{"vulnerability": "CVE-2026-88771", "sightings": [{"uuid": "d2b9b215-7aba-4cff-9776-15b45e04ddd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "content": "", "creation_timestamp": "2026-09-27T15:36:30.407267Z"}, {"uuid": "3e75b273-f7ce-4690-84c8-1a8ccbb87b27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "creation_timestamp": "2026-09-27T15:37:52.349482Z"}, {"uuid": "4aeddb2b-ed5e-4f6b-ba73-cbfafec0d5f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "creation_timestamp": "2026-09-27T15:50:37.084913Z"}, {"uuid": "d07adbae-1083-41f9-b5c2-4268bc7cf2a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwj77jedpp2r", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow", "creation_timestamp": "2026-09-27T16:18:00.604098Z"}, {"uuid": "937e2885-0a10-4198-b10c-7cde52aa6896", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwj77jtazd2x", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #PotatoSecurity #VPN #watchTowr #PatchNow", "creation_timestamp": "2026-09-27T16:18:01.339220Z"}, {"uuid": "f0762419-c794-4f74-87a0-1934d31c3000", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cherdt.bsky.social/post/3mwj7jogrcc2y", "content": "Citrix released patched today for 8 NetScaler vulnerabilities, CVE-2026-88771 through CVE-2026-88778.\n\nAlthough I don't know all the details, word is that one or more of these vulnerabilities are being actively exploited. Patch as soon as possible.", "creation_timestamp": "2026-09-27T16:23:40.577848Z"}, {"uuid": "0844fe5f-b763-46e3-88ab-3588cae10539", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117343976965806995", "content": "A new vulnerability with increased severity was disclosed for Citrix ADC and Gateway (CVE-2026-88771) https://vuldb.com/vuln/410912", "creation_timestamp": "2026-09-27T16:36:33.859256Z"}, {"uuid": "7a3987ee-1edf-483a-9498-e99b59aa9f06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/thehackernews/10175", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T16:24:30.000000Z"}, {"uuid": "6a8aa976-51df-4ec2-8b7e-1d9055befba7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mwjbkwf7sc22", "content": "\ud83d\udea8 CVE-2026-88771 & CVE-2026-88772: Citrix has patched two exploited NetScaler zero-days (CVSS 9.5). Update to 14.1-73.37 / 13.1-64.23 and check for compromise.\nwww.cyberkendra.com/2026/09/cve-... \n\n#citrixvulnerability #netscaler #zeroday #infosec", "creation_timestamp": "2026-09-27T17:00:13.418058Z"}, {"uuid": "c9379a8a-1312-4bc4-9a72-c7aeae252056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwjblzg2jz2p", "content": "Citrix lanceert noodupdates na actieve uitbuiting van kritieke kwetsbaarheden in\n\nCitrix heeft beveiligingsupdates uitgebracht voor NetScaler ADC en NetScaler Gateway vanwege twee kritieke kwetsbaarheden, CVE-2026-88771 en CVE-2026-88772, die momenteel actief worden uitgebuit. Beide kwetsbaa...", "creation_timestamp": "2026-09-27T17:00:47.360581Z"}, {"uuid": "3932fa41-0225-4ea3-9fdc-409e13bc9825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjc6lkxem2k", "content": "\ud83e\udd16 Citrix NetScaler: 2 RCE zero-days exploited pre-patch, CVSS 9.5 each. CVE-2026-88771 hits every deployment (unauth cmd exec); CVE-2026-88772 via DTLS, default on VPN vservers. Fixed: 14.1-73.37 / 13.1-64.23.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T17:11:09.472954Z"}, {"uuid": "3f13ee84-c694-45be-aad3-1fc12e9323fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-27T17:25:16.128015Z"}, {"uuid": "3134c878-4028-4657-ab0e-47b2afea2f42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/thehackernews/10175", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-27T16:24:30.000000Z"}, {"uuid": "2f40124f-2f26-44b2-b2b4-482c6cfe3367", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfcmp2oj25", "content": "\ud83d\udea8 CVE-2026-88771 \u2014 CVSS 9.5 CRITICAL\n\nImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue af...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88771\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-27T18:07:06.253715Z"}, {"uuid": "fdd083de-6b50-4fd4-851c-5ed63c9e0c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfhwp7rv2k", "content": "CVE-2026-88771\nOlder versions of Citrix NetScaler ADC and NetScaler Gateway do not properly check certain inputs, which could let an unauthenticated attacker run commands on the device. This could give the attacker control\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-27T18:10:04.501101Z"}, {"uuid": "7ff927fb-260c-4c8c-a84e-064ec76d391b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgkjhqgb2f", "content": "CVE-2026-88771 is trending. Hype score 33, currently #1 on cvemon.\n\nImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS,\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88771", "creation_timestamp": "2026-09-27T18:29:25.814320Z"}, {"uuid": "ff897380-59ed-46a1-be5f-1cf05f509d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "creation_timestamp": "2026-09-27T14:55:29.000000Z"}, {"uuid": "383dc789-c9cf-45ab-8cb1-d1cf2d7be8d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "content": "", "creation_timestamp": "2026-09-27T11:02:05.000000Z"}, {"uuid": "a24d9747-3e82-4c16-a485-e7d474ef4e83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "creation_timestamp": "2026-09-27T15:56:07.000000Z"}, {"uuid": "01867a92-2a2f-4b55-b82f-2e6047156be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117343817673361515", "content": "Citrix NetScaler zero-days\n\nExploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.\nThis is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart \nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n#citrix #netscaler #zeroday #cve", "creation_timestamp": "2026-09-27T19:36:49.601593Z"}, {"uuid": "fb34528b-773d-4065-87cf-ccd286557a47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/116797276219291526/statuses/117343904630365522", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow\nhttps://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social", "creation_timestamp": "2026-09-27T19:37:04.565278Z"}, {"uuid": "7ff4123f-76d8-4081-b011-f7ed23e7710c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117344112149380671", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: two RCE zero-days exploited in the wild before any fix, CVSS v4 9.5 each. CVE-2026-88771 hit every deployment (unauth command execution); CVE-2026-88772 needs DTLS, on by default for VPN vservers. Fixed in 14.1-73.37 / 13.1-64.23.\ud83d\udd17 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html#CVE #Exploit #NetScaler #CyberSec", "creation_timestamp": "2026-09-27T19:37:30.798519Z"}, {"uuid": "846870c7-d0bc-44fb-b16b-318e6da861e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117064736050780246/statuses/117344423181886454", "content": "Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement\nhttps://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach", "creation_timestamp": "2026-09-27T19:38:01.931830Z"}, {"uuid": "8e745a4e-d8ff-40ab-a002-ed74575a2acf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwjksevdsq2p", "content": "Citrix confirms active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, enabling remote code execution and denial of service. #Citrix #NetScaler #RCE", "creation_timestamp": "2026-09-27T19:45:23.525142Z"}, {"uuid": "cd95d6b0-cf9b-4f0b-83ff-4ca4df250a46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/zackwhittaker.com/post/3mwjlj2oots27", "content": "CISA has confirmed two bugs in Citrix NetScaler are being exploited in active cyberattacks, CVE-2026-88771 and CVE-2026-88772, in a rare weekend drop of security news. www.cisa.gov/known-exploi...\n\nCitrix has a support base article, confirming exploitation. support.citrix.com/support-home...", "creation_timestamp": "2026-09-27T19:58:06.163542Z"}, {"uuid": "23dfa00c-c7f1-472d-a9c5-e714293309eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlopz7wo2b", "content": "~Certeu~\nCitrix confirms active exploitation of two unauthenticated NetScaler RCEs; patch immediately and assess internet-facing appliances.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "creation_timestamp": "2026-09-27T20:01:14.906009Z"}, {"uuid": "7ae4efca-2d6a-4f91-a19a-19465c58ab76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlr55n5d2g", "content": "~Cisa~\nCISA reports active exploitation of two Citrix NetScaler vulnerabilities and urges rapid remediation.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "creation_timestamp": "2026-09-27T20:02:35.641108Z"}, {"uuid": "ebf1a866-8846-432e-982f-77e758425b5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlthkufc2e", "content": "~Cybergcca~\nActive exploitation of NetScaler flaws enables remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #CyberSecurity #ThreatIntel", "creation_timestamp": "2026-09-27T20:03:54.575365Z"}, {"uuid": "3e1a0b21-c9f9-4c18-9ea6-9e5dc9080a3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/ichintu/880d8b4087a6fd9cbf8625bb1b4c754e", "content": "This update covers multiple high- and critical-severity vulnerabilities disclosed around September 27, 2026. The most severe impact affects **Citrix NetScaler ADC and Gateway**, which face numerous critical flaws (including CVE-2026-88771 and 88772) enabling unauthenticated remote code execution, memory overflows, HTTP request smuggling, and TCP session prediction. Active exploitation is confirmed, requiring an immediate patch to versions 14.1-73.37 or 13.1-64.23. \n\nOther affected systems include **pnpm** (environment variable exfiltration via proxy configs, patched in 10.34.5/11.11.0), **Fleet** (command injection via cask metadata, patched in v4.92.0), **python-utcp** (SSRF via redirect bypass, patched in 1.1.4), and **Heym** (authentication bypasses for Telegram and Slack webhooks, patched in 0.0.53). \n\nRemediation guidance emphasizes patching to specified versions, temporarily disabling internet-facing Citrix appliances, preserving forensic logs, investigating for compromise, and aligning defenses with cybersecurity hardening best practices.", "creation_timestamp": "2026-09-27T20:03:40.000000Z"}, {"uuid": "99f37e90-769f-4d9c-8842-7f3884647ed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "content": "", "creation_timestamp": "2026-09-27T09:09:00.000000Z"}, {"uuid": "27f12ba9-7f4c-4c13-b29b-15f2e3a261b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/aktivt-utnyttelse-av-kritiske-sarbarheter-i-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T11:05:15.000000Z"}, {"uuid": "f8f9799c-e88e-4bf3-aa79-dc14c3083369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "", "creation_timestamp": "2026-09-27T12:34:41.000000Z"}, {"uuid": "f28bbdd2-9858-4ccf-abcb-ffdb5ea55d18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwjnt7hfzn25", "content": "AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway \u2013 CVE-2026-88771 and CVE-2026-88772", "creation_timestamp": "2026-09-27T20:39:32.549130Z"}, {"uuid": "6b3df433-e1f3-43a6-a03b-6b48b9978cda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "content": "", "creation_timestamp": "2026-09-27T10:21:12.000000Z"}, {"uuid": "2b2c0b17-ad88-457a-bd7d-48570fb45b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu", "content": "", "creation_timestamp": "2026-09-27T12:11:42.000000Z"}, {"uuid": "70c05d65-067b-4f24-818e-8aec947211dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwjqbd7eom2l", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88771: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-7\u2026\nCVSS 9.5 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-88771\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-27T21:23:13.715730Z"}, {"uuid": "b19e6da5-55bb-4874-aea9-d4a2910003de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6rtxrq2q", "content": "\ud83d\uded1 CVE-2026-88771\nCitrix NetScaler\nCVSS 9.5 / KEV: No\nTL;DR: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This i\u2026\nhttps://cvesentinel.com/report/CVE-2026-88771?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-27T21:57:36.092824Z"}, {"uuid": "6c59ba72-c197-4e9e-b31a-9d94b65e9339", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/101635ac-c10a-4cfc-b18a-1dee629f73cc", "content": "", "creation_timestamp": "2026-09-27T22:00:03.772141Z"}, {"uuid": "2008b61b-0d5e-4f2c-8840-2d5205e85fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "content": "Citrix ha rilasciato aggiornamenti di sicurezza per ADC e Gateway, prodotti NetScaler dedicati alla distribuzione, gestione e accesso sicuro ad applicazioni e servizi, che sanano 8 vulnerabilit\u00e0, di cui 3 con gravit\u00e0 \"critica\" e 5 con gravit\u00e0 \"alta\". Tra queste si evidenziano le vulnerabilit\u00e0 identificate tramite CVE-2026-88771 e CVE-2026-88772, per le quali Citrix ha osservato lo sfruttamento su sistemi NetScaler non aggiornati.", "creation_timestamp": "2026-09-27T17:34:41.000000Z"}, {"uuid": "7126fe0d-534b-4a3b-987c-a83caa3d8d75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w", "content": "Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.\n\nwww.deyda.net/index.php/en...\n\n#DeydaConsulting #NetScaler #Citrix", "creation_timestamp": "2026-09-27T23:03:26.957388Z"}, {"uuid": "b8389bac-3acc-4c5b-9037-520f732c6d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mwjw334u4i2q", "content": "Citrix patched the NetScaler zero-days alerted this morning, weeks ahead of the Sept 28 timeline first reported. CISA confirms active global exploitation, added CVE-2026-88771 and 88772 to KEV, and warns patching can erase forensic evidence of prior compromise. cisa.gov/news-events/ale...", "creation_timestamp": "2026-09-27T23:07:06.579294Z"}, {"uuid": "9829e66e-8794-4319-8400-a586dd106f81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l", "content": "Emergency Citrix Patch and the $2.2M Vendor Liability Lesson\n\nFirst, Citrix has confirmed that two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and NetScaler Gateway are being actively exploited by attackers.\n\nhttps://youtu.be/ean43KG9b1g", "creation_timestamp": "2026-09-27T23:16:13.631362Z"}, {"uuid": "13e6fb22-ba1d-4651-b6fc-f9275b8b4ae8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mwjyzwec2o2x", "content": "Re-patch NetScaler: CISA says exploited CVE-2026-88771/88772 need new fixes even after August updates. Oct. 7: Microsoft and NVIDIA share a stage. Also: Wi\u2011Fi link checks, Explorer Recents, C: shrink blockers. +23 more stories", "creation_timestamp": "2026-09-28T00:00:12.579954Z"}, {"uuid": "5cfa7346-b180-4060-a962-1cc434387b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwk7ir4e7v2h", "content": "CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability\n\nCitrix NetScaler ADC and NetScaler Gateway contain an improper input validat\u2026\n\nhttps://planetbriefing.com/events/cve-2026-88771-citrix-netscaler-improper-input-validation-vulnerability-784752551976\n\n#Technology #UnitedStates", "creation_timestamp": "2026-09-28T01:55:49.597545Z"}, {"uuid": "06a7214c-33fb-4030-8592-a6e883d53f7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 27\uff09\n\nCVE-2026-88771 Citrix NetScaler \u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\nCVE-2026-88772 Citrix NetScaler\u306b\u304a\u3051\u308b\u30e1\u30e2\u30ea\u30d0\u30c3\u30d5\u30a1\u306e\u7bc4\u56f2\u5185\u3067\u306e\u64cd\u4f5c\u306e\u4e0d\u9069\u5207\u306a\u5236\u9650\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-28T03:24:17.860252Z"}, {"uuid": "bb9f96a9-1035-4c60-b32d-3f069e27c845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44631", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-27T23:00:31.000000Z"}, {"uuid": "bb99c059-b67a-4934-85ab-3b0ed09a7cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44636", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "creation_timestamp": "2026-09-27T23:00:40.000000Z"}, {"uuid": "ccaa9d0c-77e8-47ca-b6d8-535ce26eaf95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44635", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability\nCVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-27T23:00:38.000000Z"}, {"uuid": "9ef159e4-b734-482d-9aa5-7feb4423c715", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26", "content": "~Cisa~\nThreat actors are globally exploiting two critical NetScaler zero-days enabling remote code execution.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "creation_timestamp": "2026-09-28T04:04:23.091955Z"}, {"uuid": "01d14b1f-85ef-4cea-9e2e-90406f689a9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "content": "", "creation_timestamp": "2026-09-27T18:00:00.000000Z"}, {"uuid": "c8fa8033-1f3e-4dc5-b141-c8ec42509d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwkjryaqvd26", "content": "\ud83d\udcf0 Citrix Konfirmasi Dua Zero-Day NetScaler RCE Dieksploitasi dalam Serangan\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/28/citrix-netscaler-zero-day-cve-2026-88771-88772/\n\n#citrix #cve #cybersecurity #keamananSiber #netscaler #netscalerAdc #netscalerGateway #networkSecurity ", "creation_timestamp": "2026-09-28T04:59:56.613787Z"}, {"uuid": "82819c0b-7312-4e8a-8568-66092cf41141", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwkmxrrqa22q", "content": "\ud83d\udee1\ufe0f Revue cyber du 28 sept :\n\n\u2022 Citrix NetScaler : 2 zero-days RCE exploit\u00e9s (CVE-2026-88771/88772). Patcher + invalider les sessions.\nhttps://bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-28T05:56:51.950659Z"}, {"uuid": "115dd9a8-754b-49a1-9b4b-145d716227f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mwkmxs6si62w", "content": "\ud83d\udee1\ufe0f Revue potato du 28 sept :\n\n\u2022 Citrix NetScaler : 2 zero-days RCE exploit\u00e9s (CVE-2026-88771/88772). Patcher + invalider les sessions.\nhttps://bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "creation_timestamp": "2026-09-28T05:56:52.467694Z"}, {"uuid": "a08f47a5-a573-4f1f-a40d-af71815cad18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwknogr2dp2q", "content": "Analysis: CVE-2026-88771 and CVE-2026-88772", "creation_timestamp": "2026-09-28T06:09:32.181319Z"}, {"uuid": "bda7be68-7242-4a8b-9a25-00a5e9bff435", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwkourw2ke2s", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-88771: \u26a0\ufe0f CVE-2026-88771: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-88771-improper-input-validation-vulnerability-in-citrix", "creation_timestamp": "2026-09-28T06:30:58.671845Z"}, {"uuid": "e8b2734b-4bb7-45f5-9de7-f98427fae2e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwkqivpzaq27", "content": "\ud83d\udce2 \u26a0\ufe0f [VULN] Citrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es CVE-2026-88771 CVE-2026-88772\n\nCitrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es. Les entreprises doivent v\u00e9rifier les versions et rechercher une possible intrusion sur leurs \u00e9quipements.\n\n#CVE #Cyberveille", "creation_timestamp": "2026-09-28T07:00:08.055101Z"}, {"uuid": "84fe006e-9fa8-4974-8bf1-e6616b2a6078", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/index.fomoera.com.ap.brid.gy/post/3mwkqivzj67n2", "content": "Citrix liber\u00f3 el 27 de septiembre parches para CVE-2026-88771 y CVE-2026-88772, dos fallas cr\u00edticas de NetScaler ADC y Gateway que ya se explotaban. Los equipos actualizados en agosto siguen expuestos y CISA pide revisar antes de parchar.", "creation_timestamp": "2026-09-28T07:00:12.756241Z"}, {"uuid": "e025904f-149b-4b66-8d1e-d0fd731040ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwks45oiwt2n", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: CVE-2026-88771 + CVE-2026-88772 (unauth RCE) exploited in the wild. One hits default configs, the other needs DTLS. CISA KEV, FCEB deadline Sep 30.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "creation_timestamp": "2026-09-28T07:28:47.324199Z"}, {"uuid": "3c5f412d-ede1-4cf0-ac46-a5be5344db27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 14 interactions\n", "creation_timestamp": "2026-09-28T07:32:35.890632Z"}, {"uuid": "681accf0-00e2-4cc0-900a-d84507369945", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwkszjefso2c", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:12.742020Z"}, {"uuid": "82cebced-ee2d-4f09-a130-4fc61ee71ca3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwkszv2vxu2m", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:24.760202Z"}, {"uuid": "c7f652cb-baed-41ff-8bd5-c69596a30192", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwkt2ezry22y", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "creation_timestamp": "2026-09-28T07:45:41.565523Z"}, {"uuid": "4cd8da4c-22c7-47ea-89b0-3cf4f92c7574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwktos6gfcfa", "content": "NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a42\u4ef6\u3001\u653b\u6483\u3067\u306e\u60aa\u7528\u3092Citrix\u304c\u78ba\u8a8d\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47848/", "creation_timestamp": "2026-09-28T07:57:08.278793Z"}, {"uuid": "a6c3f4e2-b3c2-4e9c-917b-9605f08bfc8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/ichintu/1d63d88b130a22aa8e7576cfb85d5791", "content": "On September 28, 2026, threat intelligence highlights multiple critical, publicly disclosed vulnerabilities across widely used platforms and network hardware. **aaPanel BaoTa** (v\u226411.8.0) and **Netcore routers** (NBR200V2/NBR100V2) are affected by several remote OS command injection and authorization bypass flaws (CVSS 8.5\u201310.0), with vendors remaining unresponsive to early notifications. Additional disclosures include a HIGH-severity LFI/SSRF vulnerability in Joomla\u2019s **Modules Anywhere** extension, an RCE in **OpenCode**, and active **Citrix NetScaler** zero-days (CVE-2026-88771/88772) recently added to CISA\u2019s KEV catalog due to real-world exploitation. Organizations should prioritize immediate patching, enforce compensating controls, and monitor for active threat campaigns.", "creation_timestamp": "2026-09-28T08:00:31.000000Z"}, {"uuid": "a9ba8778-0b69-487f-ac22-05a815b3191e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "content": "", "creation_timestamp": "2026-09-28T00:56:58.000000Z"}, {"uuid": "ea14b467-eaaa-4c5f-aa4a-c419e1fc2159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mwkvjiucu22y", "content": "CVE-2026-88771 & CVE-2026-88772 (CVSS 9.5, CISA KEV): two Citrix NetScaler RCE zero-days exploited before a patch existed. 88771 hits default configs unauthenticated. Upgrade to 14.1-73.37 / 13.1-64.23. Query: (product~\"Citrix NetScaler\") and last_seen>-7D", "creation_timestamp": "2026-09-28T08:29:59.063736Z"}, {"uuid": "399cda75-a9ce-4c71-99ad-d65e54888c26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwkvzczigcfa", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 https://www.jpcert.or.jp/at/2026/at260029.html", "creation_timestamp": "2026-09-28T08:38:49.501112Z"}, {"uuid": "9608ffb2-2443-4b36-ad9c-21601a819380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "creation_timestamp": "2026-09-28T08:45:05.846955Z"}, {"uuid": "5096d26e-d574-4adc-9335-e053648c6220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083", "content": "", "creation_timestamp": "2026-09-27T21:00:00.000000Z"}, {"uuid": "0b7a0329-1c83-44a1-9186-33e7dfcabea0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mwkx7v3rjp2q", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "creation_timestamp": "2026-09-28T09:00:21.755795Z"}, {"uuid": "00f2450f-1a0f-4572-bfe8-fe9bc5ea862b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117347845378892968", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0fLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "creation_timestamp": "2026-09-28T09:00:23.218003Z"}, {"uuid": "577b445d-af3e-434e-9172-af99f19be64a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwkxbwddev2z", "content": "\u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nCloud Software Group\u304c9\u670827\u65e5\u306bNetScaler ADC\u304a\u3088\u3073Gateway\u306e8\u3064\u306e\u8106\u5f31\u6027\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002CVE-2026-88771\u3001CVE-2026-88772\u306f\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u653b\u6483\u8005\u306b\u3088\u308b\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3067\u3001\u3059\u3067\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002CVE-2026-88771\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u69cb\u6210\u542b\u3080\u3059\u3079\u3066\u306e\u69cb\u6210\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3001CVE-2026-8877\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-28T09:01:29.770912Z"}, {"uuid": "e48b315f-d14e-4078-9ec1-38b02d9fc64c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mwkxewrywno2", "content": "\u3010JPCERT\u3011\u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260029.html\n\nNVNB\u306f\u8106\u5f31\u6027\u60c5\u5831\u306e\u95b2\u89a7\u3092\u652f\u63f4\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u3067\u3059\nhttps://nvnb.blossomsarchive.com/", "creation_timestamp": "2026-09-28T09:03:36.877834Z"}, {"uuid": "facf5b14-c7c1-429e-aaf0-47d56ff6b64f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzh3c36d2m", "content": "\uff1e NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49)\nhttps://www.ipa.go.jp/security/security-alert/2026/alert20260928.html\n", "creation_timestamp": "2026-09-28T09:40:10.182359Z"}, {"uuid": "bfff2440-1d7f-4e3f-b2e0-db8fc325f5a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzhb6qdd2a", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260029.html\n", "creation_timestamp": "2026-09-28T09:40:16.187320Z"}, {"uuid": "e705f9c6-22f9-4c69-adc3-5bf136ec858b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-d7266750-a3bb08d72eed91bf", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-88771 (CVSS score: 9.5) is a remote code execution vulnerability caused by improper input validation that could allow an unauthenticated remote [\u2026]U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog", "creation_timestamp": "2026-09-28T09:48:15.278686Z"}, {"uuid": "b50b7b45-3a4d-40f1-96da-3c9cd002f053", "vulnerability_lookup_origin": "cce329bf-df49-4c6e-a027-80be2e6483bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/227b6b17-783c-4b5e-ac08-a19e5e042920", "content": "", "creation_timestamp": "2026-09-28T10:00:02.283493Z"}, {"uuid": "813c4b14-f75d-4d73-a95b-f75741d546ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/thehackernews/10176", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "creation_timestamp": "2026-09-28T07:24:56.000000Z"}, {"uuid": "b48db887-2f8c-4154-8ff1-6d252300c188", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "content": "Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\n\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.", "creation_timestamp": "2026-09-28T05:29:51.000000Z"}, {"uuid": "1a835de3-451b-442c-b77c-b0bb372c67e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwl2s6tm5k27", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/28/c...\n\n#cybersecurity #cybersecuritynews #0day #exploit #vulnerability @ncsc-nl.bsky.social @doublepulsar.com @satn.am @tenablesecurity.bsky.social", "creation_timestamp": "2026-09-28T10:04:18.343166Z"}, {"uuid": "02fc9327-5a73-4876-80f2-412ecd1e1b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c74e692-5425-4c10-8018-5cd17bb338fa", "content": "", "creation_timestamp": "2026-09-28T10:37:13.542651Z"}, {"uuid": "fe4c95fc-5d8e-464b-b5c7-c3add8427ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwl4zcq2vc2n", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nwww.helpnetsecurity.com/2026/09/28/c...\n\n#Cybersecurity #Cyber #SituationalAwareness", "creation_timestamp": "2026-09-28T10:44:05.343469Z"}, {"uuid": "17479b6e-b588-4440-8e1a-7be32e7567df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "exploited", "source": "https://t.me/thehackernews/10176", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "creation_timestamp": "2026-09-28T07:24:56.000000Z"}, {"uuid": "10cd410a-9bed-4a17-bcb0-89f1a1cbac4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/papanda925.bsky.social/post/3mwl5y4p43w2p", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49)\u306e\u5bfe\u8c61\u6761\u4ef6\u3068\u5b89\u5168\u306a\u78ba\u8a8d\u624b\u9806\u3092\u6574\u7406\u3059\u308b\n\n\u672c\u8a18\u4e8b\u306fAI\u3092\u5229\u7528\u3057\u3066\u4f5c\u6210\u3057\u305f\u6280\u8853\u89e3\u8aac\u30fb\u5b9f\u88c5\u4f8b\u3067\u3059\u3002\u63b2\u8f09\u3059\u308b\u30b3\u30fc\u30c9\u3084\u624b\u9806\u306f\u4e00\u6b21\u60c5\u5831\u3092\u57fa\u306b\u69cb\u6210\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u7b46\u8005\u306b\u3088\u308b\u5b9f\u6a5f\u3067\u306e\u52d5\u4f5c\u78ba\u8a8d\u306f\u884c\u3063\u3066\u3044\u307e\u305b\u3093\u3002\u74b0\u5883\u3084\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u3088\u3063\u3066\u52d5\u4f5c\u304c\u7570\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002 NetScaler ADC\u304a\u3088\u3073NetScaler\u2026", "creation_timestamp": "2026-09-28T11:01:17.313146Z"}, {"uuid": "bea2c2da-1858-4000-81a8-64298acd14d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwl6ng4r7n2s", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs", "creation_timestamp": "2026-09-28T11:13:12.237569Z"}, {"uuid": "d9f39a16-cace-4be0-b943-25585abd48b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwl7bo5dof2k", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs", "creation_timestamp": "2026-09-28T11:24:30.980520Z"}, {"uuid": "6de214c4-fdc3-46be-8448-12e3374d83b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "creation_timestamp": "2026-09-28T11:24:41.962730Z"}, {"uuid": "fdc61815-7dea-4da3-bc6e-ef041694c855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117348440149556531", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T11:31:35.446075Z"}, {"uuid": "6ac23965-3985-4253-9485-e80e2f892b39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mwl7worgzry2", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T11:37:37.868907Z"}, {"uuid": "0b93d2c8-390f-4d62-b39e-cc0ebe80a6e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwlb6quwsi2x", "content": "Details about the Citrix Netscaler vulnerability CVE-2026-88771\n\n\u2014 from @cyb3rops (https://x.com/cyb3rops/status/2104538140145000738)", "creation_timestamp": "2026-09-28T11:58:41.005514Z"}, {"uuid": "a842e5ef-c073-452d-bd66-3f8f44bb5e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103634", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88771-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EXEcution-py\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 10:03:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nImproper Input Validation (CWE-20)  SSVC Scores Exploitation: Active Technical Impact: Total\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-28T10:04:31.000000Z"}, {"uuid": "668d1dc8-643b-4fe8-93e1-3476d2d53d8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://gist.github.com/ichintu/58cf1f5b7850f251de250b0b4ddc18ed", "content": "This 2026 cybersecurity briefing highlights critical vulnerabilities, active exploits, and emerging threat actor tactics across multiple platforms:\n\n\u2022 **Patched & High-Severity Flaws:** Google Cloud Application Integration, ManageEngine DDI Central, Apache Roller, Elixir\u2019s `mint` client, and BUFFALO Wi-Fi devices contain critical/high vulnerabilities (RCE, deserialization, DoS, and command injection). All have been patched; immediate updates to specified versions are required.\n\n\u2022 **Actively Exploited Risks:** Citrix NetScaler (CVE-2026-88771) is a critical, pre-authentication command injection flaw actively exploited by attackers, added to CISA\u2019s KEV catalog, and linked to Dutch hospital outages. FAST network devices face critical buffer overflows with public exploits and unresponsive vendors.\n\n\u2022 **Threat Actor Activity:** The JADEPUFFER/Storm-3168 group executed a destructive Azure attack via compromised service principals. Meanwhile, a ~80,000-node proxy network is harvesting and monetizing stolen AI/LLM credentials, with U.S. intelligence agencies linking the abuse to Chinese entities.\n\n\u2022 **Security Guidance:** Urgent patching is critical for Citrix, Apache Roller, ManageEngine, and FAST systems. Organizations should secure AI credentials using short-lived tokens, strict monitoring, and rapid incident response playbooks to counter credential theft and AI proxy abuse.", "creation_timestamp": "2026-09-28T12:06:15.000000Z"}, {"uuid": "0ee3d900-ddfe-4322-b31b-f364688bef1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwlbs6yt6f25", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)", "creation_timestamp": "2026-09-28T12:09:33.108703Z"}, {"uuid": "8f467411-341f-415d-999f-b20587cf90c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwlbutn7xm27", "content": "\ud83d\udcf0 CISA Perintahkan Pemerintah AS Menambal Dua Celah Kritis Citrix NetScaler Sebelum 30 September\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/28/cisa-patch-celah-citrix-netscaler-cve-2026-88771-88772/\n\n#cisa #citrix #cve #cyberSecurity #cybersecurity #keamananSiber #netscaler", "creation_timestamp": "2026-09-28T12:11:02.248647Z"}, {"uuid": "b19a6cf7-60db-4ad9-990a-f6466160ef68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwlc4dywdh2k", "content": "NetScaler ADC and Gateway patched for two zero-days: CVE-2026-88771 and CVE-2026-88772. CISA has ordered federal\u2026 https://0daynews.com/articles/2026-09-28-citrix-netscaler-patches-cve-2026-88771-cve-2026-88772/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3799", "creation_timestamp": "2026-09-28T12:15:14.627879Z"}, {"uuid": "24bda30b-5be3-443b-8368-e4da3b2c3fa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwlccmt4btzo", "content": "Citrix reports active exploitation of two critical NetScaler flaws: CVE-2026-88771 and CVE-2026-88772. Update affected customer-managed systems; CERT-EU urges compromise checks for exposed appliances.", "creation_timestamp": "2026-09-28T12:20:28.294939Z"}, {"uuid": "5101e8ce-bbaa-45ca-b443-6cdb695241d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/hack4career.com/post/3mwld2aunwc2p", "content": "Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772", "creation_timestamp": "2026-09-28T12:31:57.360213Z"}, {"uuid": "67b82400-6c29-46ed-8ea8-f053c8348a0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited", "content": "", "creation_timestamp": "2026-09-28T01:53:55.000000Z"}, {"uuid": "9d6328fa-3972-4178-a167-d7ddee1f44a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://t.me/information_security_channel/55987", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug (https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-28T10:22:26.000000Z"}, {"uuid": "4ca3ea2c-da3f-4f7d-a2a5-fb86508bf8d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-88771 (CVSS score: 9.5) - An improper input validation vulnerability that could allow an unauthenticated attacker to", "creation_timestamp": "2026-09-28T05:21:49.000000Z"}, {"uuid": "23be76b0-baf2-45d6-bf4c-d9d88346486c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://social.bund.de/users/bsi/statuses/117348804174042056", "content": "\u26a0\ufe0f \ud83d\udce2 Sicherheitswarnung: Am 27. September 2026 ver\u00f6ffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitsl\u00fccken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte \u00fcber eine aktive Ausnutzung verbreitet hatten.\nMehr dazu hier: https://www.bsi.bund.de/dok/1209522", "creation_timestamp": "2026-09-28T13:05:07.226900Z"}, {"uuid": "ab051367-043c-4029-afca-8f7beab28b98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://chaos.social/users/christopherkunz/statuses/117348842537592602", "content": "@bsi https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/Ab wann gilt der Betrieb dieser Ger\u00e4te eigentlich als fahrl\u00e4ssig?", "creation_timestamp": "2026-09-28T13:13:56.551953Z"}, {"uuid": "d5cfa17f-a54b-469d-b764-cfec84fec4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117348616624288037", "content": "CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway\n#CISA #KEV #Citrix #zeroday #CVE", "creation_timestamp": "2026-09-28T13:24:41.087862Z"}, {"uuid": "a62164a1-f00a-49cf-b8d1-64215f0791ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwlg27rcss25", "content": "Citrix says two critical NetScaler vulnerabilities are being actively exploited.\n\nCVE-2026-88771 enables unauthenticated RCE across all deployments.\n\nCVE-2026-88772 can lead to RCE or DoS where DTLS is enabled.\n\ncyberupdates365.com/citrix-netsc...\n\n#Cybersecurity #Citrix #NetScaler", "creation_timestamp": "2026-09-28T13:25:44.302693Z"}, {"uuid": "5ae22025-9b81-4bda-b8a5-59a92c9f2a49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwlg4xcmz22y", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE\n\nThis article heavily implies that the failure lies with Citrix's internal security and disclosure process rather than just a software bug. While the technical details of CVE-2026-88771 are clearly laid out, foc\u2026", "creation_timestamp": "2026-09-28T13:27:09.326347Z"}, {"uuid": "efa51d78-55b7-4f55-b73c-349c91ea16e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-88771", "type": "seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwlga6lslng2", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "creation_timestamp": "2026-09-28T13:29:03.045223Z"}, {"uuid": "4809bffc-ae80-4e65-b0ce-dd3f98d7dee6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88771", "type": "seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwlgtxbvxf23", "content": "watchTowr Labs dissects CVE-2026-88771, another pre-auth command injection in Citrix NetScaler, the appliance that keeps finding new ways to shoot itself in the foot unauthenticated. The post walks through the flaw and why yet another NetScaler CVE is keeping defenders busy patching.", "creation_timestamp": "2026-09-28T13:42:49.370564Z"}]}