https://vulnerability.circl.lu/sightings/feed 2026-09-28T20:25:15.972136+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b2d85176-f91c-4cf3-aec7-c1776f50ee5d/export 2026-09-28T20:25:15.998994+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b2d85176-f91c-4cf3-aec7-c1776f50ee5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm55qmiwx2b", "content": "~Watchtowr~\nActively exploited unauthenticated command injection enables root RCE on default NetScaler configurations.\n-\nIOCs: CVE-2026-88771\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T20:19:11.653141Z"} 2026-09-28T20:19:11.653141+00:00 https://vulnerability.circl.lu/sighting/4cb3e5b4-66aa-4146-96b0-0128d2f9aa5b/export 2026-09-28T20:25:16.001854+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4cb3e5b4-66aa-4146-96b0-0128d2f9aa5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4un63mx2b", "content": "@sophossecurity.bsky.social\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "creation_timestamp": "2026-09-28T20:14:06.146995Z"} 2026-09-28T20:14:06.146995+00:00 https://vulnerability.circl.lu/sighting/c023ad01-5eb7-4c2a-8ea0-2e46c802cd97/export 2026-09-28T20:25:16.002014+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c023ad01-5eb7-4c2a-8ea0-2e46c802cd97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4oyp7q42b", "content": "@ncsc.gov.uk\nTwo NetScaler flaws are actively exploited; patch or isolate affected systems.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T20:10:57.522068Z"} 2026-09-28T20:10:57.522068+00:00 https://vulnerability.circl.lu/sighting/f747ee47-a454-4b65-86c9-8e67f3bc003e/export 2026-09-28T20:25:16.002129+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f747ee47-a454-4b65-86c9-8e67f3bc003e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/cert_eu/statuses/117349951351196239", "content": "Another day, another critical vulnerability in an edge device. We\u2019ve analysed the CVE-2026-88771, one of the many vulnerabilities disclosed by Citrix recently, based on observed exploitation attempts, and set out what we learned and key takeaways. \ud83d\udd0d\ud83d\udd12\nIf you\u2019re managing Citrix infrastructure, now\u2019s the time to check for compromise!\nhttps://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\n#cybersecurity #cve-2026-88771 #vulnerability", "creation_timestamp": "2026-09-28T17:55:54.683233Z"} 2026-09-28T17:55:54.683233+00:00 https://vulnerability.circl.lu/sighting/0f9dad26-0575-47c2-9560-3bb7cee189a6/export 2026-09-28T20:25:16.002235+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "0f9dad26-0575-47c2-9560-3bb7cee189a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwlu3am7722d", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix t\u2026\n#hackernews #news", "creation_timestamp": "2026-09-28T17:36:44.842831Z"} 2026-09-28T17:36:44.842831+00:00 https://vulnerability.circl.lu/sighting/4532cc7f-9714-4733-9aa0-0070fd02f475/export 2026-09-28T20:25:16.002343+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4532cc7f-9714-4733-9aa0-0070fd02f475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwltuti3k62y", "content": "On CVE-2026-88771, \n@GreyNoiseIO\n detected the Citrix NetScaler zero day exploitation as malicious within seconds of it occuring, and days before the CVE disclosure.\n\n\u2014 from @ImposeCost (https://x.com/ImposeCost/status/2104622723213533582)", "creation_timestamp": "2026-09-28T17:33:08.979205Z"} 2026-09-28T17:33:08.979205+00:00 https://vulnerability.circl.lu/sighting/66572b76-d275-4f89-9e50-f69844edcfae/export 2026-09-28T20:25:16.002446+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "66572b76-d275-4f89-9e50-f69844edcfae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwlta4t6h542", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was [\u2026] \n\n[Original post on infosec.exchange]", "creation_timestamp": "2026-09-28T17:21:42.283353Z"} 2026-09-28T17:21:42.283353+00:00 https://vulnerability.circl.lu/sighting/1acf5556-3bd7-41bc-ace7-ff86799f236f/export 2026-09-28T20:25:16.002546+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "1acf5556-3bd7-41bc-ace7-ff86799f236f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/greynoise/statuses/117349816155656362", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.\nThe attacker's post-exploitation payload and IOCs: https://greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "creation_timestamp": "2026-09-28T17:21:32.331823Z"} 2026-09-28T17:21:32.331823+00:00 https://vulnerability.circl.lu/sighting/f7a728da-797b-4946-a274-7bec2824974f/export 2026-09-28T20:25:16.002662+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f7a728da-797b-4946-a274-7bec2824974f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117349804759188941", "content": "GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.\nhttps://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation\n#threatintel #citrix #netscaler #zeroday #CVE", "creation_timestamp": "2026-09-28T17:20:32.087597Z"} 2026-09-28T17:20:32.087597+00:00 https://vulnerability.circl.lu/sighting/a12eee2d-8ade-4d7b-8980-d5ff8a2e150c/export 2026-09-28T20:25:16.002758+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a12eee2d-8ade-4d7b-8980-d5ff8a2e150c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/greynoise.io/post/3mwlt5ttph22h", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.", "creation_timestamp": "2026-09-28T17:20:21.840009Z"} 2026-09-28T17:20:21.840009+00:00