u2800Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, along with affected FIPS and NDcPP builds. Citrix is urging customers to install the updated releases as soon as possible.\u2800CVE: CVE-2026-88779Severity: HighCVSS v4.0: 8.7Impact: Denial of ServiceCWE: CWE-119\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174", "creation_timestamp": "2026-10-04T22:05:49.054892Z"}, {"uuid": "02f8194f-fd68-4e93-aa70-fbf9c2733a62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mx3fwwgcv62i", "content": "Citrix patched CVE-2026-88779 in NetScaler ADC and Gateway, a CVSS 8.7 buffer overflow in SAML authentication exploited as a zero-day, per BleepingComputer. Attackers sent usernames containing shell commands to pull payloads. CISA added it to KEV, deadline October 7. bleepingcomputer.com/new...", "creation_timestamp": "2026-10-04T22:06:23.227885Z"}, {"uuid": "a13154d8-487e-4b26-8f28-7d11f2743188", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mx3fzem3cq2q", "content": "\ud83e\udd16 CVE-2026-88779 (CVSS 8.7): memory corruption (CWE-119) in Citrix NetScaler ADC/Gateway, unauthenticated network DoS. Exploited as a 0-day, in CISA KEV. Fixes: ADC <14.1-73.41/13.1-64.28, Gateway <14.1-73.41/13.1-64.28\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-88779", "creation_timestamp": "2026-10-04T22:07:44.702865Z"}, {"uuid": "75c6e358-84d2-43f1-b0e0-d3574a15074c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mx3hirj6xp2a", "content": "CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restrictio...\n\n\ud83d\udd17 https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog", "creation_timestamp": "2026-10-04T22:34:15.230035Z"}, {"uuid": "4ef86a20-a8ee-4588-b412-6d3da4da13f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mx3jlxywfn2c", "content": "Citrix NetScaler CVE-2026-88779 (CVSS 8.7) is exploited as a zero-day on ADC/Gateway configured for SAML, now on CISA KEV. Upgrade to 14.1-73.41 or 13.1-64.28 now. https://cti.securitycyber.uk", "creation_timestamp": "2026-10-04T23:11:50.148105Z"}, {"uuid": "6256058b-ddf4-4f40-b5a5-315c86503efa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mx3jnueuoe27", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-88779", "creation_timestamp": "2026-10-04T23:12:53.898134Z"}, {"uuid": "3f0e0c66-3464-4196-9d5c-1e054605d297", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mx3lz4ouz52s", "content": "Citrix NetScaler \u306e SAML \u8a8d\u8a3c\u306b\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027 CVE-2026-88779 \u304c\u5b58\u5728\u3002\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u304a\u308a\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u3082\u8abf\u67fb\u4e2d\u3002", "creation_timestamp": "2026-10-04T23:54:58.786965Z"}, {"uuid": "9e3bb16d-ffd6-4bb3-9049-6cf85578c0f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mx3mcibbsp2f", "content": "Patch NetScaler CVE-2026-88779, exploited in attacks. Search typing: fix CTF Loader. File errors: unblock/long paths. NvpwrControl 2.3.0 drops unsigned RTX 50 driver. Members: 29671 ISO/OpenVino upgrade. +9 more stories, 7 new members", "creation_timestamp": "2026-10-05T00:00:14.023283Z"}, {"uuid": "7c106f45-d01b-49b2-810c-52c1315e2174", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44753", "content": "CISA Adds One Known Exploited Vulnerability to Catalog \n\nCISA has added one new vulnerability to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThis type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog", "creation_timestamp": "2026-10-04T23:00:37.000000Z"}, {"uuid": "7b3ca52b-14b0-462c-ab2e-74dab4961710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44749", "content": "Citrix patches NetScaler SAML zero-day exploited in attacks\n\nCitrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]\nhttps://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/", "creation_timestamp": "2026-10-04T23:00:31.000000Z"}, {"uuid": "06cf3a53-1e8e-490b-ac6d-c58f966b504e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mx3pqahejg2i", "content": "CVE-2026-88779 is trending. Hype score 11, currently #4 on cvemon.\n\nVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88779", "creation_timestamp": "2026-10-05T01:01:35.920253Z"}, {"uuid": "16068016-f4e7-489d-966c-c4ae3e21ac8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mx3x3d33ze2q", "content": "NetScaler SAML Authentication Issue: CVE-2026-88779 Exploited in the Wild\uff08NetScaler\u306eSAML\u8a8d\u8a3c\u306b\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3001\u5b9f\u969b\u306e\u653b\u6483\u3067\u60aa\u7528\uff09 #SecurityOnline (Oct 4)\nsecurityonline.info/netscaler-sa...", "creation_timestamp": "2026-10-05T03:13:03.885399Z"}, {"uuid": "aca18df2-7a73-4816-989b-44036af1a633", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mx3s6ocoec2m", "content": "Citrix issued emergency fixes for CVE-2026-88779, a NetScaler SAML zero-day exploited in targeted attacks to cause denial of service. CISA added the flaw to its Known Exploited Vulnerabilities catalog. #Citrix #NetScaler #CISA", "creation_timestamp": "2026-10-05T01:45:27.515130Z"}, {"uuid": "8d6119c5-0e1c-4593-acdc-9c9ce5c272f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mx3t5sks6p2v", "content": "Zero-day kwetsbaarheid in NetScaler SAML maakt systemen kwetsbaar voor aanvallen\n\nEen ernstige zero-day kwetsbaarheid, gecodeerd als CVE-2026-88779, is ontdekt in de SAML-component van NetScaler. Deze kwetsbaarheid, een geheugenoverflow (CWE-119), stelt aanvallers in staat om zonder authenti...", "creation_timestamp": "2026-10-05T02:02:52.658316Z"}, {"uuid": "c2adb0dd-8925-4ad1-a89e-7d99add3745a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mx3tjgnytq2w", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERTCC \uff08Oct 2\uff09\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-10-05T02:09:22.309000Z"}, {"uuid": "d24198d2-9fa5-466b-9682-2dbcaba68051", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-denial-of-service-vulnerability_20261005", "content": "", "creation_timestamp": "2026-10-04T18:00:00.000000Z"}, {"uuid": "5f8d1cee-be0b-4bbb-9f81-996a538d1829", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://t.me/BleepingComputer/25718", "content": "\u200aCitrix patches NetScaler SAML zero-day exploited in attacks\n\nCitrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]\n\nhttps://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/", "creation_timestamp": "2026-10-04T22:21:27.000000Z"}, {"uuid": "f5af5913-64eb-4af2-8b24-15090e420765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx44vorok526", "content": "Citrix NetScaler SAML\u306e\u8106\u5f31\u6027\u3001\u8a8d\u8a3c\u306a\u3057\u306e\u30ea\u30e2\u30fc\u30c8DoS\u653b\u6483\u304c\u53ef\u80fd\u306b\n\nCitrix\u306f\u3001NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u5b58\u5728\u3059\u308b\u3001\u91cd\u5927\u5ea6\u306e\u9ad8\u3044\u30e1\u30e2\u30ea\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3059\u308b\u305f\u3081\u3001\u7dca\u6025\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30b9\u30af\u30ea\u30d7\u30c6\u30a3\u30f3\u30b0\u5bfe\u7b56 \u300cCVE-2026-88779\u300d\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u3055\u308c\u308b\u3068\u3001\u8a8d\u8a3c\u3055\u308c\u3066", "creation_timestamp": "2026-10-05T04:57:17.626280Z"}, {"uuid": "5fbe475b-2707-4599-a8e8-1c2b824991f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/BleepingComputer/25718", "content": "\u200aCitrix patches NetScaler SAML zero-day exploited in attacks\n\nCitrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]\n\nhttps://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/", "creation_timestamp": "2026-10-04T22:21:27.000000Z"}, {"uuid": "12ff4087-0097-428e-825e-32d5d33ac9fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx45kwre7j2d", "content": "Citrix\u304cNetScaler ADC\u304a\u3088\u3073Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u8b66\u544a\u3001\u60aa\u7528\u306e\u52d5\u304d\u3082\n\nCitrix\u306f\u3001\u9867\u5ba2\u7ba1\u7406\u578b\u306eNetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306b\u5f71\u97ff\u3059\u308b\u30e1\u30e2\u30ea\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u8106\u5f31\u6027\u300cCVE-2026-88779\u300d\u306b\u3064\u3044\u3066\u3001\u91cd\u8981\u5ea6\u306e\u9ad8\u3044\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u30fc\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u3001SAML\u30b5\u30fc\u30d3\u30b9\u30d7\u30ed\u30d0\u30a4\u30c0\u30fc\uff08SP\uff09\u307e\u305f\u306fSAML ID\u30d7\u30ed", "creation_timestamp": "2026-10-05T05:09:10.146883Z"}, {"uuid": "e919b117-893c-4f71-a65a-7aa3f56c06d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mx46fbojwe2y", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 04/10) (1)\n\u2022 Citrix NetScaler CVE-2026-88779, CVSS 8.7\nhttps://www.cybowl.eu/cyber/blog_2026-10-04", "creation_timestamp": "2026-10-05T05:23:54.463629Z"}, {"uuid": "5c5f98de-e236-4eae-8ac4-da383b3cfa28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mx46qhjg422y", "content": "\u3010\u7dca\u6025\u3011NetScaler ADC/Gateway \u306b\u8a8d\u8a3c\u306a\u3057\u3067\u6b62\u3081\u3089\u308c\u308b\u8106\u5f31\u6027 CVE-2026-88779\uff08CVSS 8.7\uff09\u3002\u524d\u63d0\u306f SAML SP/IdP \u69cb\u6210\u3067\u30019/27\u306b 14.1-73.37 \u3078\u4e0a\u3052\u305f\u6a5f\u5668\u3082\u5bfe\u8c61\u3067\u3059\u3002\u5bfe\u51e6\u306f 14.1-73.41 / 13.1-64.28 \u4ee5\u964d\u3078\u306e\u66f4\u65b0\u3002\nforsmile.jp/articles/net...\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #CVE", "creation_timestamp": "2026-10-05T05:30:10.837968Z"}, {"uuid": "bdf6d229-f7cf-4898-950e-2a39961e923b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mx46v7xcuszg", "content": "Citrix\u3001\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3066\u3044\u308bNetScaler SAML\u306e\u30bc\u30ed\u30c7\u30a4\u306b\u30d1\u30c3\u30c1\uff1aCVE-2026-88779 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47909/", "creation_timestamp": "2026-10-05T05:32:48.893575Z"}, {"uuid": "63e9b50d-641d-41b4-838e-6c8262826d3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mx46yq4lny2j", "content": "CVE-2026-88779 enables memory overflow in NetScaler SAML configurations, allowing targeted attacks that can cause denial of service and potentially remote code execution.\n", "creation_timestamp": "2026-10-05T05:34:48.766900Z"}, {"uuid": "2c205519-d226-4d88-a7b7-99c3241c4380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mx475yecxv2z", "content": "\ud83d\udcf0 Citrix Patch Zero-Day NetScaler CVE-2026-88779 yang Aktif Dieksploitasi\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/05/citrix-netscaler-cve-2026-88779-zero-day-saml/\n\n#cisa #citrix #cybersecurity #keamananSiber #malware #netscaler #vulnerability #zero-day", "creation_timestamp": "2026-10-05T05:37:43.162845Z"}, {"uuid": "8ddc06a4-e9b2-4c61-8be5-6af7052f697c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mx47v7fwfe2q", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88779: Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.41, before 13.1-64.2\u2026\nCVSS 8.7 \u00b7 EPSS 0.3% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-88779\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-10-05T05:50:45.469749Z"}, {"uuid": "6dc56fe0-adbe-42fb-9c76-b03c7906e949", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mx47wcg5td2d", "content": "Exploitation of Citrix NetScaler Zero\n\nThis article frames CVE-2026-88779 purely as a Denial of Service risk, yet it notes that researchers suggest remote code execution is possible and reports evidence of malware presence on honeypots. If RCE is feasible, how does Citrix's curren\u2026\n\nvia SecurityWeek", "creation_timestamp": "2026-10-05T05:51:19.201139Z"}, {"uuid": "54c2f0a8-61fd-458a-bbdd-1f44f72b2bca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mx4a5ysevy2q", "content": "\ud83d\udee1\ufe0f Revue cyber du 5 octobre :\n\n\u2022 Cisco SD-WAN : nouveau zero-day (bypass d'auth) exploit\u00e9 activement\n\u2022 Citrix NetScaler SAML : zero-day CVE-2026-88779 exploit\u00e9, patchs d'urgence\n\u2022 Fortinet FortiMail : CVE-2026-104286 critique exploit\u00e9 en 0-day\n\nhttps://www.bleepingcomputer.com/", "creation_timestamp": "2026-10-05T05:55:37.396172Z"}, {"uuid": "5c1a41bf-7429-4722-b636-3956cf1f2951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mx4c53ho6h2n", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-88779: \u26a0\ufe0f CVE-2026-88779: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 0.3%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-88779-vulnerability-in-netscaler-adc-and-netscaler", "creation_timestamp": "2026-10-05T06:30:54.850599Z"}, {"uuid": "876350d1-c3d5-4002-ad5a-b14ab9a5f0bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mx4cawnvda2n", "content": "Here we go again, as Citrix NetScaler appliances hit poor administrators with new zero-day CVE-2026-88779 just days after two other exploited flaws were patched. Protecting ourselves apparently means endlessly patching the exact same appliances over and over without any peace. It...\n\nRead full story", "creation_timestamp": "2026-10-05T06:33:04.160509Z"}, {"uuid": "41753cfb-904a-41eb-99bf-3bb657c37883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mx4f2gpysa2t", "content": "Discover how hackers exploit CVE-2026-88771 in Citrix NetScaler to hide PHP web shells as CSS files, granting remote access and compromising networks.\n\n#Citrix #NetScaler #Cybersecurity #WebShell #CVE202688771", "creation_timestamp": "2026-10-05T07:23:06.759848Z"}, {"uuid": "37aef08d-d044-4dcb-87e4-a7f369e1acdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx4fwaoq6x2e", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 72 interactions\nCVE-2026-88772: 70 interactions\nCVE-2026-104286: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 23 interactions\nCVE-2026-61500: 4 interactions\nCVE-2026-105123: 3 interactions\n", "creation_timestamp": "2026-10-05T07:38:39.655614Z"}, {"uuid": "9adab1de-b842-486f-9a6f-3393cd620cd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx4fwaoq6x2e", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 72 interactions\nCVE-2026-88772: 70 interactions\nCVE-2026-104286: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 23 interactions\nCVE-2026-61500: 4 interactions\nCVE-2026-105123: 3 interactions\n", "creation_timestamp": "2026-10-05T07:38:39.687831Z"}, {"uuid": "7e7986f7-c7d2-49fc-ae85-201ebb8424da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx4fwaoq6x2e", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 72 interactions\nCVE-2026-88772: 70 interactions\nCVE-2026-104286: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 23 interactions\nCVE-2026-61500: 4 interactions\nCVE-2026-105123: 3 interactions\n", "creation_timestamp": "2026-10-05T07:38:39.740946Z"}, {"uuid": "0578cac0-4042-4aef-9bdc-2007d371aa0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/kasperskyb2b/2331", "content": "\u2757\ufe0f \u041d\u043e\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u043d\u0430 NetScaler, \u0442\u0435\u043f\u0435\u0440\u044c \u0435\u0449\u0451 \u0438 CVE-2026-88779 \n\n\u041a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Citrix NetScaler ADC \u0438 Citrix NetScaler Gateway, \u043a\u043e\u043b\u043b\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0445 PitScaler, \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0435 \u043a\u0440\u0443\u0433\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043f\u0430\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 CVE-2026-88771 \u0438 -88772 (CVSS4B 9.5) \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 4 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043f\u0440\u0438\u0432\u043e\u0434\u044f \u043a \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0430\u0437\u0438\u043b\u0430 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 CERT \u0434\u0430\u0436\u0435 \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043e\u0442 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.  \u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f CTX697096 (\u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0435\u0449\u0451 6 CVE \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0432\u044b\u0448\u0435\u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c) 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 \u0431\u044b\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, TTPs \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0415\u0441\u043b\u0438 \u043f\u0435\u0440\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439, \u0433\u0434\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0436\u0435\u0440\u0442\u0432\u0435 \u043e\u0442\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0434\u0447\u0438\u0449\u0430\u043b\u0438 \u0441\u043b\u0435\u0434\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445, \u0442\u043e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u043e\u043b\u043d\u0435 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430\u0443\u0434\u0430\u0447\u0443. \u0427\u0438\u0441\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 SAML-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a DoS \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.  \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2026-88779 (CVSS4B 8.7) \u0438 \u0434\u043b\u044f \u043d\u0435\u0451 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u044b\u0448\u043b\u043e \u0435\u0451 \u043e\u0434\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0412\u0430\u0436\u043d\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0443\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u041f\u041e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0432\u0437\u043b\u043e\u043c\u0430. \u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0437\u0435\u043b, \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e (HA synchronization), \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u0438\u0441\u043a\u043e\u0432 \u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0447\u0438\u0441\u0442\u044b\u0439 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437, \u0430 \u043d\u0435 \u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0442\u0430\u0440\u044b\u0439.  \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0440\u0438\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u043f\u043e\u043b\u043d\u0443\u044e \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 (nsroot, LDAP bind, RADIUS, API-\u043a\u043b\u044e\u0447\u0438, KEK \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b), \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0447\u0430\u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432. \n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0438 IoC: 1, 2, 3, 4.\n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-10-05T07:18:02.000000Z"}, {"uuid": "c2bc749e-d4eb-4225-8333-82662c6b999e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://t.me/kasperskyb2b/2331", "content": "\u2757\ufe0f \u041d\u043e\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u043d\u0430 NetScaler, \u0442\u0435\u043f\u0435\u0440\u044c \u0435\u0449\u0451 \u0438 CVE-2026-88779 \n\n\u041a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Citrix NetScaler ADC \u0438 Citrix NetScaler Gateway, \u043a\u043e\u043b\u043b\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0445 PitScaler, \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0435 \u043a\u0440\u0443\u0433\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043f\u0430\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 CVE-2026-88771 \u0438 -88772 (CVSS4B 9.5) \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 4 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043f\u0440\u0438\u0432\u043e\u0434\u044f \u043a \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0430\u0437\u0438\u043b\u0430 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 CERT \u0434\u0430\u0436\u0435 \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043e\u0442 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.  \u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f CTX697096 (\u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0435\u0449\u0451 6 CVE \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0432\u044b\u0448\u0435\u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c) 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 \u0431\u044b\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, TTPs \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0415\u0441\u043b\u0438 \u043f\u0435\u0440\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439, \u0433\u0434\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0436\u0435\u0440\u0442\u0432\u0435 \u043e\u0442\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0434\u0447\u0438\u0449\u0430\u043b\u0438 \u0441\u043b\u0435\u0434\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445, \u0442\u043e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u043e\u043b\u043d\u0435 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430\u0443\u0434\u0430\u0447\u0443. \u0427\u0438\u0441\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 SAML-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a DoS \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.  \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2026-88779 (CVSS4B 8.7) \u0438 \u0434\u043b\u044f \u043d\u0435\u0451 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u044b\u0448\u043b\u043e \u0435\u0451 \u043e\u0434\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0412\u0430\u0436\u043d\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0443\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u041f\u041e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0432\u0437\u043b\u043e\u043c\u0430. \u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0437\u0435\u043b, \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e (HA synchronization), \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u0438\u0441\u043a\u043e\u0432 \u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0447\u0438\u0441\u0442\u044b\u0439 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437, \u0430 \u043d\u0435 \u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0442\u0430\u0440\u044b\u0439.  \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0440\u0438\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u043f\u043e\u043b\u043d\u0443\u044e \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 (nsroot, LDAP bind, RADIUS, API-\u043a\u043b\u044e\u0447\u0438, KEK \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b), \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0447\u0430\u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432. \n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0438 IoC: 1, 2, 3, 4.\n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-10-05T07:18:02.000000Z"}, {"uuid": "4e49c835-37b8-471f-8b18-9beeff40d3b0", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f9546ed0-8bec-45b1-be2d-83be14550f68", "content": "", "creation_timestamp": "2026-10-05T08:01:05.673321Z"}, {"uuid": "dab6fe3e-ae17-4067-bcc8-728ef9dc397f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mx4h7dinse2f", "content": "NetScaler \u306e SAML \u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3001\u6a19\u7684\u578b\u653b\u6483\u3067\u60aa\u7528\u4e2d\u2014Citrix \u304c CVE-2026-88779 \u3092\u30d1\u30c3\u30c1\n\nCitrix NetScaler \u306e SAML \u6a5f\u80fd\u306b\u5b58\u5728\u3059\u308b CVE-2026-88779 \u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u304c\u6a19\u7684\u578b\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3001SAML \u5bfe\u5fdc\u74b0\u5883\u304cDoS \u653b\u6483\u3092\u53d7\u3051\u3066\u3044\u307e\u3059\u3002Citrix \u304c\u7dca\u6025\u30d1\u30c3\u30c1\u3092\u516c\u958b\u3057\u305f\u305f\u3081\u3001\u5373\u5ea7\u306e\u9069\u7528\u304c\u63a8\u5968\u3055\u308c\u307e\u3059\u3002\n\n#\u30bc\u30ed\u30c7\u30a4 #CVE #\u8106\u5f31\u6027", "creation_timestamp": "2026-10-05T08:01:38.823188Z"}, {"uuid": "458661f1-a7b1-4a3c-a735-9cb53f747cc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/raven-sec.bsky.social/post/3mx4hg6zmuavp", "content": "NetScaler zero-day rages post-patch; Keycloak token leaks exposed\n\n\u2022 CVE-2026-88779 bypasses SAML defenses (news/58f5730...)\n\u2022 Keycloak leaks bearer tokens (vulns/CVE-2026-105302)\n\n5 sources verified \u00b7 hackingallthethings.com\n#infosec #threatintel #cybersecurity #Keycloak #ShinyHunters", "creation_timestamp": "2026-10-05T08:05:30.713436Z"}, {"uuid": "fda547f4-3a1e-4cdc-bcbe-b1d912512687", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mx4hwrzz2h24", "content": "\ud83e\udd16 CVE-2026-88779 (CVSS 8.7): memory overflow in Citrix NetScaler ADC & Gateway, exploited in zero-day attacks. Can knock SAML deployments offline; RCE potential probed. Emergency patches out.\nhttps://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html", "creation_timestamp": "2026-10-05T08:14:45.418907Z"}, {"uuid": "f1249bf2-d1f4-4a73-940c-bef3de9dc737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/117387473613042889", "content": "New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline\nCitrix has released security updates for CVE-2026-88779, a high-severity (CVSS 8.7) memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that has been exploited in targeted zero-day attacks. Successful exploitation can knock SAML-based deployments offline. Citrix urges administrators to apply the updates immediately. https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html", "creation_timestamp": "2026-10-05T08:58:18.815251Z"}, {"uuid": "fd42cf95-abf2-4a4a-94fa-616e1b5092bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mx4kep7qqo26", "content": "New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline\n\nCitrix has released security updates for CVE-2026-88779, a high-severity (CVSS 8.7) memory overflow vulnerability in NetScaler ADC and... https://threatintel.cc/2026/10/05/new-netscaler-zeroday-exploited-in.html", "creation_timestamp": "2026-10-05T08:58:20.295638Z"}, {"uuid": "f6d6ab19-82cb-4548-acae-b8f2922a66a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/kasperskyb2b/2331", "content": "\u2757\ufe0f \u041d\u043e\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u043d\u0430 NetScaler, \u0442\u0435\u043f\u0435\u0440\u044c \u0435\u0449\u0451 \u0438 CVE-2026-88779 \n\n\u041a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Citrix NetScaler ADC \u0438 Citrix NetScaler Gateway, \u043a\u043e\u043b\u043b\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0445 PitScaler, \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0435 \u043a\u0440\u0443\u0433\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043f\u0430\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 CVE-2026-88771 \u0438 -88772 (CVSS4B 9.5) \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 4 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043f\u0440\u0438\u0432\u043e\u0434\u044f \u043a \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0430\u0437\u0438\u043b\u0430 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 CERT \u0434\u0430\u0436\u0435 \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043e\u0442 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.  \u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f CTX697096 (\u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0435\u0449\u0451 6 CVE \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0432\u044b\u0448\u0435\u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c) 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 \u0431\u044b\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, TTPs \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0415\u0441\u043b\u0438 \u043f\u0435\u0440\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439, \u0433\u0434\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0436\u0435\u0440\u0442\u0432\u0435 \u043e\u0442\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0434\u0447\u0438\u0449\u0430\u043b\u0438 \u0441\u043b\u0435\u0434\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445, \u0442\u043e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u043e\u043b\u043d\u0435 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430\u0443\u0434\u0430\u0447\u0443. \u0427\u0438\u0441\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 SAML-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a DoS \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.  \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2026-88779 (CVSS4B 8.7) \u0438 \u0434\u043b\u044f \u043d\u0435\u0451 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u044b\u0448\u043b\u043e \u0435\u0451 \u043e\u0434\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0412\u0430\u0436\u043d\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0443\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u041f\u041e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0432\u0437\u043b\u043e\u043c\u0430. \u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0437\u0435\u043b, \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e (HA synchronization), \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u0438\u0441\u043a\u043e\u0432 \u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0447\u0438\u0441\u0442\u044b\u0439 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437, \u0430 \u043d\u0435 \u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0442\u0430\u0440\u044b\u0439.  \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0440\u0438\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u043f\u043e\u043b\u043d\u0443\u044e \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 (nsroot, LDAP bind, RADIUS, API-\u043a\u043b\u044e\u0447\u0438, KEK \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b), \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0447\u0430\u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432. \n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0438 IoC: 1, 2, 3, 4.\n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-10-05T07:18:02.000000Z"}, {"uuid": "668798d7-da94-485c-8a67-f1dd03aa18be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/kasperskyb2b/2331", "content": "\u2757\ufe0f \u041d\u043e\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u043d\u0430 NetScaler, \u0442\u0435\u043f\u0435\u0440\u044c \u0435\u0449\u0451 \u0438 CVE-2026-88779 \n\n\u041a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Citrix NetScaler ADC \u0438 Citrix NetScaler Gateway, \u043a\u043e\u043b\u043b\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0445 PitScaler, \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0435 \u043a\u0440\u0443\u0433\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043f\u0430\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 CVE-2026-88771 \u0438 -88772 (CVSS4B 9.5) \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 4 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043f\u0440\u0438\u0432\u043e\u0434\u044f \u043a \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0430\u0437\u0438\u043b\u0430 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 CERT \u0434\u0430\u0436\u0435 \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043e\u0442 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.  \u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f CTX697096 (\u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0435\u0449\u0451 6 CVE \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0432\u044b\u0448\u0435\u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c) 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 \u0431\u044b\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, TTPs \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0415\u0441\u043b\u0438 \u043f\u0435\u0440\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439, \u0433\u0434\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0436\u0435\u0440\u0442\u0432\u0435 \u043e\u0442\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0434\u0447\u0438\u0449\u0430\u043b\u0438 \u0441\u043b\u0435\u0434\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445, \u0442\u043e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u043e\u043b\u043d\u0435 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430\u0443\u0434\u0430\u0447\u0443. \u0427\u0438\u0441\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 SAML-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a DoS \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.  \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2026-88779 (CVSS4B 8.7) \u0438 \u0434\u043b\u044f \u043d\u0435\u0451 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u044b\u0448\u043b\u043e \u0435\u0451 \u043e\u0434\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0412\u0430\u0436\u043d\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0443\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u041f\u041e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0432\u0437\u043b\u043e\u043c\u0430. \u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0437\u0435\u043b, \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e (HA synchronization), \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u0438\u0441\u043a\u043e\u0432 \u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0447\u0438\u0441\u0442\u044b\u0439 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437, \u0430 \u043d\u0435 \u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0442\u0430\u0440\u044b\u0439.  \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0440\u0438\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u043f\u043e\u043b\u043d\u0443\u044e \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 (nsroot, LDAP bind, RADIUS, API-\u043a\u043b\u044e\u0447\u0438, KEK \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b), \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0447\u0430\u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432. \n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0438 IoC: 1, 2, 3, 4.\n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "creation_timestamp": "2026-10-05T07:18:02.000000Z"}, {"uuid": "03a9dcbc-42cd-4921-88e9-69e9885fbbf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mx4kpywbh72u", "content": "Citrix released security updates for CVE-2026-88779, a high-severity memory overflow flaw in NetScaler ADC and Gateway exploited in targeted zero-day [\u2026]", "creation_timestamp": "2026-10-05T09:04:39.466623Z"}, {"uuid": "61c3fe76-b051-4d17-9aae-2b11e3931a8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://t.me/thehackernews/10234", "content": "\u203c\ufe0f Citrix has patched a new NetScaler zero-day exploited in targeted attacks.\n\nCVE-2026-88779 affects certain SAML-configured deployments & can cause denial-of-service, with repeated triggering potentially leaving services unavailable.\n\nDetails - https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html", "creation_timestamp": "2026-10-05T06:42:52.000000Z"}, {"uuid": "7916d3c6-cf28-4af0-bb2e-b320f3f8a55c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://gist.github.com/alon710/2a1ac2074ae10a8c5c664c8d13c0f492", "content": "# CVE-2026-88779: CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88779\n\n## Summary\nCVE-2026-88779 is a critical vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway affecting systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). An unauthenticated remote attacker can exploit this vulnerability to trigger a buffer overflow in the authentication daemon, resulting in persistent denial of service and appliance crash loops.\n\n## TL;DR\nAn unauthenticated remote buffer overflow vulnerability in Citrix NetScaler's SAML parsing daemon (nsaaad) allows attackers to trigger a persistent, cluster-wide denial of service loop on affected ADC and Gateway appliances.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-119\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **EPSS Score**: 0.00276\n- **Impact**: Denial of Service / High Availability Failover Loop\n- **Exploit Status**: active\n- **KEV Status**: Listed\n\n## Affected Systems\n\n- Citrix NetScaler ADC\n- Citrix NetScaler Gateway\n- **NetScaler ADC**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler Gateway**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler ADC**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n- **NetScaler Gateway**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n\n## Mitigation\n\n- Apply security patches immediately to NetScaler appliances\n- Deploy temporary responder policies bound to AAA_REQUEST\n- Apply latest Application Firewall signature updates via NetScaler Console\n\n**Remediation Steps:**\n1. Verify if SAML is active using the command 'show authentication samlAction'\n2. If vulnerable, download firmware build 14.1-73.41 or 13.1-64.28\n3. Install the updated firmware according to Citrix deployment guidelines\n4. Verify that the nsaaad daemon is stable and no core dumps are generated\n\n## References\n\n- [Citrix Security Bulletin CTX697174](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174)\n- [Citrix Tech Zone Security Blog](https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/)\n- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779)\n- [Thomas Poppelgaard NetScaler Checker](https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker)\n- [Orjan Johansen NetScaler Threat Hunt Helper](https://github.com/orjanj/netscaler_threat_hunt_helper)\n- [Technical Background Blog & Remediation Guide](https://www.poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88779) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-05T10:00:30.000000Z"}, {"uuid": "ecfe29c6-6efc-4fa8-b520-ae781a966e09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117387773319588891", "content": "I need @watchTowr to fact-check me here but I think CVE-2026-88779 is a redux of CVE-2026-8452? At least based on this mitigation Citrix support are giving out, somebody posted it on their blog. https://www.deyda.net/index.php/de/2026/08/28/netscaler-cve-checkliste-updates-sicherheitspruefung-und-incident-response/\nThe 8452 patch locked SAML PrefixList to 512 byte or below string. But I think CVE-2026-8452 may be more than 15 items in PrefixList, space-separated, to trigger a vuln. Assuming Citrix support gave out the right mitigation.", "creation_timestamp": "2026-10-05T10:14:41.243500Z"}, {"uuid": "b7d1ef49-c5f9-439f-89e8-25ee834a158a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88778", "type": "seen", "source": "https://gist.github.com/alon710/2a1ac2074ae10a8c5c664c8d13c0f492", "content": "# CVE-2026-88779: CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88779\n\n## Summary\nCVE-2026-88779 is a critical vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway affecting systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). An unauthenticated remote attacker can exploit this vulnerability to trigger a buffer overflow in the authentication daemon, resulting in persistent denial of service and appliance crash loops.\n\n## TL;DR\nAn unauthenticated remote buffer overflow vulnerability in Citrix NetScaler's SAML parsing daemon (nsaaad) allows attackers to trigger a persistent, cluster-wide denial of service loop on affected ADC and Gateway appliances.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-119\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **EPSS Score**: 0.00276\n- **Impact**: Denial of Service / High Availability Failover Loop\n- **Exploit Status**: active\n- **KEV Status**: Listed\n\n## Affected Systems\n\n- Citrix NetScaler ADC\n- Citrix NetScaler Gateway\n- **NetScaler ADC**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler Gateway**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler ADC**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n- **NetScaler Gateway**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n\n## Mitigation\n\n- Apply security patches immediately to NetScaler appliances\n- Deploy temporary responder policies bound to AAA_REQUEST\n- Apply latest Application Firewall signature updates via NetScaler Console\n\n**Remediation Steps:**\n1. Verify if SAML is active using the command 'show authentication samlAction'\n2. If vulnerable, download firmware build 14.1-73.41 or 13.1-64.28\n3. Install the updated firmware according to Citrix deployment guidelines\n4. Verify that the nsaaad daemon is stable and no core dumps are generated\n\n## References\n\n- [Citrix Security Bulletin CTX697174](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174)\n- [Citrix Tech Zone Security Blog](https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/)\n- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779)\n- [Thomas Poppelgaard NetScaler Checker](https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker)\n- [Orjan Johansen NetScaler Threat Hunt Helper](https://github.com/orjanj/netscaler_threat_hunt_helper)\n- [Technical Background Blog & Remediation Guide](https://www.poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88779) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-05T10:00:30.000000Z"}, {"uuid": "e3a72685-5ccb-414e-bffb-e18aeaf1cb48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://gist.github.com/alon710/2a1ac2074ae10a8c5c664c8d13c0f492", "content": "# CVE-2026-88779: CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88779\n\n## Summary\nCVE-2026-88779 is a critical vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway affecting systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). An unauthenticated remote attacker can exploit this vulnerability to trigger a buffer overflow in the authentication daemon, resulting in persistent denial of service and appliance crash loops.\n\n## TL;DR\nAn unauthenticated remote buffer overflow vulnerability in Citrix NetScaler's SAML parsing daemon (nsaaad) allows attackers to trigger a persistent, cluster-wide denial of service loop on affected ADC and Gateway appliances.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-119\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **EPSS Score**: 0.00276\n- **Impact**: Denial of Service / High Availability Failover Loop\n- **Exploit Status**: active\n- **KEV Status**: Listed\n\n## Affected Systems\n\n- Citrix NetScaler ADC\n- Citrix NetScaler Gateway\n- **NetScaler ADC**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler Gateway**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler ADC**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n- **NetScaler Gateway**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n\n## Mitigation\n\n- Apply security patches immediately to NetScaler appliances\n- Deploy temporary responder policies bound to AAA_REQUEST\n- Apply latest Application Firewall signature updates via NetScaler Console\n\n**Remediation Steps:**\n1. Verify if SAML is active using the command 'show authentication samlAction'\n2. If vulnerable, download firmware build 14.1-73.41 or 13.1-64.28\n3. Install the updated firmware according to Citrix deployment guidelines\n4. Verify that the nsaaad daemon is stable and no core dumps are generated\n\n## References\n\n- [Citrix Security Bulletin CTX697174](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174)\n- [Citrix Tech Zone Security Blog](https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/)\n- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779)\n- [Thomas Poppelgaard NetScaler Checker](https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker)\n- [Orjan Johansen NetScaler Threat Hunt Helper](https://github.com/orjanj/netscaler_threat_hunt_helper)\n- [Technical Background Blog & Remediation Guide](https://www.poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88779) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-05T10:00:30.000000Z"}, {"uuid": "f9198f07-41ff-45fb-bee1-9c928e44e1e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx4okcfb2q2f", "content": "CISA\u3001\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3066\u3044\u308bCitrix NetScaler\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u8b66\u544a\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001Citrix NetScaler\u306e\u6df1\u523b\u306a\u8106\u5f31\u6027\u300cCVE-2026-88779\u300d\u306b\u3064\u3044\u3066\u3001\u60aa\u7528\u306e\u8a3c\u62e0\u3092\u78ba\u8a8d\u3057\u305f\u3068\u3057\u3066\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u3001Citrix NetScaler ADC\uff08\u65e7Citrix", "creation_timestamp": "2026-10-05T10:13:02.972656Z"}, {"uuid": "de409322-77b5-4541-bf10-eaee77989fdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-04)", "content": "", "creation_timestamp": "2026-10-04T00:00:00.000000Z"}, {"uuid": "f983837a-b8cd-4c8e-a7bd-ffd596143278", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx4qwq5g4x2i", "content": "CISA\u3001Citrix NetScaler\u306e\u8106\u5f31\u6027\u3092\u60aa\u7528\u78ba\u8a8d\u3068\u3057\u3066\u8b66\u544a\u3000\u653b\u6483\u304c\u7d99\u7d9a\u4e2d\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001Citrix NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3059\u91cd\u5927\u5ea6\u300c\u9ad8\u300d\u306e\u8106\u5f31\u6027\u300cCVE-2026-88779\u300d\u3092\u3001\u60aa\u7528\u306e\u8a3c\u62e0\u304c\u78ba\u8a8d\u3055\u308c\u305f\u3068\u3057\u3066\u300c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u300d\u306b\u8ffd\u52a0", "creation_timestamp": "2026-10-05T10:55:47.142083Z"}, {"uuid": "0f468db8-f500-4952-888b-7e0e79e2f56e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/stiffeo.bsky.social/post/3mx4r23hu2s22", "content": "\ud83d\udea8 If you are not patching your Netscalers today then what are you doing?!\nCheck out CVE-2026-88771.\n\nCHECK YOUR LOGG FOR TRAFFIC GOING TO 213.209.159.55.\n\n#CyberSEC", "creation_timestamp": "2026-10-05T10:57:39.642851Z"}, {"uuid": "b529028b-11f7-4199-b51e-4447e3acb077", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/kelvinsecteam.bsky.social/post/3mx4tcw2wpx2o", "content": "CISA has added CVE-2026-88779 to its Known Exploited Vulnerabilities Catalog, citing active exploitation of a high-severity memory buffer flaw in Citrix NetScaler ADC and Gateway appliances. The listing follows reporting from GBHackers regarding ongoing attacks. #CyberSecurity", "creation_timestamp": "2026-10-05T11:38:24.402934Z"}, {"uuid": "12b7e6cb-4ae8-48de-bb04-02d9dd87112f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-996", "content": "", "creation_timestamp": "2026-10-05T04:45:18.000000Z"}, {"uuid": "d811d966-a15b-4e1a-815a-8ea54b9c6b02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znvxibs2u", "content": "[1/3] NetScaler ADC/Gateway CVE-2026-88779 (CVSS 8.7): zero-day sfruttato, in CISA KEV dal 4/10, deadline FCEB 7/10. Memory overflow nel flusso SAML; Citrix lo d\u00e0 come DoS, ma su honeypot patchati si vede attivit\u00e0 compatibile con RCE (non confermato). #infosec", "creation_timestamp": "2026-10-05T13:31:55.075910Z"}, {"uuid": "5c4ff0ef-7dca-4cc4-b966-7d2152d7efd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znvxibs2u", "content": "[3/3] Citrix ha pubblicato una deny list di IP. Nel 2026 \u00e8 la sesta NetScaler in KEV, dopo CVE-2026-88771/88772. Advisory: support.citrix.com/support-home...", "creation_timestamp": "2026-10-05T13:31:55.524954Z"}, {"uuid": "0bee1c58-4cf0-4b53-9140-bed4d3d5e60c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rc2u", "content": "[1/3] NetScaler ADC/Gateway CVE-2026-88779 (CVSS 8.7): zero-day sfruttato, in CISA KEV dal 4/10, deadline FCEB 7/10. Memory overflow nel flusso SAML; Citrix lo d\u00e0 come DoS, ma su honeypot patchati si vede attivit\u00e0 compatibile con RCE (non confermato). #infosec", "creation_timestamp": "2026-10-05T13:31:55.970288Z"}, {"uuid": "a9e349e7-1d82-425d-9ef2-cc2521a0bc1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rc2u", "content": "[3/3] Citrix ha pubblicato una deny list di IP. Nel 2026 \u00e8 la sesta NetScaler in KEV, dopo CVE-2026-88771/88772. Advisory: support.citrix.com/support-home...", "creation_timestamp": "2026-10-05T13:31:56.431745Z"}, {"uuid": "106b1d8a-e06e-4b83-8ca3-dd3695b7b401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx4zrbc6up2i", "content": "Citrix NetScaler\u3001\u65b0\u305f\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3067\u6a19\u7684\u578b\u653b\u6483\u3092\u53d7\u3051\u308b\n\nCitrix\u306f\u3001\u65b0\u305f\u306a\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u305f\u300c\u6a19\u7684\u578b\u653b\u6483\u300d\u304cNetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u5bfe\u3057\u3066\u78ba\u8a8d\u3055\u308c\u305f\u3068\u3057\u3066\u3001\u6ce8\u610f\u3092\u547c\u3073\u304b\u3051\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u8106\u5f31\u6027\u3092\u7a81\u304b\u308c\u308b\u3068\u3001\u5229\u7528\u4f01\u696d\u304c\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\uff08DoS\uff09\u306b\u9665\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002 \u6df1\u523b\u5ea6\u300c\u9ad8\u300d\u306e\u8106\u5f31\u6027\u300cCVE-2026-88779\u300d\u306f", "creation_timestamp": "2026-10-05T13:33:47.250908Z"}, {"uuid": "00ffa736-eae3-4f31-b8f6-4ae7292cfb6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rd2u", "content": "[1/3] NetScaler ADC/Gateway CVE-2026-88779 (CVSS 8.7): zero-day sfruttato, in CISA KEV dal 4/10, deadline FCEB 7/10. Memory overflow nel flusso SAML; Citrix lo d\u00e0 come DoS, ma su honeypot patchati si vede attivit\u00e0 compatibile con RCE (non confermato). #infosec", "creation_timestamp": "2026-10-05T13:31:56.876347Z"}, {"uuid": "cf34f4da-c9fa-43a1-99a8-8871498c2d7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rd2u", "content": "[3/3] Citrix ha pubblicato una deny list di IP. Nel 2026 \u00e8 la sesta NetScaler in KEV, dopo CVE-2026-88771/88772. Advisory: support.citrix.com/support-home...", "creation_timestamp": "2026-10-05T13:31:58.009976Z"}, {"uuid": "979d0dfa-2f91-449f-a49d-a97edefaa95c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mx4zymxqw327", "content": "TheCyberMind.co\u2122 Survival Series \u2014Part\u00a04\n\nCISA added CVE-2026-88779 affecting Citrix NetScaler ADC and Gateway to the KEV catalog. This Cyber Mind\u2122 Survival Series article explains why gateway downtime is more than a technical issue \u2014 it is a business continuity and\u2026\n\nhttps://thecybermind.co/3is1", "creation_timestamp": "2026-10-05T13:37:55.086503Z"}, {"uuid": "a21c487c-6345-4659-9921-46853e7a5bc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mx524khnyy2i", "content": "\ud83d\udd17 CVE : CVE-2026-88779", "creation_timestamp": "2026-10-05T13:40:05.939087Z"}, {"uuid": "c99be31b-4555-4e51-a0dd-b4ec3fd668c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mx52lvb3um2y", "content": "Citrix NetScaler customers report repeated reboots after installing emergency update 14.1-73.37, addressing two zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772). The reboots are linked to crafted SAML traffic crashing the nsaaad service.", "creation_timestamp": "2026-10-05T13:48:41.072421Z"}, {"uuid": "9a103e0a-090d-4100-b0d7-af54591287eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mx52lvb3um2y", "content": "Citrix NetScaler customers report repeated reboots after installing emergency update 14.1-73.37, addressing two zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772). The reboots are linked to crafted SAML traffic crashing the nsaaad service.", "creation_timestamp": "2026-10-05T13:48:41.109973Z"}, {"uuid": "484e3bb1-e059-41c8-9bac-91556e8b29aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-8727f951-0951c513f6c535b5", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Citrix NetScaler flaw tracked as CVE-2026-88779 (CVSS score of 8.7), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway [\u2026]U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog - Security Affairs", "creation_timestamp": "2026-10-05T13:49:59.666586Z"}, {"uuid": "617c7328-4f9c-4b25-9be4-0ce57c2b1489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mx52px2hutg2", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Citrix NetScaler flaw tracked as CVE-2026-88779 (CVSS score of 8.7), to its Known [\u2026]", "creation_timestamp": "2026-10-05T13:51:37.665607Z"}, {"uuid": "5cd0fd83-83ee-4a16-b8ef-65734063a65b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "Telegram/M1muP3GX1b_YvDOWwH5HlXJ4xxFQPQ5c5h-0_sjDQeUxBQQ", "content": "", "creation_timestamp": "2026-10-03T09:00:04.000000Z"}, {"uuid": "18c9a1e4-9d08-46f4-82f4-f8e1df15c535", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/kasperskyb2b/2332", "content": "\ud83d\udd25 \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u0418\u0411 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\ude31 \u0410\u043d\u0430\u043b\u0438\u0437 \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0412\u041f\u041e NeedyMantis, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0433\u0440\u0443\u043f\u043f\u043e\u0439 Storm-3069, \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a DAEMON Tools. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0442\u0435\u043b\u0435\u043a\u043e\u043c, \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u044b \u0438 \u0433\u043e\u0441\u043f\u043e\u0434\u0440\u044f\u0434\u0447\u0438\u043a\u043e\u0432. \n\n\ud83d\udfe2\u0420\u0430\u0437\u0431\u043e\u0440 TTPs UAT-11587 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 Antino. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u0431\u044b\u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0432 \u0432\u043e\u0441\u044c\u043c\u0438 \u0441\u0442\u0440\u0430\u043d\u0430\u0445,  \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0422\u0430\u0439\u0432\u0430\u043d\u044c, \u0418\u043d\u0434\u0438\u044e, \u0424\u0438\u043b\u0438\u043f\u043f\u0438\u043d\u044b \u0438 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d. \u0411\u044d\u043a\u0434\u043e\u0440 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 Rust \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 OneDrive \u0438 Outlook \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 C2. \n\n\ud83d\udfe2\u041d\u043e\u0432\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f RedFlick \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 Python-\u0431\u044d\u043a\u0434\u043e\u0440 CosmicPulse \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 (scheduled tasks). \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043e\u0442 \u043f\u0440\u0435\u0436\u043d\u0435\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 ClickFix, \u0447\u0442\u043e\u0431\u044b \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0432\u043e\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\ud83d\udfe2\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 Mimbrob \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0435 \u0438 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 DLL Sideloading \u043d\u0430 \u0431\u0430\u0437\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Yandex Browser \u0438 Notepad++. \u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0412\u041f\u041e FBULoader \u0438 RAT-Go.  \n\n\ud83d\udd35\u0412\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 DragonForce \u0432\u0437\u044f\u043b\u0430 \u043d\u0430 \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0434\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0442 C2-\u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 TURN \u0438 MQTT. \n\n\ud83d\udd35\u0420\u0430\u0437\u0431\u043e\u0440 Linux-\u0412\u041f\u041e JITTERLY \u0438 \u0440\u0443\u0442\u043a\u0438\u0442\u0430 SIXZUT, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u044b Red Heron, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Gitea. \u0410\u0442\u0430\u043a\u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u042e\u0412\u0410 \u0438 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435, \u0446\u0435\u043b\u044c\u044e, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u044b\u043b \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u0434\u0430\u043d\u043d\u044b\u0445. \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u0445\u0438\u0442\u0438\u043b\u0438 $388 \u043c\u043b\u043d \u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0431\u0438\u0440\u0436\u0438 Bitget, \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c \u0418\u0411-\u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0432 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0432\u044b\u0432\u043e\u0434 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432 \u0431\u044d\u043a\u0435\u043d\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \n\n\ud83d\udfe3\u0421\u0442\u0438\u043b\u0435\u0440\u044b, \u043f\u0440\u043e\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043d\u0430 \u043f\u043e\u0434\u043f\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Bee Stealer \u0438 AVENGER \u0434\u043b\u044f macOS, \u0442\u0435\u043f\u0435\u0440\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 LLM \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432 \u043f\u043e \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u0438, \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0430\u043c, \u043c\u0435\u0441\u0442\u0443 \u0440\u0430\u0431\u043e\u0442\u044b, \u0431\u0430\u043d\u043a\u0430\u043c \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0430\u043a\u0442\u0438\u0432\u0430\u043c. \n\n\ud83d\udfe3\u0410\u043d\u0430\u043b\u0438\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0433\u0434\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0443 ChatGPT \u0432\u0435\u043b\u0438 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 Custom GPT \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u0434\u043e\u043c\u0435\u043d\u0435 chatgpt[.]com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 ClickFix \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0412\u041f\u041e. \n\n\ud83d\udd35\u0420\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u044e\u0436\u0435\u0442 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0437\u0438\u0440\u043e\u0434\u0435\u044f \u0432 Citrix NetScaler ADC \u0438 Gateway (CVE-2026-88771 \u0438 -88772),  \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0437 \u0433\u043e\u0441\u0441\u0435\u043a\u0442\u043e\u0440\u0430, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0444\u0435\u0440 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0412 \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b WHIPSHOT \u0438 \u0412\u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f SLAPSHOT.\n\n\ud83d\udd35Cisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f CVE-2026-76504 (CVSS 9.8) \u2014 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Catalyst SD-WAN Manager, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0451\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 CVE-2026-73570 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Zimbra Collaboration Suite, \u0437\u0430\u043a\u0440\u044b\u0442\u0443\u044e \u0435\u0449\u0451 \u0432 \u0438\u044e\u043b\u0435) \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432, \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0447\u0442\u044b. \n\n\ud83d\udd34TeamViewer \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 15.82. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u2014 CVE-2026-92370 (CVSS 8.8), \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0441\u0441\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE. \n\n#APT #\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 @\u041f2\u0422", "creation_timestamp": "2026-10-05T12:05:44.000000Z"}, {"uuid": "b8789232-66a0-49fc-b0f6-e4cc3340731d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/information_security_channel/56040", "content": "Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier\nhttps://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/\n\nCitrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.\nThe post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier (https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-10-05T11:15:05.000000Z"}, {"uuid": "7904aa33-64ab-4906-8ccf-1b74156b2ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mx53flcjih2i", "content": "NetScaler CVE-2026-88779 is under active attack\u2014patch by Oct 7 or mitigate remote access exposure. #NetScaler #CVE2026-88779 #Cybersecurity #Vulnerability #PatchNow #CISA #EdgeSecurity #InfoSec https://thedailytechfeed.com/urgent-patch-alert-netscaler-flaw-cve-2026-88779-actively-attacked/", "creation_timestamp": "2026-10-05T14:03:03.224215Z"}, {"uuid": "2ee60df8-7550-43e1-b80b-4c30aa7e0142", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117388754453377891", "content": "\ud83d\udcf0 Citrix Patches Critical NetScaler Zero-Day Under Active Attack\nCitrix patches critical zero-day (CVE-2026-88779) in NetScaler ADC & Gateway under active attack. The flaw can cause DoS & potential RCE. CISA added it to its KEV catalog, mandating federal agencies to patch by Oct 7. #NetScaler #ZeroDay #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-10-05T14:24:06.748781Z"}, {"uuid": "e4c57ba6-7456-434b-a9e1-164e78ce5ee9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mx54lsavxx24", "content": "Citrix patches critical zero-day (CVE-2026-88779) in NetScaler ADC & Gateway under active attack. The flaw can cause DoS & potential RCE. CISA added it to its KEV catalog, mandating federal agencies to patch by Oct 7. #NetScaler #ZeroDay #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-05T14:24:25.928577Z"}, {"uuid": "dc744bc4-86c7-459e-b177-0b7b18fc7e3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx56xb5onn2w", "content": "CISA\u3001\u653b\u6483\u8005\u306b\u3088\u308b\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u505c\u6b62\u3092\u62db\u304f\u65b0\u305f\u306aNetScaler\u8106\u5f31\u6027\u3092\u60aa\u7528\u78ba\u8a8d\u3068\u3057\u3066\u8b66\u544a\uff08CVE-2026-88779\uff09\n\nCISA\u306f\u65e5\u66dc\u65e5\u3001Citrix NetScaler\u306e\u5225\u306e\u8106\u5f31\u6027\u300cCVE-2026-88779\u300d\u3092\u300c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u300d\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u8106\u5f31\u6027\u306f\u30e1\u30e2\u30ea\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc\u306e\u30d0\u30b0\u3067\u3001\u8106\u5f31\u306aNetScaler ADC\u3084Gateway\u3092\u6a5f\u80fd\u4e0d\u5168\u306b\u9665\u308c\u308b\u6050\u308c\u304c\u3042\u308a\u307e\u3059\u3002 \u30d9\u30f3\u30c0\u30fc\u306f\u58f0\u660e\u3067\u3001\u6b21", "creation_timestamp": "2026-10-05T15:06:37.278863Z"}, {"uuid": "55143202-1244-4b4f-a41f-1a05041042a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://t.me/bdufstecru/3502", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 NetScaler ADC (\u0440\u0430\u043d\u0435\u0435 Citrix ADC) \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 NetScaler Gateway (\u0440\u0430\u043d\u0435\u0435 Citrix Gateway) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-15858\nCVE-2026-88779\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174", "creation_timestamp": "2026-10-05T14:40:03.000000Z"}, {"uuid": "6845e127-0857-4b4e-b663-26334325c0b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hasamba72.bsky.social/post/3mx56whqyv72b", "content": "Get-NetScalerTimeline parses NetScaler VMDK images into a UFS file timeline, pulls ns.log and httpaccess logs with SHA256, flags fake pitboss heartbeats tied to log poisoning (CVE-2026-88771). #DFIR #tool #NetScaler https://github.com/LETHAL-FORENSICS/Get-NetScalerTimeline", "creation_timestamp": "2026-10-05T15:06:10.896511Z"}, {"uuid": "410ae385-4e67-4ee3-b127-cb1afb55dcd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mx6bftuwv22k", "content": "Monday's fuck up - Now and again great Citrix - Citrix NetScaler PreAuth Command Injection\nCVE-2026-88771 Improper input validation leading to RCE in a default NetScaler configuration, with no additional product features required.\ngithub.com/watchtowrlab... #redteam #critical #citrix #cve-2026-88771", "creation_timestamp": "2026-10-05T15:23:26.587573Z"}, {"uuid": "c2e64a74-31d8-449f-9e9c-416f45475196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mx5bgqg4jy27", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-88779 \u2013 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer\u00a0Vulnerability\n\nImmediate CISA KEV threat advisory for CVE-2026-88779 affecting Citrix NetScaler. Includes executive risk\u2026\n\nhttps://thecybermind.co/bl05", "creation_timestamp": "2026-10-05T15:51:05.092986Z"}, {"uuid": "feb06e57-db2a-40f3-995b-6daec5c0215a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mx5bizewbb2h", "content": "(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-88779 \u2013 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer\u00a0Vulnerability\n\nImmediate CISA KEV threat advisory for CVE-2026-88779 affecting Citrix NetScaler. Includes SAML exposure\u2026\n\nhttps://thecybermind.co/0b64", "creation_timestamp": "2026-10-05T15:52:21.275226Z"}, {"uuid": "11d1d92c-2951-4b24-a09a-b5f731765da0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mx5bxha4mz2y", "content": "CISA added CVE-2026-88779 to its exploited vulns list after targeted attacks crashed Citrix NetScaler appliances, causing denial of service. The flaw hits on-prem SAML Gateway and AAA deployments. #Citrix #NetScaler #CISA", "creation_timestamp": "2026-10-05T16:00:24.703010Z"}, {"uuid": "2b2bf5d2-ce15-4f62-af7d-7c9291858062", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mx5cfk75ju23", "content": "~Checkpoint~\nActive exploitation, ransomware, phishing, AI-enabled attacks and major breaches reported.\n-\nIOCs: CVE-2026-76504, CVE-2026-88771, CVE-2026-90970\n-\n#CVE #Ransomware #ThreatIntel", "creation_timestamp": "2026-10-05T16:08:18.527406Z"}, {"uuid": "a84264f3-948a-4ca9-a58a-f0bc318eadef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mx5ct2ofjp2u", "content": "\ud83d\udce1 Citrix NetScaler Zero-Days (CVE-2026-88771 and CVE-2026-88772): A Skeleton Key at the Network Edge", "creation_timestamp": "2026-10-05T16:15:51.293786Z"}, {"uuid": "961e7479-ab4e-457f-9ef7-c39983080097", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mx5ct2ofjp2u", "content": "\ud83d\udce1 Citrix NetScaler Zero-Days (CVE-2026-88771 and CVE-2026-88772): A Skeleton Key at the Network Edge", "creation_timestamp": "2026-10-05T16:15:51.336989Z"}, {"uuid": "66b14ec2-2ba3-4120-8f40-0b50f3183aaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mx5ctagioy23", "content": "@sophossecurity.bsky.social\nUnpatched NetScaler appliances face active exploitation causing denial of service.\n-\nIOCs: CVE-2026-88779\n-\n#CVE-2026-88779 #NetScaler #ThreatIntel", "creation_timestamp": "2026-10-05T16:15:57.516874Z"}, {"uuid": "182e0265-895d-49bf-821e-d64eb815b7bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mx5g4dydms2v", "content": "CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)\n\nwww.helpnetsecurity.com/2026/10/05/c...\n\n#Kyberturvallisuus #LaajaVaikutus #Haavoittuvuus", "creation_timestamp": "2026-10-05T17:14:45.955172Z"}, {"uuid": "7cfaff49-5ab0-4ff0-ba2a-148a6dfc2303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "MISP/8561728f-95b4-45be-97b4-a3adfc049ebe", "content": "", "creation_timestamp": "2026-10-05T14:36:15.000000Z"}, {"uuid": "d20cee01-0b10-4ae2-9332-8fe88c4a9480", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88773", "type": "published-proof-of-concept", "source": "Telegram/M1muP3GX1b_YvDOWwH5HlXJ4xxFQPQ5c5h-0_sjDQeUxBQQ", "content": "", "creation_timestamp": "2026-10-03T09:00:04.000000Z"}, {"uuid": "cd1ac6cd-1b59-4aaf-93e5-7b2bd6cfddfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/youranonirc.bsky.social/post/3mx5njdeqk425", "content": "SITREP: Critical Citrix NetScaler zero-day (CVE-2026-88779) exploited. Alleged ShinyHunters leader nabbed. Iranian-linked ops target US water. Maintain OpSec. #Cybersecurity #Anonymous #News", "creation_timestamp": "2026-10-05T19:27:15.945766Z"}, {"uuid": "f17ead97-11c0-474f-9307-e74b75f4fec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mx5nkvwvkc24", "content": "Citrix patches NetScaler SAML zero-day exploited in attacks\n\nCitrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be e\u2026\n#hackernews #ml #news", "creation_timestamp": "2026-10-05T19:28:09.005454Z"}, {"uuid": "484c82fb-ced9-4e19-ad32-cc83bb315aea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/yasna.io/post/3mx5pq7lbsx2l", "content": "Citrix patched a critical zero-day in NetScaler causing denial-of-service attacks, actively exploited and posing risks to government and enterprise systems.\n\nCVE-2026-88779 #Vulnerability #ZeroDay #infosec\n\nFull synthesis & sources: yasna.io", "creation_timestamp": "2026-10-05T20:06:54.945827Z"}, {"uuid": "b932b1e1-15bd-4270-96de-0e3202200b7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mx5qzx3z7c22", "content": "NetScaler: CVE-2026-88779, a DoS flaw in SAML deployments, is Citrix's third zero-day patch in two weeks. Now in CISA KEV \u2014 federal deadline Oct 7. #infosec https://0daynews.com/articles/2026-10-05-citrix-netscaler-cve-2026-88779-saml-zero-day/", "creation_timestamp": "2026-10-05T20:30:15.455024Z"}, {"uuid": "c3f3d6f3-0325-4920-a29e-e4e6f31e1675", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/densuke.bsky.social/post/3mx5wdjivjf2n", "content": "\u66f4\u65b0\u3055\u308c\u305f\u3088\u3001\u898b\u306b\u6765\u3066\u306d!\u2192 \n\n\u76f4\u3057\u305f\u306f\u305a\u304c\u3001\u6b21\u306e\u7a74\u306b\uff1f Debian DSA-6528-1\u30fbCitrix NetScaler CVE-2026-88779\u30fbWine 11.19\u30fbKDE Plasma 6.8\u30fbUbuntu 26.10 uutils\uff082026/10/6 Linux\u30fbOSS\u30c8\u30ec\u30f3\u30c9\uff09 https://blog.fuga.jp/posts/2026-10-06-linux-oss-trend/", "creation_timestamp": "2026-10-05T22:05:06.644149Z"}, {"uuid": "120d7af2-e3b7-4eb0-83fc-5d81204216c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://bsky.app/profile/norviktech.bsky.social/post/3mx5weialzn2a", "content": "La vulnerabilidad CVE-2026-88779 se refiere a un desbordamiento de memoria en el manejador SAML de Citrix NetScaler, un componente cr\u00edtico utilizado para la autenticaci\u00f3n y autorizaci\u00f3n en aplicaciones web.\n\nhttps://norvik.tech/news/cve-2026-88779-analisis-citrix-netscaler", "creation_timestamp": "2026-10-05T22:05:37.524421Z"}, {"uuid": "c35fd512-eb1a-4c37-bc70-aae2909ab7de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88779", "type": "seen", "source": "https://infosec.exchange/users/securestep9/statuses/117390624752877735", "content": "#Citrix: A third #NetScaler #zeroday is being exploited days after admins patched two earlier flaws. CVE-2026-88779 remotely crashes SAML-enabled appliances. Install 14.1-73.41/13.1-64.28+, preserve evidence and investigate unexpected reboots:\ud83d\udc47https://socprime.com/blog/cve-2026-88779-citrix-netscaler-zero-day-exploited-against-saml-deployments/", "creation_timestamp": "2026-10-05T22:19:41.499637Z"}, {"uuid": "51e61831-07eb-462f-9cbe-00ad38e01023", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mx5x5ojyq32i", "content": "#Citrix: A third #NetScaler #zeroday is being exploited days after admins patched two earlier flaws. CVE-2026-88779 remotely crashes SAML-enabled appliances. Install 14.1-73.41/13.1-64.28+, preserve evidence and investigate unexpected reboots:\n\ud83d\udc47", "creation_timestamp": "2026-10-05T22:19:42.837292Z"}, {"uuid": "4aee31ec-4aa3-425f-913a-9ec372c408db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mx62n36sjd2w", "content": "Citrix\u30011\u9031\u9593\u8db3\u3089\u305a\u30673\u4ef6\u76ee\u3068\u306a\u308b\u60aa\u7528\u4e2d\u306eNetScaler\u30bc\u30ed\u30c7\u30a4\u3092\u516c\u8868\n\nCitrix\u306e\u9867\u5ba2\u306f\u30012\u9031\u672b\u7d9a\u3051\u3066\u4e0d\u5b89\u3068\u61f8\u5ff5\u306b\u63fa\u308c\u308b\u9031\u672b\u3092\u904e\u3054\u3057\u307e\u3057\u305f\u3002Citrix NetScaler\u88fd\u54c1\u3067\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u30bc\u30ed\u30c7\u30a4\u8106\u5f31\u6027\u304c\u307e\u305f\u65b0\u305f\u306b\u898b\u3064\u304b\u3063\u305f\u305f\u3081\u3067\u3059\u3002 \u7814\u7a76\u8005\u3084\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c02\u9580\u5bb6\u306b\u3088\u308b\u3068\u3001\u3053\u306e\u8106\u5f31\u6027\u300cCVE-2026-88779\u300d\u306f\u3001\u60aa\u7528\u3055\u308c\u308b\u3068\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\uff08DoS\uff09\u304c\u767a\u751f\u3059\u308b\u70b9\u3068\u3001SAML\uff08", "creation_timestamp": "2026-10-05T23:22:00.103530Z"}, {"uuid": "68de5331-75c9-4eb8-9d71-365b1e0ff878", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mx633zt5jd2m", "content": "Nieuwe Citrix NetScaler Zero-Day Ontdekt na Reeks Kwetsbaarheden\n\nOp vrijdag 2 oktober 2026 is een zero-day kwetsbaarheid, aangeduid als CVE-2026-88779, ontdekt in Citrix NetScaler producten. Dit is de derde publiekelijk ge\u00ebxploiteerde NetScaler zero-day kwetsbaarheid binnen ...", "creation_timestamp": "2026-10-05T23:30:22.572913Z"}, {"uuid": "52fd542b-d229-45a5-9ce6-45e8c129ef17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://t.me/VulnerabilityNews/44773", "content": "Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier\n\nCitrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.\nThe post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek.\nhttps://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/", "creation_timestamp": "2026-10-05T23:01:05.000000Z"}, {"uuid": "6dbb197f-3fe0-43f8-a3e9-a143d727c3dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mx67camdpm2r", "content": "Citrix disclosed CVE-2026-88779, an actively exploited NetScaler zero-day affecting SAML-enabled setups. The flaw mainly causes denial of service, and CISA added it to the KEV catalog. #Citrix #NetScaler #CISA", "creation_timestamp": "2026-10-06T00:45:26.020453Z"}, {"uuid": "38ea4540-9af5-42b5-85f6-9c625f0a19d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44773", "content": "Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier\n\nCitrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.\nThe post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek.\nhttps://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/", "creation_timestamp": "2026-10-05T23:01:05.000000Z"}, {"uuid": "8d0f3017-374b-49fd-83f9-d3217bc0bdf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mx6a5air2r2v", "content": "US and Australia warn of active exploitation of Citrix NetScaler CVE-2026-88779, which can crash appliances and cause DoS. CISA urges patching as exposure grows. #Citrix #NetScaler #Australia", "creation_timestamp": "2026-10-06T01:00:31.992863Z"}, {"uuid": "98f3e2c3-58c4-4d81-ae68-d4b2be1073aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mx6bssr2kb2a", "content": "\ud83d\udce2 Citrix NetScaler : CVE-2026-88771 \u00e0 88779 exploit\u00e9es, checker IoC open-source publi\u00e9\n\nCet outil est un script POSIX shell en lecture seule destin\u00e9 \u00e0 v\u00e9rifier l'exposition et la compromission des appliances\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#CitrixNetScaler #CtxsReceiverWebshell #Cyberveille", "creation_timestamp": "2026-10-06T01:30:28.736795Z"}, {"uuid": "afd562ab-b6c9-485d-a0fc-fed8100fc6c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mx6ducyptd26", "content": "\ud83d\udccc CVE-2026-88779 - Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and befor... https://www.cyberhub.blog/cves/CVE-2026-88779", "creation_timestamp": "2026-10-06T02:07:07.565173Z"}, {"uuid": "1192ae99-accc-4c3a-92e2-ccb3badf0da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mx6glcrqq42i", "content": "The latest update for #Sophos includes \"Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation\" and \"Sophos Named a Leader in the #IDC MarketScape for Worldwide Modern #EndpointSecurity for Enterprises 2026\".\n \n#cybersecurity #antivirus #malware https://opsmtrs.com/487u2e2", "creation_timestamp": "2026-10-06T02:55:46.067422Z"}, {"uuid": "2d88454a-9f66-4f3f-bf72-666d34314ef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mx6k743q4w2j", "content": "BREAKING: Citrix NetScaler zero-day CVE-2026-88779 (CVSS 8.7) exploited in targeted attacks \u2014 SAML deployments knocked offline. CISA added to KEV, patch by Oct 7. (The Hacker News)", "creation_timestamp": "2026-10-06T04:00:31.129621Z"}, {"uuid": "3a5bda45-2d87-4fb2-a772-95de57f1cd24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mx6n3mu3tc2i", "content": "CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)\uff08CISA\u3001\u60aa\u7528\u78ba\u8a8d\u6e08\u307fNetScaler\u8106\u5f31\u6027\u3092\u8b66\u544a\u2015\u653b\u6483\u8005\u304c\u30a2\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u3092\u30af\u30e9\u30c3\u30b7\u30e5\uff09 #HelpNetSecurity \uff08Oct 5\uff09 \nwww.helpnetsecurity.com/2026/10/05/c...", "creation_timestamp": "2026-10-06T04:52:16.257496Z"}, {"uuid": "5ce8c829-c736-41cc-95e5-f1551bdb3016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mx6pwf43sm2g", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) \u00b7 4\n\u2022 Citrix NetScaler (CVE-2026-88771), CVSS 9.5 \ud83d\udd34 (Semaine 40, CVE les plus\u2026)\n\u2022 GitLab AI Gateway (CVE-2026-90970), CVSS 9.9 (GitLab AI)\n\u2022 MikroTik RouterOS (CVE-2026-84411), CVSS 9.3 (MikroTik)\nhttps://www.cybowl.eu/cyber/blog_2026-10-05", "creation_timestamp": "2026-10-06T05:43:00.949259Z"}, {"uuid": "f76d6c91-6e6e-49cd-a944-32f77003e70d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/infosec_ita_notizie/4264", "content": "\u2615 CYBERBRIEFING \u2014 Marted\u00ec 6 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Marted\u00ec 6 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. IN PRIMO PIANO Gli aggressori stanno sfruttando attivamente una falla zero-day nei gateway Citrix NetScaler ADC e NetScaler Gateway (CVE-2026-88779, gravit\u00e0 8,7/10) che permette l'esecuzion\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-06\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-10-06T06:30:56.000000Z"}, {"uuid": "a757481d-888b-4978-a92d-8a97c8fd1a91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mx6xljeaao2o", "content": "BREAKING: Citrix NetScaler zero-day CVE-2026-88779 (CVSS 8.7) exploited in targeted attacks \u2014 SAML deployments knocked offline. CISA added to KEV, patch by Oct 7. (The Hacker News)", "creation_timestamp": "2026-10-06T08:00:06.512330Z"}, {"uuid": "e0737677-0aed-489b-a268-697a3de8a7af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx6xths6tr2u", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88772: 57 interactions\nCVE-2026-88771: 52 interactions\nCVE-2026-104286: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 12 interactions\nCVE-2026-17989: 7 interactions\nCVE-2026-19556: 7 interactions\n", "creation_timestamp": "2026-10-06T08:04:34.682546Z"}, {"uuid": "3d512d8c-0a38-4b94-8b4d-c061456414fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx6xths6tr2u", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88772: 57 interactions\nCVE-2026-88771: 52 interactions\nCVE-2026-104286: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 12 interactions\nCVE-2026-17989: 7 interactions\nCVE-2026-19556: 7 interactions\n", "creation_timestamp": "2026-10-06T08:04:34.728323Z"}, {"uuid": "69a25c1c-c470-4bc1-a6dd-c400609daebb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx6xths6tr2u", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88772: 57 interactions\nCVE-2026-88771: 52 interactions\nCVE-2026-104286: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 12 interactions\nCVE-2026-17989: 7 interactions\nCVE-2026-19556: 7 interactions\n", "creation_timestamp": "2026-10-06T08:04:34.794731Z"}, {"uuid": "e56b5e2f-44b6-47ae-8ef0-68ab18814b33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mx6y7j6bzl2i", "content": "COGNOSCERE Tech Brief \u2014 2026-10-06\n\nCitrix released an emergency fix for CVE-2026-88779, the third actively exploite\n\nhttps://youtube.com/watch?v=ugSEVgrBd40\n\nhttps://www.cognoscerellc.com/news", "creation_timestamp": "2026-10-06T08:11:19.789719Z"}, {"uuid": "b3facd86-4cf5-417d-b051-3a50d5d4c505", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mx6zc3iqln2s", "content": "\ud83d\udce2 \u26a0\ufe0f[VULN] Citrix NetScaler - Et c'est reparti pour un patch ! - CVE-2026-88779\n\n1) Citrix publie un correctif pour la CVE-2026-88779 sur NetScaler, activement exploit\u00e9e et touchant m\u00eame les appliances d\u00e9j\u00e0 patch\u00e9es contre PitScaler si elles utilisent SAML 2) Citrix parle d'un\u2026\n\n#CVE #Cyberveille", "creation_timestamp": "2026-10-06T08:30:37.520579Z"}, {"uuid": "10683ac5-df02-47a3-8671-f845e914ca9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx72ajepo22p", "content": "\ud83d\udd34 Citrix NetScaler CVE-2026-88779 \u2014 active exploitation confirmed\nRemote unauthenticated memory overflow targets NetScaler ADC/Gateway systems using SAML and can cause denial of service. CISA added the flaw to KE\nstemshop.top/blog/netscal...\n#CVE #CVE202688779 #Citrix #NetScaler #SAML #CyberSecurity", "creation_timestamp": "2026-10-06T08:47:53.759224Z"}, {"uuid": "1120c4b7-c541-4330-a8b5-916cf6a29011", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-05)", "content": "", "creation_timestamp": "2026-10-05T00:00:00.000000Z"}, {"uuid": "10e5e2b3-17cc-4b85-b3b9-9e32780e8dc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/johonotodai.bsky.social/post/3mx7fltuqla2d", "content": "NetScaler CVE-2026-88779\u3001\u524d\u56de\u30d1\u30c3\u30c1\u9069\u7528\u6e08\u307f\u3067\u3082SAML\u74b0\u5883\u306f\u518d\u66f4\u65b0\u304c\u5fc5\u8981", "creation_timestamp": "2026-10-06T12:10:50.440600Z"}, {"uuid": "f932dc4d-129e-4bca-aa1e-831afe5e0c8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mx7hi5sguk2k", "content": "The new vuln, CVE-2026-88779, is a memory overflow bug that leads to denial of service. www.theregister.com/security/202...", "creation_timestamp": "2026-10-06T12:44:35.149974Z"}, {"uuid": "a44a7130-8c0e-4800-b612-5554e7444f1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/tp-security.bsky.social/post/3mx7kk7dyi22y", "content": "Third exploited NetScaler flaw in about a week: CVE-2026-88779 hits SAML-enabled appliances (CISA deadline Oct 7). Also: critical Atlassian Data Center bug, Denmark's 8.8M-person CPR breach, UIC ransomware.\n\ntp-security.com/news/cyber-b...", "creation_timestamp": "2026-10-06T13:39:24.489837Z"}, {"uuid": "abb11f10-4e23-4242-89db-742560e3f274", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/theravenfile.bsky.social/post/3mx7kv34hsk2z", "content": "Today, I just dropped an article which might be useful while hunting ongoing #0day #exploit of #citrix #netscalar!\n\ntheravenfile.com/2026/10/06/cit\nrix-0-day-exploits-cve-2026-88771-cve-2026-88772-in-the-wild/\n\n#ZeroDay #Malware #Slapshot #Whipshot #Python #infosec #security #OSINT #ThreatIntel #CVE", "creation_timestamp": "2026-10-06T13:45:12.082344Z"}, {"uuid": "0a274de9-3a2f-43d3-8e77-e45a20547eb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/theravenfile.bsky.social/post/3mx7kv34hsk2z", "content": "Today, I just dropped an article which might be useful while hunting ongoing #0day #exploit of #citrix #netscalar!\n\ntheravenfile.com/2026/10/06/cit\nrix-0-day-exploits-cve-2026-88771-cve-2026-88772-in-the-wild/\n\n#ZeroDay #Malware #Slapshot #Whipshot #Python #infosec #security #OSINT #ThreatIntel #CVE", "creation_timestamp": "2026-10-06T13:45:12.111602Z"}, {"uuid": "b73f0039-febd-4612-b038-7a8823104f6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mx7lpjgwc22f", "content": "BREAKING: Citrix NetScaler zero-day CVE-2026-88779 (CVSS 8.7) exploited in targeted attacks \u2014 SAML deployments knocked offline. CISA added to KEV, patch by Oct 7. (The Hacker News)", "creation_timestamp": "2026-10-06T14:00:15.931488Z"}, {"uuid": "57bc51bc-3538-4b08-8f7c-096a1d398f3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mx7nffzjv72n", "content": "Citrix patches critical zero-day (CVE-2026-88779) in NetScaler ADC & Gateway under active attack. The flaw can cause DoS & potential RCE. CISA added it to its KEV catalog, mandating federal agencies to patch by Oct 7. #NetScaler #ZeroDay #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-10-06T14:30:23.672994Z"}, {"uuid": "6f81c601-f4cb-4967-b277-eca3d92af810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mx7np5e5z3p2", "content": "# **PitScaler: tre zero-day NetScaler sfruttati in una settimana, due gi\u00e0 prima della patch**\n\n\n@informatica\nTra fine settembre e inizio ottobre 2026 Citrix corregge in emergenza tre zero-day critici su NetScaler ADC/Gateway (CVE-2026-88771, 88772, 88779), tutti sfruttati attivamente prima della [\u2026]", "creation_timestamp": "2026-10-06T14:36:03.595601Z"}, {"uuid": "4164e040-72d3-4d04-9461-c030d72b1a23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mx7qnjccrc24", "content": "CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)\n\nCISA has added another Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities catalog on Sunday: CVE-2026-88779, a memory overflow bug that may cripple vulnerable NetScaler ADCs \u2026\n#hackernews #news", "creation_timestamp": "2026-10-06T15:28:38.088982Z"}, {"uuid": "7bacfcc8-a735-47c9-af2f-880215ed664e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/jshannonquest.bsky.social/post/3mx7rmyf26q2s", "content": "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution http://my.sociabble.com/Bav1mJMsqVeD", "creation_timestamp": "2026-10-06T15:46:13.730886Z"}, {"uuid": "2c725cad-acbf-4a1e-a112-8fc14b13b691", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "Telegram/YlJxE1Oi-4xIe5JDAgwywzMiVrGiK-Q58m3Pj7zkxKSoEg", "content": "", "creation_timestamp": "2026-10-05T08:44:16.000000Z"}, {"uuid": "8598b063-71be-4d25-bc64-0f5246f9dfa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mx7xwukoe222", "content": "Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier\n\nCitrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched. www.securityweek.com/exploitation...", "creation_timestamp": "2026-10-06T17:39:09.689070Z"}, {"uuid": "92b3594e-9dfc-47ed-afd1-8ff904a45f7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/cybereyeq.bsky.social/post/3mx7ydz4fqq2u", "content": "CISA added an actively exploited Citrix NetScaler zero-day (CVE-2026-88779) to its KEV catalog on Oct 4. Federal agencies must remediate by Oct 7. Citrix has shipped patches. https://www.cybereyeq.com/?utm_source=bluesky&utm_medium=social&utm_campaign=netscaler_kev_88779", "creation_timestamp": "2026-10-06T17:46:28.037693Z"}, {"uuid": "d2659985-2a2d-4211-81e1-194efb7987b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mxabcysndc24", "content": "Citrix NetScaler security snafus get even worse amid more 0-day reports\n\nThe new vuln, CVE-2026-88779, is a memory overflow bug that leads to denial of service\n#hackernews #news", "creation_timestamp": "2026-10-06T20:26:58.284165Z"}, {"uuid": "3bcf9ac8-58d1-4ee4-9dd8-39ffa87a16e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88772", "type": "seen", "source": "https://bsky.app/profile/tier1solutionsllc.bsky.social/post/3mxag2p77m42y", "content": "\ud835\uddd6\ud835\uddf6\ud835\ude01\ud835\uddff\ud835\uddf6\ud835\ude05 \ud835\udde1\ud835\uddf2\ud835\ude01\ud835\udde6\ud835\uddf0\ud835\uddee\ud835\uddf9\ud835\uddf2\ud835\uddff \ud835\uddd6\ud835\udde9\ud835\uddd8-\ud835\udfee\ud835\udfec\ud835\udfee\ud835\udff2-\ud835\udff4\ud835\udff4\ud835\udff3\ud835\udff3\ud835\udfee \ud835\uddd8\ud835\ude05\ud835\uddfd\ud835\uddf9\ud835\uddfc\ud835\uddf6\ud835\ude01 \ud835\uddd7\ud835\uddf2\ud835\ude01\ud835\uddee\ud835\uddf6\ud835\uddf9\ud835\ude00 \ud835\udde6\ud835\uddf5\ud835\uddfc\ud835\ude04 \ud835\udde3\ud835\uddff\ud835\uddf2-\ud835\uddd4\ud835\ude02\ud835\ude01\ud835\uddf5 \ud835\udde3\ud835\uddee\ud835\ude01\ud835\uddf5 \ud835\ude01\ud835\uddfc \ud835\udde6\ud835\uddf5\ud835\uddf2\ud835\uddf9\ud835\uddf9\ud835\uddf0\ud835\uddfc\ud835\uddf1\ud835\uddf2 \ud835\uddd8\ud835\ude05\ud835\uddf2...\nhttps://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html\nCall us for a FREE IT Assessment! (888) 999-2709", "creation_timestamp": "2026-10-06T21:51:48.456172Z"}, {"uuid": "ee265b72-832d-4d9d-b376-1d9c9d041001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxb2q6zcv223", "content": "~Asec~\nAttackers exploited perimeter devices, poisoned packages, and hijacked identity sessions for persistence and expansion.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772, CVE-2026-20079\n-\n#IdentityAttack #SupplyChain #ThreatIntel #WebShell", "creation_timestamp": "2026-10-07T04:01:44.068476Z"}, {"uuid": "09de5045-6eb4-4e14-b1f2-e373518ab676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxb2q6zcv223", "content": "~Asec~\nAttackers exploited perimeter devices, poisoned packages, and hijacked identity sessions for persistence and expansion.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772, CVE-2026-20079\n-\n#IdentityAttack #SupplyChain #ThreatIntel #WebShell", "creation_timestamp": "2026-10-07T04:01:44.093911Z"}, {"uuid": "485414f6-9075-464d-8994-d872aeec2a9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mxb4sl6n762f", "content": "The latest update for #Sophos includes \"Understanding Asymmetric Routing Risks in Modern Firewall Deployments\" and \"Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation\".\n \n#cybersecurity #antivirus #malware https://opsmtrs.com/487u2e2", "creation_timestamp": "2026-10-07T04:38:51.247017Z"}, {"uuid": "6a3622c9-47c4-4a89-9f53-31b946ca83f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://t.me/CyberDispatch/3247", "content": "Citrix has patched a new NetScaler zero-day exploited in targeted attacks.\n\nCVE-2026-88779 affects certain SAML-configured deployments & can cause denial-of-service, with repeated triggering potentially leaving services unavailable.", "creation_timestamp": "2026-10-05T09:45:57.000000Z"}, {"uuid": "0b6b108b-d9aa-4d3a-b371-6e1ec043229d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mxbb7tgi5q2l", "content": "\u2022 Citrix NetScaler : zero-day CVE-2026-88779 exploit\u00e9, m\u00eame sur des instances patch\u00e9es\nhttps://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/", "creation_timestamp": "2026-10-07T05:57:51.728113Z"}, {"uuid": "57ec52c5-a90c-4915-bb9d-7b980dfe1c09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mxbdrlfkx32n", "content": "It's October 7. Federal employees and vendors who care about compliance need to patch CVE-2026-88779 in Citrix NetScaler by today; if you didn't update the gateway, you're late.\n\n#vulnerability #databreach #infosec", "creation_timestamp": "2026-10-07T06:43:34.678084Z"}, {"uuid": "61142395-cc70-45fa-a624-e7d0bd4c9270", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxbgza2ol62f", "content": "Top 3 CVE for last 7 days:\nCVE-2026-104286: 39 interactions\nCVE-2026-88779: 39 interactions\nCVE-2026-88771: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-21589: 29 interactions\nCVE-2026-86360: 8 interactions\nCVE-2023-28252: 7 interactions\n", "creation_timestamp": "2026-10-07T07:41:32.071771Z"}, {"uuid": "218d1100-62bb-4924-9baf-0ae1269a1916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxbgza2ol62f", "content": "Top 3 CVE for last 7 days:\nCVE-2026-104286: 39 interactions\nCVE-2026-88779: 39 interactions\nCVE-2026-88771: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-21589: 29 interactions\nCVE-2026-86360: 8 interactions\nCVE-2023-28252: 7 interactions\n", "creation_timestamp": "2026-10-07T07:41:32.091743Z"}, {"uuid": "7e21e01f-106a-4a13-bbb9-c5e2751d9421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxbh5ysv6o2f", "content": "Citrix reveals CVE-2026-88779, a critical memory overflow flaw in NetScaler SAML configurations leading to DoS, following recent RCE zero-day attacks.\n\n#CitrixNetScaler #Cybersecurity #CVE202688779 #SAML #ZeroDay", "creation_timestamp": "2026-10-07T07:44:13.124151Z"}, {"uuid": "eb30cda7-0bc6-45e0-b9c4-cafcb35939c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://t.me/infosec_ita_notizie/4272", "content": "\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 7 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 7 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u26a0\ufe0f IN PRIMO PIANO Citrix ha reso nota una nuova vulnerabilit\u00e0 zero-day critica (CVE-2026-88779, CVSS 8.7) in NetScaler ADC e Gateway, gi\u00e0 sfruttata in attacchi mirati. Il problema, un ove\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-07\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-10-07T06:45:36.000000Z"}, {"uuid": "04bc5317-ecb0-450f-9af4-5df759a4dece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mxbinkqiua2n", "content": "COGNOSCERE Tech Brief \u2014 2026-10-07\n\nCitrix shipped emergency fixes for CVE-2026-88779, a SAML authentication flaw in\n\nhttps://youtube.com/watch?v=RLDGhCk_euY\n\nhttps://www.cognoscerellc.com/news", "creation_timestamp": "2026-10-07T08:10:49.763150Z"}, {"uuid": "60c9e0a5-0c5d-450d-bdf9-a08f974b4275", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "exploited", "source": "https://t.me/infosec_ita_notizie/4272", "content": "\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 7 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Mercoled\u00ec 7 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u26a0\ufe0f IN PRIMO PIANO Citrix ha reso nota una nuova vulnerabilit\u00e0 zero-day critica (CVE-2026-88779, CVSS 8.7) in NetScaler ADC e Gateway, gi\u00e0 sfruttata in attacchi mirati. Il problema, un ove\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-07\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "creation_timestamp": "2026-10-07T06:45:36.000000Z"}, {"uuid": "c82f4d84-389f-4ac5-a1fb-8c07f0dc667f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-06)", "content": "", "creation_timestamp": "2026-10-06T00:00:00.000000Z"}, {"uuid": "f4dcbdf0-84a7-4573-8a31-bf721b42e617", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88779", "type": "seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mxbrlzxcja2x", "content": "Another Citrix NetScaler zero-day\n\nCitrix confirmed a new 0-day, CVE-2026-88779, in NetScaler appliances configured for SAML, already being exploited for denial of service.\n\nThe constant churn of these vulnerabilities is becoming a bit of a pattern.", "creation_timestamp": "2026-10-07T10:51:00.476096Z"}, {"uuid": "6da3f22b-fddb-4923-9756-eb5b9d876fb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/secpoint.bsky.social/post/3mxbso7hye222", "content": "Citrix NetScaler security alert: two actively exploited vulnerabilities\n\nCitrix has confirmed exploitation of CVE-2026-88771 and CVE-2026-88772 in unmitigated NetScaler deployments.\n\nwww.linkedin.com/products/sec...\n\n#NetScaler #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator", "creation_timestamp": "2026-10-07T11:10:09.569690Z"}, {"uuid": "82922fd6-614f-48c7-858c-05a6c9905121", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88772", "type": "seen", "source": "https://bsky.app/profile/secpoint.bsky.social/post/3mxbso7hye222", "content": "Citrix NetScaler security alert: two actively exploited vulnerabilities\n\nCitrix has confirmed exploitation of CVE-2026-88771 and CVE-2026-88772 in unmitigated NetScaler deployments.\n\nwww.linkedin.com/products/sec...\n\n#NetScaler #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator", "creation_timestamp": "2026-10-07T11:10:09.610968Z"}, {"uuid": "dcab77ea-ddfa-4116-a00a-1faa120013a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mxbthxzbak24", "content": "CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters", "creation_timestamp": "2026-10-07T11:24:34.253787Z"}, {"uuid": "f6fd0e49-b4c2-40ef-882e-414aaf04925a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88773", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-critical-http-requestresponse-smuggling-citrix-netscaler-adc-gateway-fips-patch", "content": "", "creation_timestamp": "2026-10-07T00:08:06.000000Z"}, {"uuid": "5f96c996-b4f8-4556-8d95-86b68431c5fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxbyzm4j4m22", "content": "eSentire tracks four clusters behind CVE-2026-88771 exploitation, planting NetScaler web shells and backdoor accounts. Learn how to detect them.\n\n#CVE202688771 #CitrixNetScaler #WebShell #ZeroDay #Platypus #eSentire #EdgeSecurity #CyberSecurity", "creation_timestamp": "2026-10-07T13:03:52.559925Z"}]}