https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 22:57:31 +0000 https://vulnerability.circl.lu/sighting/30cc18ac-d5fe-44d0-89a4-d264d85d00da/export {"uuid": "30cc18ac-d5fe-44d0-89a4-d264d85d00da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117351107654208046", "content": "Technical write up of the latest Citrix Netscaler incident, which I\u2019m calling PitScaler - you\u2019ll find out why from this: \n https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\nYou may notice it matches the hunting hints earlier in this thread. Guess who found it first :annoyingdog: \nIt\u2019s a really interesting vuln scenario. I\u2019m tracking over 100 victim orgs now. Each one has a unique webshell which can\u2019t be scanned for remotely unless you\u2019re the attacker. It\u2019s espionage.", "creation_timestamp": "2026-09-28T22:50:10.832761Z"} {"uuid": "30cc18ac-d5fe-44d0-89a4-d264d85d00da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117351107654208046", "content": "Technical write up of the latest Citrix Netscaler incident, which I\u2019m calling PitScaler - you\u2019ll find out why from this: \n https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\nYou may notice it matches the hunting hints earlier in this thread. Guess who found it first :annoyingdog: \nIt\u2019s a really interesting vuln scenario. I\u2019m tracking over 100 victim orgs now. Each one has a unique webshell which can\u2019t be scanned for remotely unless you\u2019re the attacker. It\u2019s espionage.", "creation_timestamp": "2026-09-28T22:50:10.832761Z"} https://vulnerability.circl.lu/sighting/30cc18ac-d5fe-44d0-89a4-d264d85d00da/export Mon, 28 Sep 2026 22:50:10 +0000 https://vulnerability.circl.lu/sighting/cb9c4fb9-3dec-4d1b-81c3-9e48374289a2/export {"uuid": "cb9c4fb9-3dec-4d1b-81c3-9e48374289a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-28T22:34:45.710649Z"} {"uuid": "cb9c4fb9-3dec-4d1b-81c3-9e48374289a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-28T22:34:45.710649Z"} https://vulnerability.circl.lu/sighting/cb9c4fb9-3dec-4d1b-81c3-9e48374289a2/export Mon, 28 Sep 2026 22:34:45 +0000 https://vulnerability.circl.lu/sighting/21ca3904-6463-47e0-9cb7-af1536103199/export {"uuid": "21ca3904-6463-47e0-9cb7-af1536103199", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-28T22:34:30.164038Z"} {"uuid": "21ca3904-6463-47e0-9cb7-af1536103199", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-28T22:34:30.164038Z"} https://vulnerability.circl.lu/sighting/21ca3904-6463-47e0-9cb7-af1536103199/export Mon, 28 Sep 2026 22:34:30 +0000 https://vulnerability.circl.lu/sighting/1a8e7010-e636-45a1-8921-e026d6435ebf/export {"uuid": "1a8e7010-e636-45a1-8921-e026d6435ebf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcdjexto2e", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERT/CC \uff08Sep 28\uff09\n\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-09-28T21:51:53.913703Z"} {"uuid": "1a8e7010-e636-45a1-8921-e026d6435ebf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcdjexto2e", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERT/CC \uff08Sep 28\uff09\n\nwww.jpcert.or.jp/at/2026/at26...", "creation_timestamp": "2026-09-28T21:51:53.913703Z"} https://vulnerability.circl.lu/sighting/1a8e7010-e636-45a1-8921-e026d6435ebf/export Mon, 28 Sep 2026 21:51:53 +0000 https://vulnerability.circl.lu/sighting/34d57470-28ac-4aad-b2af-ff7b4479a813/export {"uuid": "34d57470-28ac-4aad-b2af-ff7b4479a813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcd775752s", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09 #IPA \uff08Sep 28\uff09\n\nwww.ipa.go.jp/security/sec...", "creation_timestamp": "2026-09-28T21:51:43.387579Z"} {"uuid": "34d57470-28ac-4aad-b2af-ff7b4479a813", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcd775752s", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09 #IPA \uff08Sep 28\uff09\n\nwww.ipa.go.jp/security/sec...", "creation_timestamp": "2026-09-28T21:51:43.387579Z"} https://vulnerability.circl.lu/sighting/34d57470-28ac-4aad-b2af-ff7b4479a813/export Mon, 28 Sep 2026 21:51:43 +0000 https://vulnerability.circl.lu/sighting/8ffbb82f-0dbd-4522-9656-c9902897d9a8/export {"uuid": "8ffbb82f-0dbd-4522-9656-c9902897d9a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mwmbrvgszn2r", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) labs.watchtowr.com/oh-look-the-...", "creation_timestamp": "2026-09-28T21:42:06.386228Z"} {"uuid": "8ffbb82f-0dbd-4522-9656-c9902897d9a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mwmbrvgszn2r", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) labs.watchtowr.com/oh-look-the-...", "creation_timestamp": "2026-09-28T21:42:06.386228Z"} https://vulnerability.circl.lu/sighting/8ffbb82f-0dbd-4522-9656-c9902897d9a8/export Mon, 28 Sep 2026 21:42:06 +0000 https://vulnerability.circl.lu/sighting/59f9d316-4ef6-456a-9bae-73e2c4e4cddc/export {"uuid": "59f9d316-4ef6-456a-9bae-73e2c4e4cddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/117350840551160210", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T21:42:02.817441Z"} {"uuid": "59f9d316-4ef6-456a-9bae-73e2c4e4cddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/117350840551160210", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T21:42:02.817441Z"} https://vulnerability.circl.lu/sighting/59f9d316-4ef6-456a-9bae-73e2c4e4cddc/export Mon, 28 Sep 2026 21:42:02 +0000 https://vulnerability.circl.lu/sighting/6390198c-76f6-40e6-9f2c-d0e9d600f8d1/export {"uuid": "6390198c-76f6-40e6-9f2c-d0e9d600f8d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwmb4kpvp627", "content": "\ud83d\udce2 Citrix NetScaler : injection de commandes pr\u00e9-auth exploit\u00e9e en zero-day (CVE-2026-88771)\n\nCet article pr\u00e9sente l'analyse technique d\u00e9taill\u00e9e de CVE-2026-88771, une vuln\u00e9rabilit\u00e9 d'injection de commandes pr\u00e9-authentification\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#CitrixNetScaler #ZeroDay #Cyberveille", "creation_timestamp": "2026-09-28T21:30:06.830608Z"} {"uuid": "6390198c-76f6-40e6-9f2c-d0e9d600f8d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwmb4kpvp627", "content": "\ud83d\udce2 Citrix NetScaler : injection de commandes pr\u00e9-auth exploit\u00e9e en zero-day (CVE-2026-88771)\n\nCet article pr\u00e9sente l'analyse technique d\u00e9taill\u00e9e de CVE-2026-88771, une vuln\u00e9rabilit\u00e9 d'injection de commandes pr\u00e9-authentification\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#CitrixNetScaler #ZeroDay #Cyberveille", "creation_timestamp": "2026-09-28T21:30:06.830608Z"} https://vulnerability.circl.lu/sighting/6390198c-76f6-40e6-9f2c-d0e9d600f8d1/export Mon, 28 Sep 2026 21:30:06 +0000 https://vulnerability.circl.lu/sighting/1f8e6134-7ed0-4c08-9950-2c809c61c55d/export {"uuid": "1f8e6134-7ed0-4c08-9950-2c809c61c55d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24", "content": "\ud83d\udce2 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploit\u00e9s activement\n\n\ud83d\udd0d Vuln\u00e9rabilit\u00e9s identifi\u00e9es Citrix a publi\u00e9 le bulletin de s\u00e9curit\u00e9 CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#NetScaler #ZeroDay #Cyberveille", "creation_timestamp": "2026-09-28T20:30:06.816224Z"} {"uuid": "1f8e6134-7ed0-4c08-9950-2c809c61c55d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24", "content": "\ud83d\udce2 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploit\u00e9s activement\n\n\ud83d\udd0d Vuln\u00e9rabilit\u00e9s identifi\u00e9es Citrix a publi\u00e9 le bulletin de s\u00e9curit\u00e9 CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#NetScaler #ZeroDay #Cyberveille", "creation_timestamp": "2026-09-28T20:30:06.816224Z"} https://vulnerability.circl.lu/sighting/1f8e6134-7ed0-4c08-9950-2c809c61c55d/export Mon, 28 Sep 2026 20:30:06 +0000 https://vulnerability.circl.lu/sighting/b2d85176-f91c-4cf3-aec7-c1776f50ee5d/export {"uuid": "b2d85176-f91c-4cf3-aec7-c1776f50ee5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm55qmiwx2b", "content": "~Watchtowr~\nActively exploited unauthenticated command injection enables root RCE on default NetScaler configurations.\n-\nIOCs: CVE-2026-88771\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T20:19:11.653141Z"} {"uuid": "b2d85176-f91c-4cf3-aec7-c1776f50ee5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm55qmiwx2b", "content": "~Watchtowr~\nActively exploited unauthenticated command injection enables root RCE on default NetScaler configurations.\n-\nIOCs: CVE-2026-88771\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-28T20:19:11.653141Z"} https://vulnerability.circl.lu/sighting/b2d85176-f91c-4cf3-aec7-c1776f50ee5d/export Mon, 28 Sep 2026 20:19:11 +0000