{"metadata": {"vulnerability": "CVE-2026-88771", "count": 403, "kinds": {"milestone": 10, "sighting": 354, "kev": 19, "other": 20}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-10T07:14:57.369Z", "date_only": false, "value": "2026-09-10T07:14:57.369Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-88771", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-88771", "field": "timestamps.asserted_at", "uuid": "101635ac-c10a-4cfc-b18a-1dee629f73cc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "enisa-cnw-kev", "record": "CVE-2026-88771", "field": "timestamps.asserted_at", "uuid": "227b6b17-783c-4b5e-ac08-a19e5e042920", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88771", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-88771", "field": "evidence.0.details.date_added", "uuid": "101635ac-c10a-4cfc-b18a-1dee629f73cc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-88771", "field": "timestamps.first_seen_at", "uuid": "101635ac-c10a-4cfc-b18a-1dee629f73cc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "enisa-cnw-kev", "record": "CVE-2026-88771", "field": "timestamps.first_seen_at", "uuid": "227b6b17-783c-4b5e-ac08-a19e5e042920", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": true, "value": "2026-09-27", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88771", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88771", "record": "FKIE_CVE-2026-88771", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-88771", "field": "status.status_updated_at", "uuid": "101635ac-c10a-4cfc-b18a-1dee629f73cc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T00:00:00Z", "date_only": false, "value": "2026-09-27T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "enisa-cnw-kev", "record": "CVE-2026-88771", "field": "status.status_updated_at", "uuid": "227b6b17-783c-4b5e-ac08-a19e5e042920", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T09:09:00Z", "date_only": false, "value": "2026-09-27T09:09:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "99f37e90-769f-4d9c-8842-7f3884647ed6", "url": "https://www.cert.se/2026/09/information-om-kritiska-sarbarheter-i-citrixnetscaler.html"}, {"timestamp": "2026-09-27T10:21:12Z", "date_only": false, "value": "2026-09-27T10:21:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6b3df433-e1f3-43a6-a03b-6b48b9978cda", "url": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-30"}, {"timestamp": "2026-09-27T11:02:05Z", "date_only": false, "value": "2026-09-27T11:02:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "383dc789-c9cf-45ab-8cb1-d1cf2d7be8d0", "url": "https://cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772"}, {"timestamp": "2026-09-27T11:05:15Z", "date_only": false, "value": "2026-09-27T11:05:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/aktivt-utnyttelse-av-kritiske-sarbarheter-i-citrix-netscaler", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "27f12ba9-7f4c-4c13-b29b-15f2e3a261b2", "url": "https://nsm.no/fagomrader/digital-sikkerhet/digital-hendelseshandtering/varsler-fra-nsm/aktivt-utnyttelse-av-kritiske-sarbarheter-i-citrix-netscaler"}, {"timestamp": "2026-09-27T12:11:42Z", "date_only": false, "value": "2026-09-27T12:11:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2b2c0b17-ad88-457a-bd7d-48570fb45b6b", "url": "https://www.ncsc.nl/alerts/kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway-update-nu"}, {"timestamp": "2026-09-27T12:34:41Z", "date_only": false, "value": "2026-09-27T12:34:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f8f9799c-e88e-4bf3-aa79-dc14c3083369", "url": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler"}, {"timestamp": "2026-09-27T14:55:29Z", "date_only": false, "value": "2026-09-27T14:55:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ff897380-59ed-46a1-be5f-1cf05f509d81", "content": "Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway. De volgende ondersteunde versies van Citrix NetScaler ADC en Citrix NetScaler Gateway zijn kwetsbaar:\n\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 14.1 v\u00f3\u00f3r versie 14.1-73.37\n- Citrix NetScaler ADC en Citrix NetScaler Gateway 13.1 v\u00f3\u00f3r versie 13.1-64.23\n- Citrix NetScaler ADC FIPS v\u00f3\u00f3r versie 14.1-73.37 FIPS\n- Citrix NetScaler ADC FIPS en NDcPP v\u00f3\u00f3r versie 13.1-37.279\n\nSecure Private Access Hybrid-implementaties die gebruikmaken van NetScaler-instances zijn ook kwetsbaar voor deze kwetsbaarheden.\n\nDeze advisory is uitsluitend van toepassing op door klanten beheerde Citrix NetScaler ADC-systemen (\u201cNetScaler ADC\u201d) en Citrix NetScaler Gateway-systemen (\u201cNetScaler Gateway\u201d). Cloud Software Group voorziet de door Citrix beheerde clouddiensten en Citrix Managed Adaptive Authentication van de benodigde software-updates.   De kwetsbaarheden betreffen verschillende beveiligingsproblemen die onder meer kunnen leiden tot Remote Code Execution (RCE), HTTP Request Smuggling, het omzeilen van beleidsregels en Denial-of-Service. Drie kwetsbaarheden met kenmerk CVE-2026-88771, CVE-2026-88772 en CVE-2026-88773 zijn als kritiek aangemerkt.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88771 heeft een CVSS-score van 9,5 en betreft onvoldoende invoervalidatie. Een niet-geauthenticeerde kwaadwillende kan op afstand willekeurige commando's uitvoeren. Volgens Citrix zijn alle NetScaler ADC- en NetScaler Gateway-deployments getroffen en is geen aanvullende functionaliteit of specifieke configuratie voor misbruik vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88772 heeft een CVSS-score van 9,5 en betreft een memory overflow die kan leiden tot RCE of Denial-of-Service. Misbruik is mogelijk wanneer DTLS is ingeschakeld. Citrix geeft aan dat DTLS standaard is ingeschakeld op een VPN virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88773 heeft een CVSS-score van 9,3 en betreft HTTP Request Smuggling. Voor misbruik moet HTTP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway. Authenticatie en gebruikersinteractie zijn niet vereist.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88774 heeft een CVSS-score van 7,0 en kan leiden tot het omzeilen van een feature policy door onjuist gebruik van HTTP URL-gebaseerde policy expressions. De kwetsbaarheid is alleen van toepassing wanneer dergelijke expressions zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88775 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid is van toepassing op systemen die zijn geconfigureerd als Gateway, waaronder SSL VPN, ICA Proxy, CVPN en RDP Proxy, of als AAA virtual server.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88776 heeft een CVSS-score van 8,8 en betreft eveneens een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. Voor misbruik moet een load-balancing virtual server van het type Oracle zijn geconfigureerd.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88777 heeft een CVSS-score van 8,8 en betreft een memory overflow die kan leiden tot onvoorspelbaar gedrag of Denial-of-Service. De kwetsbaarheid vereist een LB-, CS- of CGNAT-LSN/NAT64-configuratie waarbij een non-HTTP Layer 7-protocol is ingeschakeld.\n\nDe kwetsbaarheid met kenmerk CVE-2026-88778 heeft een CVSS-score van 8,8 en betreft voorspelbaarheid van TCP Initial Sequence Numbers (ISN). Voor misbruik moet TCP-functionaliteit zijn ingeschakeld op NetScaler ADC of NetScaler Gateway.\n\nCitrix meldt dat misbruik van de kwetsbaarheden met kenmerk CVE-2026-88771 en CVE-2026-88772 zijn waargenomen op NetScaler-systemen.", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0394"}, {"timestamp": "2026-09-27T15:36:30.407Z", "date_only": false, "value": "2026-09-27T15:36:30.407267Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d2b9b215-7aba-4cff-9776-15b45e04ddd2", "url": "https://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6"}, {"timestamp": "2026-09-27T15:37:52.349Z", "date_only": false, "value": "2026-09-27T15:37:52.349482Z", "kind": "sighting", "label": "Seen", "source": "https://social.circl.lu/users/circl/statuses/117343746256136269", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3e75b273-f7ce-4690-84c8-1a8ccbb87b27", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nhttps://vulnerability.circl.lu/bundle/6d8bc6ad-f616-4600-9f2e-18a677efbaa6", "url": "https://social.circl.lu/users/circl/statuses/117343746256136269"}, {"timestamp": "2026-09-27T15:50:37.084Z", "date_only": false, "value": "2026-09-27T15:50:37.084913Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117343796345996830", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4aeddb2b-ed5e-4f6b-ba73-cbfafec0d5f1", "content": "Citrix has finally spoken.\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #infosec #Citrix #NetScaler #vulnerability \n@mttaggart", "url": "https://infosec.exchange/users/AAKL/statuses/117343796345996830"}, {"timestamp": "2026-09-27T15:51:00Z", "date_only": false, "value": "2026-09-27T15:51:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / NetScaler", "record": "CVE-2026-88771", "field": "containers.cna.datePublic"}, {"timestamp": "2026-09-27T15:56:07Z", "date_only": false, "value": "2026-09-27T15:56:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a24d9747-3e82-4c16-a485-e7d474ef4e83", "content": "27. September 2026\n\nBeschreibung\n\nIn Citrix NetScaler ADC und Citrix NetScaler Gateway existieren mehrere Sicherheitslücken, darunter zwei kritische Schwachstellen, die die Ausführung von beliebigem Code ermöglichen. Laut Hersteller werden CVE-2026-88771 und CVE-2026-88772 bereits aktiv ausgenutzt.\n\nCVE-Nummer(n): CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778\n\nCVSS v4.0 Base Scores: bis zu 9.5 (kritisch)\n\nAuswirkungen\n\nCVE-2026-88771 ermöglicht es nicht authentifizierten Angreifer:innen aus der Ferne, aufgrund unzureichender Eingabevalidierung beliebige Befehle auszuführen. Laut Hersteller sind alle Installationen von NetScaler ADC und NetScaler Gateway betroffen, auch in der Standardkonfiguration.\n\nCVE-2026-88772 ist ein Speicherüberlauf, der zur Ausführung von beliebigem Code oder zu Denial-of-Service führen kann. Voraussetzung ist eine aktivierte DTLS-Konfiguration; auf VPN-Virtual-Servern ist DTLS standardmäßig aktiviert.\n\nDie weiteren Schwachstellen ermöglichen HTTP Request Smuggling (CVE-2026-88773), die Umgehung von Richtlinien mit HTTP-URL-basierten Ausdrücken (CVE-2026-88774), Denial-of-Service oder fehlerhaftes Verhalten durch Speicherüberläufe (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777) sowie die Vorhersage von TCP Initial Sequence Numbers (CVE-2026-88778). Sie setzen jeweils bestimmte Konfigurationen voraus, u. a. den Betrieb als Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) oder AAA-Virtual-Server, Load-Balancing-Virtual-Server vom Typ Oracle oder aktivierte Nicht-HTTP-Layer-7-Protokollfunktionen (z. B. FTP, RTSP, DNS64, NAT64). Die genauen Voraussetzungen sowie Anleitungen zur Überprüfung der eigenen Konfiguration finden sich im Advisory des Herstellers.\n\nBetroffene Systeme\n\n\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 14.1 vor 14.1-73.37\n\nCitrix NetScaler ADC und Citrix NetScaler Gateway 13.1 vor 13.1-64.23\n\nCitrix NetScaler ADC 14.1-FIPS vor 14.1-73.37 FIPS\n\nCitrix NetScaler ADC 13.1-FIPS und 13.1-NDcPP vor 13.1-37.279\n\n\nEbenfalls betroffen sind Secure-Private-Access-Hybrid-Installationen, die NetScaler-Instanzen verwenden. Das Advisory gilt nur für kundenseitig verwaltete Installationen; von Citrix verwaltete Cloud-Dienste sowie Adaptive Authentication werden vom Hersteller aktualisiert.\n\nAbhilfe\n\nCitrix stellt Updates bereit, welche die Schwachstellen beheben: Version 14.1-73.37 bzw. 13.1-64.23 für NetScaler ADC und NetScaler Gateway sowie 14.1-73.37 FIPS bzw. 13.1-37.279 für die FIPS- und NDcPP-Varianten. Aufgrund der aktiven Ausnutzung wird dringend empfohlen, die Updates umgehend einzuspielen. Dies gilt auch für NetScaler-Instanzen in Secure-Private-Access-Hybrid-Installationen.\n\nFür von CVE-2026-88778 betroffene Systeme empfiehlt der Hersteller zusätzlich, die Option „Enhanced ISN Generation“ zu aktivieren (set ns tcpparam -enhancedISNgeneration ENABLED). Details finden sich in der Dokumentation des Herstellers.\n\nAufgrund der aktiven Ausnutzung empfiehlt CERT.at zudem, betroffene Systeme auf Anzeichen einer Kompromittierung zu überprüfen.\n\nHinweis\n\nGenerell empfiehlt CERT.at, sämtliche Software aktuell zu halten und dabei insbesondere auf automatische Updates zu setzen. Regelmäßige Neustarts stellen sicher, dass diese auch zeitnah aktiviert werden.\n\n\n\nInformationsquelle(n):\n\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (Englisch)https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n\nTCP configurations – Enhanced ISN generation (Englisch)https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation", "url": "https://www.cert.at/de/warnungen/2026/9/kritische-sicherheitslucken-in-citrix-netscaler-adc-und-netscaler-gateway-aktiv-ausgenutzt-updates-verfugbar"}, {"timestamp": "2026-09-27T16:02:07.001Z", "date_only": false, "value": "2026-09-27T16:02:07.001Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-88771", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-27T16:02:07.001Z", "date_only": false, "value": "2026-09-27T16:02:07.001Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / NetScaler", "record": "CVE-2026-88771", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-27T16:18:00.604Z", "date_only": false, "value": "2026-09-27T16:18:00.604098Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwj77jedpp2r", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d07adbae-1083-41f9-b5c2-4268bc7cf2a3", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwj77jedpp2r"}, {"timestamp": "2026-09-27T16:18:01.339Z", "date_only": false, "value": "2026-09-27T16:18:01.339220Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mwj77jtazd2x", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "937e2885-0a10-4198-b10c-7cde52aa6896", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n\n#Citrix #NetScaler #ZeroDay #RCE #PotatoSecurity #VPN #watchTowr #PatchNow", "url": "https://bsky.app/profile/potato.software/post/3mwj77jtazd2x"}, {"timestamp": "2026-09-27T16:23:40.577Z", "date_only": false, "value": "2026-09-27T16:23:40.577848Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cherdt.bsky.social/post/3mwj7jogrcc2y", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f0762419-c794-4f74-87a0-1934d31c3000", "content": "Citrix released patched today for 8 NetScaler vulnerabilities, CVE-2026-88771 through CVE-2026-88778.\n\nAlthough I don't know all the details, word is that one or more of these vulnerabilities are being actively exploited. Patch as soon as possible.", "url": "https://bsky.app/profile/cherdt.bsky.social/post/3mwj7jogrcc2y"}, {"timestamp": "2026-09-27T16:24:30Z", "date_only": false, "value": "2026-09-27T16:24:30.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10175", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3134c878-4028-4657-ab0e-47b2afea2f42", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://t.me/thehackernews/10175"}, {"timestamp": "2026-09-27T16:24:30Z", "date_only": false, "value": "2026-09-27T16:24:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10175", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7a3987ee-1edf-483a-9498-e99b59aa9f06", "content": "\u203c\ufe0f BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments.\n\nThe new advisory covers 8 new CVEs affecting NetScaler ADC and Gateway.\n\nRead details \u2192 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://t.me/thehackernews/10175"}, {"timestamp": "2026-09-27T16:36:33.859Z", "date_only": false, "value": "2026-09-27T16:36:33.859256Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117343976965806995", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0844fe5f-b763-46e3-88ab-3588cae10539", "content": "A new vulnerability with increased severity was disclosed for Citrix ADC and Gateway (CVE-2026-88771) https://vuldb.com/vuln/410912", "url": "https://infosec.exchange/users/vuldb/statuses/117343976965806995"}, {"timestamp": "2026-09-27T16:44:00Z", "date_only": false, "value": "2026-09-27T16:44:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-88771", "field": "timestamps.asserted_at", "uuid": "8531502c-38a6-45cf-a019-1e85f05f720a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:44:00Z", "date_only": false, "value": "2026-09-27T16:44:00.000Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-88771", "field": "evidence.0.details.added_date", "uuid": "8531502c-38a6-45cf-a019-1e85f05f720a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:44:00Z", "date_only": false, "value": "2026-09-27T16:44:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-88771", "field": "timestamps.first_seen_at", "uuid": "8531502c-38a6-45cf-a019-1e85f05f720a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:44:00Z", "date_only": false, "value": "2026-09-27T16:44:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-88771", "field": "status.status_updated_at", "uuid": "8531502c-38a6-45cf-a019-1e85f05f720a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T16:55:29.765Z", "date_only": false, "value": "2026-09-27T16:55:29.765476Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-27T16:55:29.765Z", "date_only": false, "value": "2026-09-27T16:55:29.765476Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-27T17:00:13.418Z", "date_only": false, "value": "2026-09-27T17:00:13.418058Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mwjbkwf7sc22", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6a8aa976-51df-4ec2-8b7e-1d9055befba7", "content": "\ud83d\udea8 CVE-2026-88771 & CVE-2026-88772: Citrix has patched two exploited NetScaler zero-days (CVSS 9.5). Update to 14.1-73.37 / 13.1-64.23 and check for compromise.\nwww.cyberkendra.com/2026/09/cve-... \n\n#citrixvulnerability #netscaler #zeroday #infosec", "url": "https://bsky.app/profile/cyberkendra.com/post/3mwjbkwf7sc22"}, {"timestamp": "2026-09-27T17:00:47.360Z", "date_only": false, "value": "2026-09-27T17:00:47.360581Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwjblzg2jz2p", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c9379a8a-1312-4bc4-9a72-c7aeae252056", "content": "Citrix lanceert noodupdates na actieve uitbuiting van kritieke kwetsbaarheden in\n\nCitrix heeft beveiligingsupdates uitgebracht voor NetScaler ADC en NetScaler Gateway vanwege twee kritieke kwetsbaarheden, CVE-2026-88771 en CVE-2026-88772, die momenteel actief worden uitgebuit. Beide kwetsbaa...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwjblzg2jz2p"}, {"timestamp": "2026-09-27T17:11:09.472Z", "date_only": false, "value": "2026-09-27T17:11:09.472954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjc6lkxem2k", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3932fa41-0225-4ea3-9fdc-409e13bc9825", "content": "\ud83e\udd16 Citrix NetScaler: 2 RCE zero-days exploited pre-patch, CVSS 9.5 each. CVE-2026-88771 hits every deployment (unauth cmd exec); CVE-2026-88772 via DTLS, default on VPN vservers. Fixed: 14.1-73.37 / 13.1-64.23.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwjc6lkxem2k"}, {"timestamp": "2026-09-27T17:16:56Z", "date_only": false, "value": "2026-09-27T17:16:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MX58-P288-86QP", "record": "GHSA-MX58-P288-86QP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-27T17:16:56.260Z", "date_only": false, "value": "2026-09-27T17:16:56.260", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88771", "record": "FKIE_CVE-2026-88771", "field": "published"}, {"timestamp": "2026-09-27T17:25:16.128Z", "date_only": false, "value": "2026-09-27T17:25:16.128015Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3f13ee84-c694-45be-aad3-1fc12e9323fc", "content": "\u203c\ufe0f Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.\nMore info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\nCVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117344168526853624"}, {"timestamp": "2026-09-27T17:34:41Z", "date_only": false, "value": "2026-09-27T17:34:41.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2008b61b-0d5e-4f2c-8840-2d5205e85fc0", "content": "Citrix ha rilasciato aggiornamenti di sicurezza per ADC e Gateway, prodotti NetScaler dedicati alla distribuzione, gestione e accesso sicuro ad applicazioni e servizi, che sanano 8 vulnerabilit\u00e0, di cui 3 con gravit\u00e0 \"critica\" e 5 con gravit\u00e0 \"alta\". Tra queste si evidenziano le vulnerabilit\u00e0 identificate tramite CVE-2026-88771 e CVE-2026-88772, per le quali Citrix ha osservato lo sfruttamento su sistemi NetScaler non aggiornati.", "url": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler"}, {"timestamp": "2026-09-27T18:00:00Z", "date_only": false, "value": "2026-09-27T18:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "01d14b1f-85ef-4cea-9e2e-90406f689a9e", "url": "https://www.hkcert.org/security-bulletin/citrix-products-multiple-vulnerabilities_20260928"}, {"timestamp": "2026-09-27T18:07:06.253Z", "date_only": false, "value": "2026-09-27T18:07:06.253715Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfcmp2oj25", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2f40124f-2f26-44b2-b2b4-482c6cfe3367", "content": "\ud83d\udea8 CVE-2026-88771 \u2014 CVSS 9.5 CRITICAL\n\nImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue af...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88771\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwjfcmp2oj25"}, {"timestamp": "2026-09-27T18:10:04.501Z", "date_only": false, "value": "2026-09-27T18:10:04.501101Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfhwp7rv2k", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "fdd083de-6b50-4fd4-851c-5ed63c9e0c40", "content": "CVE-2026-88771\nOlder versions of Citrix NetScaler ADC and NetScaler Gateway do not properly check certain inputs, which could let an unauthenticated attacker run commands on the device. This could give the attacker control\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwjfhwp7rv2k"}, {"timestamp": "2026-09-27T18:29:25.814Z", "date_only": false, "value": "2026-09-27T18:29:25.814320Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgkjhqgb2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7ff927fb-260c-4c8c-a84e-064ec76d391b", "content": "CVE-2026-88771 is trending. Hype score 33, currently #1 on cvemon.\n\nImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS,\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-88771", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mwjgkjhqgb2f"}, {"timestamp": "2026-09-27T18:30:22Z", "date_only": false, "value": "2026-09-27T18:30:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MX58-P288-86QP", "record": "GHSA-MX58-P288-86QP", "field": "published"}, {"timestamp": "2026-09-27T19:36:49.601Z", "date_only": false, "value": "2026-09-27T19:36:49.601593Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117343817673361515", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "01867a92-2a2f-4b55-b82f-2e6047156be7", "content": "Citrix NetScaler zero-days\n\nExploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.\nThis is a Monday problem for me, but you're better off knowing what to expect when coming into work tomorrow. h/t @mttaggart \nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096\n#citrix #netscaler #zeroday #cve", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117343817673361515"}, {"timestamp": "2026-09-27T19:37:04.565Z", "date_only": false, "value": "2026-09-27T19:37:04.565278Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/116797276219291526/statuses/117343904630365522", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "fb34528b-773d-4065-87cf-ccd286557a47", "content": "Two Citrix NetScaler zero-day RCE flaws are under active exploitation. Citrix confirmed CVE-2026-88771 and CVE-2026-88772 and shipped patches. Update now.\n#Citrix #NetScaler #ZeroDay #RCE #CyberSecurity #VPN #watchTowr #PatchNow\nhttps://securityonline.info/citrix-netscaler-zero-day-rce/?utm_source=mastodon&utm_medium=jetpack_social", "url": "https://infosec.exchange/ap/users/116797276219291526/statuses/117343904630365522"}, {"timestamp": "2026-09-27T19:37:30.798Z", "date_only": false, "value": "2026-09-27T19:37:30.798519Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cloud/statuses/117344112149380671", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7ff4123f-76d8-4081-b011-f7ed23e7710c", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: two RCE zero-days exploited in the wild before any fix, CVSS v4 9.5 each. CVE-2026-88771 hit every deployment (unauth command execution); CVE-2026-88772 needs DTLS, on by default for VPN vservers. Fixed in 14.1-73.37 / 13.1-64.23.\ud83d\udd17 https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html#CVE #Exploit #NetScaler #CyberSec", "url": "https://infosec.exchange/users/cloud/statuses/117344112149380671"}, {"timestamp": "2026-09-27T19:38:01.931Z", "date_only": false, "value": "2026-09-27T19:38:01.931830Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117064736050780246/statuses/117344423181886454", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "846870c7-d0bc-44fb-b16b-318e6da861e2", "content": "Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after confirmed exploitation of unmitigated systems. Edge appliances remain high-value targets, and the September 27 release also fixes six other flaws requiring immediate patching. #Citrix #NetScaler #ZeroDay #VulnerabilityManagement\nhttps://cyberworldops.eu/en/citrix-patches-two-netscaler-zero-days-after-attackers-breach", "url": "https://infosec.exchange/ap/users/117064736050780246/statuses/117344423181886454"}, {"timestamp": "2026-09-27T19:45:23.525Z", "date_only": false, "value": "2026-09-27T19:45:23.525142Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwjksevdsq2p", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "8e745a4e-d8ff-40ab-a002-ed74575a2acf", "content": "Citrix confirms active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, enabling remote code execution and denial of service. #Citrix #NetScaler #RCE", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwjksevdsq2p"}, {"timestamp": "2026-09-27T19:58:06.163Z", "date_only": false, "value": "2026-09-27T19:58:06.163542Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/zackwhittaker.com/post/3mwjlj2oots27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "cd95d6b0-cf9b-4f0b-83ff-4ca4df250a46", "content": "CISA has confirmed two bugs in Citrix NetScaler are being exploited in active cyberattacks, CVE-2026-88771 and CVE-2026-88772, in a rare weekend drop of security news. www.cisa.gov/known-exploi...\n\nCitrix has a support base article, confirming exploitation. support.citrix.com/support-home...", "url": "https://bsky.app/profile/zackwhittaker.com/post/3mwjlj2oots27"}, {"timestamp": "2026-09-27T20:01:14.906Z", "date_only": false, "value": "2026-09-27T20:01:14.906009Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlopz7wo2b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "23dfa00c-c7f1-472d-a9c5-e714293309eb", "content": "~Certeu~\nCitrix confirms active exploitation of two unauthenticated NetScaler RCEs; patch immediately and assess internet-facing appliances.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwjlopz7wo2b"}, {"timestamp": "2026-09-27T20:02:35.641Z", "date_only": false, "value": "2026-09-27T20:02:35.641108Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlr55n5d2g", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7ae4efca-2d6a-4f91-a19a-19465c58ab76", "content": "~Cisa~\nCISA reports active exploitation of two Citrix NetScaler vulnerabilities and urges rapid remediation.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwjlr55n5d2g"}, {"timestamp": "2026-09-27T20:03:40Z", "date_only": false, "value": "2026-09-27T20:03:40.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/880d8b4087a6fd9cbf8625bb1b4c754e", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3e1a0b21-c9f9-4c18-9ea6-9e5dc9080a3c", "content": "This update covers multiple high- and critical-severity vulnerabilities disclosed around September 27, 2026. The most severe impact affects **Citrix NetScaler ADC and Gateway**, which face numerous critical flaws (including CVE-2026-88771 and 88772) enabling unauthenticated remote code execution, memory overflows, HTTP request smuggling, and TCP session prediction. Active exploitation is confirmed, requiring an immediate patch to versions 14.1-73.37 or 13.1-64.23. \n\nOther affected systems include **pnpm** (environment variable exfiltration via proxy configs, patched in 10.34.5/11.11.0), **Fleet** (command injection via cask metadata, patched in v4.92.0), **python-utcp** (SSRF via redirect bypass, patched in 1.1.4), and **Heym** (authentication bypasses for Telegram and Slack webhooks, patched in 0.0.53). \n\nRemediation guidance emphasizes patching to specified versions, temporarily disabling internet-facing Citrix appliances, preserving forensic logs, investigating for compromise, and aligning defenses with cybersecurity hardening best practices.", "url": "https://gist.github.com/ichintu/880d8b4087a6fd9cbf8625bb1b4c754e"}, {"timestamp": "2026-09-27T20:03:54.575Z", "date_only": false, "value": "2026-09-27T20:03:54.575365Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwjlthkufc2e", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ebf1a866-8846-432e-982f-77e758425b5a", "content": "~Cybergcca~\nActive exploitation of NetScaler flaws enables remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #CyberSecurity #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwjlthkufc2e"}, {"timestamp": "2026-09-27T20:39:32.549Z", "date_only": false, "value": "2026-09-27T20:39:32.549130Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwjnt7hfzn25", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f28bbdd2-9858-4ccf-abcb-ffdb5ea55d18", "content": "AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway \u2013 CVE-2026-88771 and CVE-2026-88772", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwjnt7hfzn25"}, {"timestamp": "2026-09-27T21:00:00Z", "date_only": false, "value": "2026-09-27T21:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5096d26e-d574-4adc-9335-e053648c6220", "url": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2083"}, {"timestamp": "2026-09-27T21:23:13.715Z", "date_only": false, "value": "2026-09-27T21:23:13.715730Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mwjqbd7eom2l", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "70c05d65-067b-4f24-818e-8aec947211dc", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88771: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-7\u2026\nCVSS 9.5 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-88771\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mwjqbd7eom2l"}, {"timestamp": "2026-09-27T21:57:36.092Z", "date_only": false, "value": "2026-09-27T21:57:36.092824Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6rtxrq2q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b19e6da5-55bb-4874-aea9-d4a2910003de", "content": "\ud83d\uded1 CVE-2026-88771\nCitrix NetScaler\nCVSS 9.5 / KEV: No\nTL;DR: Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This i\u2026\nhttps://cvesentinel.com/report/CVE-2026-88771?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwjs6rtxrq2q"}, {"timestamp": "2026-09-27T22:00:01Z", "date_only": false, "value": "2026-09-27T22:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-88771", "field": "timestamps.recorded_at", "uuid": "101635ac-c10a-4cfc-b18a-1dee629f73cc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T22:00:03.772Z", "date_only": false, "value": "2026-09-27T22:00:03.772141Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/101635ac-c10a-4cfc-b18a-1dee629f73cc", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6c59ba72-c197-4e9e-b31a-9d94b65e9339", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/101635ac-c10a-4cfc-b18a-1dee629f73cc"}, {"timestamp": "2026-09-27T23:00:31Z", "date_only": false, "value": "2026-09-27T23:00:31.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44631", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "bb9f96a9-1035-4c60-b32d-3f069e27c845", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "url": "https://t.me/VulnerabilityNews/44631"}, {"timestamp": "2026-09-27T23:00:38Z", "date_only": false, "value": "2026-09-27T23:00:38.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44635", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ccaa9d0c-77e8-47ca-b6d8-535ce26eaf95", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\n\nCISA has added two new vulnerabilities to its\u00a0Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.\nCVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability\nCVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability\nThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of\u00a0KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the\u00a0specified criteria.\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s\u00a0KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog", "url": "https://t.me/VulnerabilityNews/44635"}, {"timestamp": "2026-09-27T23:00:40Z", "date_only": false, "value": "2026-09-27T23:00:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44636", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "bb99c059-b67a-4934-85ab-3b0ed09a7cc9", "content": "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway\n\nCISA is amplifying Citrix\u2019s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.\u00a0\nCISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nBecause updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.\u00a0\nGiven the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix\u2019s advisories. If possible, users are encouraged to check for indication of compromise prior to patching. Citrix has made indicators of compromise available through NetScaler Console and published additional guidance in their recent publication, Security Bulletin for CVE-2026-88771 through CVE-2026-88778, to support organizations in assessing potential compromise. Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility.\u00a0\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 - Security Updates - Citrix Community\nCitrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778\nSteps to Take if NetScaler ADC is Suspected to be Compromised\nDisclaimer\nThe information in this report is being provided \u201cas is\u201d for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway", "url": "https://t.me/VulnerabilityNews/44636"}, {"timestamp": "2026-09-27T23:03:26.957Z", "date_only": false, "value": "2026-09-27T23:03:26.957388Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7126fe0d-534b-4a3b-987c-a83caa3d8d75", "content": "Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.\n\nwww.deyda.net/index.php/en...\n\n#DeydaConsulting #NetScaler #Citrix", "url": "https://bsky.app/profile/deyda.bsky.social/post/3mwjvuhxjlc2w"}, {"timestamp": "2026-09-27T23:07:06.579Z", "date_only": false, "value": "2026-09-27T23:07:06.579294Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mwjw334u4i2q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b8389bac-3acc-4c5b-9037-520f732c6d6e", "content": "Citrix patched the NetScaler zero-days alerted this morning, weeks ahead of the Sept 28 timeline first reported. CISA confirms active global exploitation, added CVE-2026-88771 and 88772 to KEV, and warns patching can erase forensic evidence of prior compromise. cisa.gov/news-events/ale...", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mwjw334u4i2q"}, {"timestamp": "2026-09-27T23:16:13.631Z", "date_only": false, "value": "2026-09-27T23:16:13.631362Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9829e66e-8794-4319-8400-a586dd106f81", "content": "Emergency Citrix Patch and the $2.2M Vendor Liability Lesson\n\nFirst, Citrix has confirmed that two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and NetScaler Gateway are being actively exploited by attackers.\n\nhttps://youtu.be/ean43KG9b1g", "url": "https://bsky.app/profile/tccubed.com/post/3mwjwldxenr2l"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "last_revision_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "initial_release_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "initial_release_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": false, "value": "2026-09-28T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1235", "record": "CERTFR-2026-AVI-1235", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-28T00:00:12.579Z", "date_only": false, "value": "2026-09-28T00:00:12.579954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/windowsforum.com/post/3mwjyzwec2o2x", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "13e6fb22-ba1d-4651-b6fc-f9275b8b4ae8", "content": "Re-patch NetScaler: CISA says exploited CVE-2026-88771/88772 need new fixes even after August updates. Oct. 7: Microsoft and NVIDIA share a stage. Also: Wi\u2011Fi link checks, Explorer Recents, C: shrink blockers. +23 more stories", "url": "https://bsky.app/profile/windowsforum.com/post/3mwjyzwec2o2x"}, {"timestamp": "2026-09-28T00:56:58Z", "date_only": false, "value": "2026-09-28T00:56:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a9ba8778-0b69-487f-ac22-05a815b3191e", "url": "https://www.cert.si/si-cert-2026-06-kriticne-ranljivosti-v-citrix-netscaler-adc-in-gateway"}, {"timestamp": "2026-09-28T01:53:55Z", "date_only": false, "value": "2026-09-28T01:53:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "67b82400-6c29-46ed-8ea8-f053c8348a0b", "url": "https://ccb.belgium.be/advisories/warning-citrix-netscaler-adc-netscaler-gateway-rce-vulnerabilities-actively-exploited"}, {"timestamp": "2026-09-28T01:55:49.597Z", "date_only": false, "value": "2026-09-28T01:55:49.597545Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwk7ir4e7v2h", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "5cfa7346-b180-4060-a962-1cc434387b14", "content": "CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability\n\nCitrix NetScaler ADC and NetScaler Gateway contain an improper input validat\u2026\n\nhttps://planetbriefing.com/events/cve-2026-88771-citrix-netscaler-improper-input-validation-vulnerability-784752551976\n\n#Technology #UnitedStates", "url": "https://bsky.app/profile/planetbriefing.bsky.social/post/3mwk7ir4e7v2h"}, {"timestamp": "2026-09-28T03:24:17.860Z", "date_only": false, "value": "2026-09-28T03:24:17.860252Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "06a7214c-33fb-4030-8592-a6e883d53f7e", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 27\uff09\n\nCVE-2026-88771 Citrix NetScaler \u5165\u529b\u691c\u8a3c\u306e\u4e0d\u5099\nCVE-2026-88772 Citrix NetScaler\u306b\u304a\u3051\u308b\u30e1\u30e2\u30ea\u30d0\u30c3\u30d5\u30a1\u306e\u7bc4\u56f2\u5185\u3067\u306e\u64cd\u4f5c\u306e\u4e0d\u9069\u5207\u306a\u5236\u9650\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkegxw3ef2v"}, {"timestamp": "2026-09-28T04:04:23.091Z", "date_only": false, "value": "2026-09-28T04:04:23.091955Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9ef159e4-b734-482d-9aa5-7feb4423c715", "content": "~Cisa~\nThreat actors are globally exploiting two critical NetScaler zero-days enabling remote code execution.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwkgon3ufi26"}, {"timestamp": "2026-09-28T04:59:56.613Z", "date_only": false, "value": "2026-09-28T04:59:56.613787Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwkjryaqvd26", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "c8fa8033-1f3e-4dc5-b141-c8ec42509d6e", "content": "\ud83d\udcf0 Citrix Konfirmasi Dua Zero-Day NetScaler RCE Dieksploitasi dalam Serangan\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/28/citrix-netscaler-zero-day-cve-2026-88771-88772/\n\n#citrix #cve #cybersecurity #keamananSiber #netscaler #netscalerAdc #netscalerGateway #networkSecurity ", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwkjryaqvd26"}, {"timestamp": "2026-09-28T05:00:00Z", "date_only": false, "value": "2026-09-28T05:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1a92db2e-6652-4241-9ddc-90eac38d1c6e", "url": "https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway"}, {"timestamp": "2026-09-28T05:16:20Z", "date_only": false, "value": "2026-09-28T05:16:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "96c3c540-8b94-4546-a9fe-33aa66877370", "url": "https://cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-965"}, {"timestamp": "2026-09-28T05:21:49Z", "date_only": false, "value": "2026-09-28T05:21:49.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4ca3ea2c-da3f-4f7d-a2a5-fb86508bf8d9", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.\n\nThe vulnerabilities are listed below -\n\n\n  CVE-2026-88771 (CVSS score: 9.5) - An improper input validation vulnerability that could allow an unauthenticated attacker to", "url": "https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html"}, {"timestamp": "2026-09-28T05:29:51Z", "date_only": false, "value": "2026-09-28T05:29:51.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b48db887-2f8c-4154-8ff1-6d252300c188", "content": "Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\n\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.", "url": "https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/"}, {"timestamp": "2026-09-28T05:31:41.424Z", "date_only": false, "value": "2026-09-28T05:31:41.424000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "acc21fe2-8df8-475b-b218-aada4bfbbf3b", "url": "https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771"}, {"timestamp": "2026-09-28T05:56:51.950Z", "date_only": false, "value": "2026-09-28T05:56:51.950659Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwkmxrrqa22q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "82819c0b-7312-4e8a-8568-66092cf41141", "content": "\ud83d\udee1\ufe0f Revue cyber du 28 sept :\n\n\u2022 Citrix NetScaler : 2 zero-days RCE exploit\u00e9s (CVE-2026-88771/88772). Patcher + invalider les sessions.\nhttps://bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwkmxrrqa22q"}, {"timestamp": "2026-09-28T05:56:52.467Z", "date_only": false, "value": "2026-09-28T05:56:52.467694Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mwkmxs6si62w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "115dd9a8-754b-49a1-9b4b-145d716227f2", "content": "\ud83d\udee1\ufe0f Revue potato du 28 sept :\n\n\u2022 Citrix NetScaler : 2 zero-days RCE exploit\u00e9s (CVE-2026-88771/88772). Patcher + invalider les sessions.\nhttps://bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/", "url": "https://bsky.app/profile/potato.software/post/3mwkmxs6si62w"}, {"timestamp": "2026-09-28T06:09:32.181Z", "date_only": false, "value": "2026-09-28T06:09:32.181319Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwknogr2dp2q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a08f47a5-a573-4f1f-a40d-af71815cad18", "content": "Analysis: CVE-2026-88771 and CVE-2026-88772", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwknogr2dp2q"}, {"timestamp": "2026-09-28T06:30:58.671Z", "date_only": false, "value": "2026-09-28T06:30:58.671845Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwkourw2ke2s", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "bda7be68-7242-4a8b-9a25-00a5e9bff435", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-88771: \u26a0\ufe0f CVE-2026-88771: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-88771-improper-input-validation-vulnerability-in-citrix", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwkourw2ke2s"}, {"timestamp": "2026-09-28T07:00:08.055Z", "date_only": false, "value": "2026-09-28T07:00:08.055101Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwkqivpzaq27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e8b2734b-4bb7-45f5-9de7-f98427fae2e1", "content": "\ud83d\udce2 \u26a0\ufe0f [VULN] Citrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es CVE-2026-88771 CVE-2026-88772\n\nCitrix corrige deux failles NetScaler d\u00e9j\u00e0 exploit\u00e9es. Les entreprises doivent v\u00e9rifier les versions et rechercher une possible intrusion sur leurs \u00e9quipements.\n\n#CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwkqivpzaq27"}, {"timestamp": "2026-09-28T07:00:12.756Z", "date_only": false, "value": "2026-09-28T07:00:12.756241Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/index.fomoera.com.ap.brid.gy/post/3mwkqivzj67n2", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "84fe006e-9fa8-4974-8bf1-e6616b2a6078", "content": "Citrix liber\u00f3 el 27 de septiembre parches para CVE-2026-88771 y CVE-2026-88772, dos fallas cr\u00edticas de NetScaler ADC y Gateway que ya se explotaban. Los equipos actualizados en agosto siguen expuestos y CISA pide revisar antes de parchar.", "url": "https://bsky.app/profile/index.fomoera.com.ap.brid.gy/post/3mwkqivzj67n2"}, {"timestamp": "2026-09-28T07:24:56Z", "date_only": false, "value": "2026-09-28T07:24:56.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10176", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "17479b6e-b588-4440-8e1a-7be32e7567df", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "url": "https://t.me/thehackernews/10176"}, {"timestamp": "2026-09-28T07:24:56Z", "date_only": false, "value": "2026-09-28T07:24:56.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10176", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "813c4b14-f75d-4d73-a95b-f75741d546ef", "content": "\u26a0\ufe0f CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally.\n\nCVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled.\n\nCitrix has fixes and IoCs.\n\nRead: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html", "url": "https://t.me/thehackernews/10176"}, {"timestamp": "2026-09-28T07:28:47.324Z", "date_only": false, "value": "2026-09-28T07:28:47.324199Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwks45oiwt2n", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e025904f-149b-4b66-8d1e-d0fd731040ac", "content": "\ud83e\udd16 Citrix NetScaler ADC/Gateway: CVE-2026-88771 + CVE-2026-88772 (unauth RCE) exploited in the wild. One hits default configs, the other needs DTLS. CISA KEV, FCEB deadline Sep 30.\nhttps://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwks45oiwt2n"}, {"timestamp": "2026-09-28T07:32:35.890Z", "date_only": false, "value": "2026-09-28T07:32:35.890632Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3c5f412d-ede1-4cf0-ac46-a5be5344db27", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24"}, {"timestamp": "2026-09-28T07:45:12.742Z", "date_only": false, "value": "2026-09-28T07:45:12.742020Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwkszjefso2c", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "681accf0-00e2-4cc0-900a-d84507369945", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwkszjefso2c"}, {"timestamp": "2026-09-28T07:45:24.760Z", "date_only": false, "value": "2026-09-28T07:45:24.760202Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwkszv2vxu2m", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "82cebced-ee2d-4f09-a130-4fc61ee71ca3", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwkszv2vxu2m"}, {"timestamp": "2026-09-28T07:45:41.565Z", "date_only": false, "value": "2026-09-28T07:45:41.565523Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwkt2ezry22y", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c7f652cb-baed-41ff-8bd5-c69596a30192", "content": "Citrix released patches for exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, prompting CISA KEV listing and global exploitation warnings.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwkt2ezry22y"}, {"timestamp": "2026-09-28T07:57:08.278Z", "date_only": false, "value": "2026-09-28T07:57:08.278793Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwktos6gfcfa", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4cd8da4c-22c7-47ea-89b0-3cf4f92c7574", "content": "NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a42\u4ef6\u3001\u653b\u6483\u3067\u306e\u60aa\u7528\u3092Citrix\u304c\u78ba\u8a8d\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47848/", "url": "https://bsky.app/profile/shiojiri.com/post/3mwktos6gfcfa"}, {"timestamp": "2026-09-28T08:00:31Z", "date_only": false, "value": "2026-09-28T08:00:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/1d63d88b130a22aa8e7576cfb85d5791", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a6c3f4e2-b3c2-4e9c-917b-9605f08bfc8c", "content": "On September 28, 2026, threat intelligence highlights multiple critical, publicly disclosed vulnerabilities across widely used platforms and network hardware. **aaPanel BaoTa** (v\u226411.8.0) and **Netcore routers** (NBR200V2/NBR100V2) are affected by several remote OS command injection and authorization bypass flaws (CVSS 8.5\u201310.0), with vendors remaining unresponsive to early notifications. Additional disclosures include a HIGH-severity LFI/SSRF vulnerability in Joomla\u2019s **Modules Anywhere** extension, an RCE in **OpenCode**, and active **Citrix NetScaler** zero-days (CVE-2026-88771/88772) recently added to CISA\u2019s KEV catalog due to real-world exploitation. Organizations should prioritize immediate patching, enforce compensating controls, and monitor for active threat campaigns.", "url": "https://gist.github.com/ichintu/1d63d88b130a22aa8e7576cfb85d5791"}, {"timestamp": "2026-09-28T08:29:59.063Z", "date_only": false, "value": "2026-09-28T08:29:59.063736Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mwkvjiucu22y", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ea14b467-eaaa-4c5f-aa4a-c419e1fc2159", "content": "CVE-2026-88771 & CVE-2026-88772 (CVSS 9.5, CISA KEV): two Citrix NetScaler RCE zero-days exploited before a patch existed. 88771 hits default configs unauthenticated. Upgrade to 14.1-73.37 / 13.1-64.23. Query: (product~\"Citrix NetScaler\") and last_seen>-7D", "url": "https://bsky.app/profile/modat-io.bsky.social/post/3mwkvjiucu22y"}, {"timestamp": "2026-09-28T08:38:49.501Z", "date_only": false, "value": "2026-09-28T08:38:49.501112Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwkvzczigcfa", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "399cda75-a9ce-4c71-99ad-d65e54888c26", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 https://www.jpcert.or.jp/at/2026/at260029.html", "url": "https://bsky.app/profile/shiojiri.com/post/3mwkvzczigcfa"}, {"timestamp": "2026-09-28T08:45:05.846Z", "date_only": false, "value": "2026-09-28T08:45:05.846955Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9608ffb2-2443-4b36-ad9c-21601a819380", "content": "\ud83d\udd17 CVE : CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwkweluzbu2d"}, {"timestamp": "2026-09-28T09:00:21.755Z", "date_only": false, "value": "2026-09-28T09:00:21.755795Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cert-fr.bsky.social/post/3mwkx7v3rjp2q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0b7a0329-1c83-44a1-9186-33e7dfcabea0", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0f\nLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\n\nwww.cert.ssi.gouv.fr/alerte/CERTF...", "url": "https://bsky.app/profile/cert-fr.bsky.social/post/3mwkx7v3rjp2q"}, {"timestamp": "2026-09-28T09:00:23.218Z", "date_only": false, "value": "2026-09-28T09:00:23.218003Z", "kind": "sighting", "label": "Seen", "source": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117347845378892968", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "00f2450f-1a0f-4572-bfe8-fe9bc5ea862b", "content": "\u26a0\ufe0f Alerte CERT-FR \u26a0\ufe0fLes vuln\u00e9rabilit\u00e9s CVE-2026-88771 et CVE-2026-88772 sont activement exploit\u00e9es et permettent une RCE pr\u00e9-authentification sur Citrix NetScaler ADC et Gateway.\nhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "url": "https://social.numerique.gouv.fr/users/cert_fr/statuses/117347845378892968"}, {"timestamp": "2026-09-28T09:01:29.770Z", "date_only": false, "value": "2026-09-28T09:01:29.770912Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwkxbwddev2z", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "577b445d-af3e-434e-9172-af99f19be64a", "content": "\u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\n\nCloud Software Group\u304c9\u670827\u65e5\u306bNetScaler ADC\u304a\u3088\u3073Gateway\u306e8\u3064\u306e\u8106\u5f31\u6027\u3092\u516c\u8868\u3057\u307e\u3057\u305f\u3002CVE-2026-88771\u3001CVE-2026-88772\u306f\u8a8d\u8a3c\u306a\u3057\u3067\u30ea\u30e2\u30fc\u30c8\u653b\u6483\u8005\u306b\u3088\u308b\u4efb\u610f\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3067\u3001\u3059\u3067\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002CVE-2026-88771\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u69cb\u6210\u542b\u3080\u3059\u3079\u3066\u306e\u69cb\u6210\u304c\u5f71\u97ff\u3092\u53d7\u3051\u3001CVE-2026-8877\u2026\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "url": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mwkxbwddev2z"}, {"timestamp": "2026-09-28T09:03:36.877Z", "date_only": false, "value": "2026-09-28T09:03:36.877834Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mwkxewrywno2", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e48b315f-d14e-4078-9ec1-38b02d9fc64c", "content": "\u3010JPCERT\u3011\u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260029.html\n\nNVNB\u306f\u8106\u5f31\u6027\u60c5\u5831\u306e\u95b2\u89a7\u3092\u652f\u63f4\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u3067\u3059\nhttps://nvnb.blossomsarchive.com/", "url": "https://bsky.app/profile/nvnb.misskey.io.ap.brid.gy/post/3mwkxewrywno2"}, {"timestamp": "2026-09-28T09:40:10.182Z", "date_only": false, "value": "2026-09-28T09:40:10.182359Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzh3c36d2m", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "facf5b14-c7c1-429e-aaf0-47d56ff6b64f", "content": "\uff1e NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49)\nhttps://www.ipa.go.jp/security/security-alert/2026/alert20260928.html\n", "url": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzh3c36d2m"}, {"timestamp": "2026-09-28T09:40:16.187Z", "date_only": false, "value": "2026-09-28T09:40:16.187320Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzhb6qdd2a", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "bfff2440-1d7f-4e3f-b2e0-db8fc325f5a0", "content": "\uff1e \u6ce8\u610f\u559a\u8d77: NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77  (\u516c\u958b)\nhttps://www.jpcert.or.jp/at/2026/at260029.html\n", "url": "https://bsky.app/profile/crawler.baldanders.info/post/3mwkzhb6qdd2a"}, {"timestamp": "2026-09-28T09:48:15.278Z", "date_only": false, "value": "2026-09-28T09:48:15.278686Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-d7266750-a3bb08d72eed91bf", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e705f9c6-22f9-4c69-adc3-5bf136ec858b", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-88771 (CVSS score: 9.5) is a remote code execution vulnerability caused by improper input validation that could allow an unauthenticated remote [\u2026]U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog", "url": "https://poliverso.org/objects/0477a01e-d7266750-a3bb08d72eed91bf"}, {"timestamp": "2026-09-28T10:00:02Z", "date_only": false, "value": "2026-09-28T10:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "enisa-cnw-kev", "record": "CVE-2026-88771", "field": "timestamps.recorded_at", "uuid": "227b6b17-783c-4b5e-ac08-a19e5e042920", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:00:02.283Z", "date_only": false, "value": "2026-09-28T10:00:02.283493Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/227b6b17-783c-4b5e-ac08-a19e5e042920", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b50b7b45-3a4d-40f1-96da-3c9cd002f053", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/227b6b17-783c-4b5e-ac08-a19e5e042920"}, {"timestamp": "2026-09-28T10:04:18.343Z", "date_only": false, "value": "2026-09-28T10:04:18.343166Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwl2s6tm5k27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1a835de3-451b-442c-b77c-b0bb372c67e5", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/28/c...\n\n#cybersecurity #cybersecuritynews #0day #exploit #vulnerability @ncsc-nl.bsky.social @doublepulsar.com @satn.am @tenablesecurity.bsky.social", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mwl2s6tm5k27"}, {"timestamp": "2026-09-28T10:04:31Z", "date_only": false, "value": "2026-09-28T10:04:31.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103634", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a842e5ef-c073-452d-bd66-3f8f44bb5e4f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #POC #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-88771-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EXEcution-py\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 10:03:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nImproper Input Validation (CWE-20)  SSVC Scores Exploitation: Active Technical Impact: Total\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103634"}, {"timestamp": "2026-09-28T10:22:26Z", "date_only": false, "value": "2026-09-28T10:22:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/55987", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9d6328fa-3972-4178-a167-d7ddee1f44a7", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug (https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55987"}, {"timestamp": "2026-09-28T10:36:58Z", "date_only": false, "value": "2026-09-28T10:36:58+00:00", "kind": "kev", "label": "Asserted", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88771", "field": "timestamps.asserted_at", "uuid": "7c74e692-5425-4c10-8018-5cd17bb338fa", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:36:58Z", "date_only": false, "value": "2026-09-28T10:36:58+00:00", "kind": "kev", "label": "First seen", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88771", "field": "timestamps.first_seen_at", "uuid": "7c74e692-5425-4c10-8018-5cd17bb338fa", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:36:58Z", "date_only": false, "value": "2026-09-28T10:36:58+00:00", "kind": "kev", "label": "Last seen", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88771", "field": "timestamps.last_seen_at", "uuid": "7c74e692-5425-4c10-8018-5cd17bb338fa", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:36:58Z", "date_only": false, "value": "2026-09-28T10:36:58+00:00", "kind": "kev", "label": "Status updated", "source": "1a89b78e-f703-45f3-bb86-59eb712668bd", "record": "CVE-2026-88771", "field": "status.status_updated_at", "uuid": "7c74e692-5425-4c10-8018-5cd17bb338fa", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T10:37:13.542Z", "date_only": false, "value": "2026-09-28T10:37:13.542651Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c74e692-5425-4c10-8018-5cd17bb338fa", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "02fc9327-5a73-4876-80f2-412ecd1e1b2b", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c74e692-5425-4c10-8018-5cd17bb338fa"}, {"timestamp": "2026-09-28T10:44:05.343Z", "date_only": false, "value": "2026-09-28T10:44:05.343469Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwl4zcq2vc2n", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "fe4c95fc-5d8e-464b-b5c7-c3add8427ce8", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nwww.helpnetsecurity.com/2026/09/28/c...\n\n#Cybersecurity #Cyber #SituationalAwareness", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mwl4zcq2vc2n"}, {"timestamp": "2026-09-28T11:01:17.313Z", "date_only": false, "value": "2026-09-28T11:01:17.313146Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/papanda925.bsky.social/post/3mwl5y4p43w2p", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "10cd410a-9bed-4a17-bcb0-89f1a1cbac4c", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49)\u306e\u5bfe\u8c61\u6761\u4ef6\u3068\u5b89\u5168\u306a\u78ba\u8a8d\u624b\u9806\u3092\u6574\u7406\u3059\u308b\n\n\u672c\u8a18\u4e8b\u306fAI\u3092\u5229\u7528\u3057\u3066\u4f5c\u6210\u3057\u305f\u6280\u8853\u89e3\u8aac\u30fb\u5b9f\u88c5\u4f8b\u3067\u3059\u3002\u63b2\u8f09\u3059\u308b\u30b3\u30fc\u30c9\u3084\u624b\u9806\u306f\u4e00\u6b21\u60c5\u5831\u3092\u57fa\u306b\u69cb\u6210\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u7b46\u8005\u306b\u3088\u308b\u5b9f\u6a5f\u3067\u306e\u52d5\u4f5c\u78ba\u8a8d\u306f\u884c\u3063\u3066\u3044\u307e\u305b\u3093\u3002\u74b0\u5883\u3084\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u3088\u3063\u3066\u52d5\u4f5c\u304c\u7570\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002 NetScaler ADC\u304a\u3088\u3073NetScaler\u2026", "url": "https://bsky.app/profile/papanda925.bsky.social/post/3mwl5y4p43w2p"}, {"timestamp": "2026-09-28T11:10:35Z", "date_only": false, "value": "2026-09-28T11:10:35.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/DrbNH4uqJedT5sAqO6eGnwMUaYlIlYbbHz_FBCNpaIT3xg", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "37efd4a9-7666-428e-b75c-26f1325ec5ed"}, {"timestamp": "2026-09-28T11:10:35Z", "date_only": false, "value": "2026-09-28T11:10:35.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/DrbNH4uqJedT5sAqO6eGnwMUaYlIlYbbHz_FBCNpaIT3xg", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ab90fc05-ef43-4107-ac32-f76e7052ff61"}, {"timestamp": "2026-09-28T11:13:12.237Z", "date_only": false, "value": "2026-09-28T11:13:12.237569Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwl6ng4r7n2s", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "bea2c2da-1858-4000-81a8-64298acd14d9", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs", "url": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mwl6ng4r7n2s"}, {"timestamp": "2026-09-28T11:24:30.980Z", "date_only": false, "value": "2026-09-28T11:24:30.980520Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwl7bo5dof2k", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d9f39a16-cace-4be0-b943-25585abd48b8", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) - watchTowr Labs", "url": "https://bsky.app/profile/r-netsec.bsky.social/post/3mwl7bo5dof2k"}, {"timestamp": "2026-09-28T11:24:41.962Z", "date_only": false, "value": "2026-09-28T11:24:41.962730Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6de214c4-fdc3-46be-8448-12e3374d83b0", "content": "Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwl7byjmgm2r"}, {"timestamp": "2026-09-28T11:31:35.446Z", "date_only": false, "value": "2026-09-28T11:31:35.446075Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/obivan/statuses/117348440149556531", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "fdc61815-7dea-4da3-bc6e-ef041694c855", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "url": "https://infosec.exchange/users/obivan/statuses/117348440149556531"}, {"timestamp": "2026-09-28T11:37:37.868Z", "date_only": false, "value": "2026-09-28T11:37:37.868907Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mwl7worgzry2", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "6ac23965-3985-4253-9485-e80e2f892b39", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "url": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mwl7worgzry2"}, {"timestamp": "2026-09-28T11:58:41.005Z", "date_only": false, "value": "2026-09-28T11:58:41.005514Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwlb6quwsi2x", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0b93d2c8-390f-4d62-b39e-cc0ebe80a6e4", "content": "Details about the Citrix Netscaler vulnerability CVE-2026-88771\n\n\u2014 from @cyb3rops (https://x.com/cyb3rops/status/2104538140145000738)", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwlb6quwsi2x"}, {"timestamp": "2026-09-28T12:00:08Z", "date_only": false, "value": "2026-09-28T12:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103641", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "748861c9-0f7e-46f9-bb62-387bf2132fe1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a citrix-netscaler-cve-2026-88771-rce\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a techupdate24\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 11:37:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103641"}, {"timestamp": "2026-09-28T12:06:15Z", "date_only": false, "value": "2026-09-28T12:06:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/58cf1f5b7850f251de250b0b4ddc18ed", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "668d1dc8-643b-4fe8-93e1-3476d2d53d8d", "content": "This 2026 cybersecurity briefing highlights critical vulnerabilities, active exploits, and emerging threat actor tactics across multiple platforms:\n\n\u2022 **Patched & High-Severity Flaws:** Google Cloud Application Integration, ManageEngine DDI Central, Apache Roller, Elixir\u2019s `mint` client, and BUFFALO Wi-Fi devices contain critical/high vulnerabilities (RCE, deserialization, DoS, and command injection). All have been patched; immediate updates to specified versions are required.\n\n\u2022 **Actively Exploited Risks:** Citrix NetScaler (CVE-2026-88771) is a critical, pre-authentication command injection flaw actively exploited by attackers, added to CISA\u2019s KEV catalog, and linked to Dutch hospital outages. FAST network devices face critical buffer overflows with public exploits and unresponsive vendors.\n\n\u2022 **Threat Actor Activity:** The JADEPUFFER/Storm-3168 group executed a destructive Azure attack via compromised service principals. Meanwhile, a ~80,000-node proxy network is harvesting and monetizing stolen AI/LLM credentials, with U.S. intelligence agencies linking the abuse to Chinese entities.\n\n\u2022 **Security Guidance:** Urgent patching is critical for Citrix, Apache Roller, ManageEngine, and FAST systems. Organizations should secure AI credentials using short-lived tokens, strict monitoring, and rapid incident response playbooks to counter credential theft and AI proxy abuse.", "url": "https://gist.github.com/ichintu/58cf1f5b7850f251de250b0b4ddc18ed"}, {"timestamp": "2026-09-28T12:09:33.108Z", "date_only": false, "value": "2026-09-28T12:09:33.108703Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwlbs6yt6f25", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0ee3d900-ddfe-4322-b31b-f364688bef1a", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwlbs6yt6f25"}, {"timestamp": "2026-09-28T12:11:02.248Z", "date_only": false, "value": "2026-09-28T12:11:02.248647Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwlbutn7xm27", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "8f467411-341f-415d-999f-b20587cf90c1", "content": "\ud83d\udcf0 CISA Perintahkan Pemerintah AS Menambal Dua Celah Kritis Citrix NetScaler Sebelum 30 September\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/28/cisa-patch-celah-citrix-netscaler-cve-2026-88771-88772/\n\n#cisa #citrix #cve #cyberSecurity #cybersecurity #keamananSiber #netscaler", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwlbutn7xm27"}, {"timestamp": "2026-09-28T12:15:14.627Z", "date_only": false, "value": "2026-09-28T12:15:14.627879Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwlc4dywdh2k", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "b19a6cf7-60db-4ad9-990a-f6466160ef68", "content": "NetScaler ADC and Gateway patched for two zero-days: CVE-2026-88771 and CVE-2026-88772. CISA has ordered federal\u2026 https://0daynews.com/articles/2026-09-28-citrix-netscaler-patches-cve-2026-88771-cve-2026-88772/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3799", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mwlc4dywdh2k"}, {"timestamp": "2026-09-28T12:20:28.294Z", "date_only": false, "value": "2026-09-28T12:20:28.294939Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwlccmt4btzo", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "24bda30b-5be3-443b-8368-e4da3b2c3fa0", "content": "Citrix reports active exploitation of two critical NetScaler flaws: CVE-2026-88771 and CVE-2026-88772. Update affected customer-managed systems; CERT-EU urges compromise checks for exposed appliances.", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwlccmt4btzo"}, {"timestamp": "2026-09-28T12:31:03Z", "date_only": false, "value": "2026-09-28T12:31:03Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MX58-P288-86QP", "record": "GHSA-MX58-P288-86QP", "field": "modified"}, {"timestamp": "2026-09-28T12:31:57.360Z", "date_only": false, "value": "2026-09-28T12:31:57.360213Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hack4career.com/post/3mwld2aunwc2p", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5101e8ce-bbaa-45ca-b443-6cdb695241d4", "content": "Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772", "url": "https://bsky.app/profile/hack4career.com/post/3mwld2aunwc2p"}, {"timestamp": "2026-09-28T13:02:04Z", "date_only": false, "value": "2026-09-28T13:02:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "91c80eec-0521-4e77-aa3b-72fee6fd25f4", "content": "Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. \n\nThe post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild appeared first on Unit 42.", "url": "https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/"}, {"timestamp": "2026-09-28T13:05:07.226Z", "date_only": false, "value": "2026-09-28T13:05:07.226900Z", "kind": "sighting", "label": "Seen", "source": "https://social.bund.de/users/bsi/statuses/117348804174042056", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "23be76b0-baf2-45d6-bf4c-d9d88346486c", "content": "\u26a0\ufe0f \ud83d\udce2 Sicherheitswarnung: Am 27. September 2026 ver\u00f6ffentlichte der Hersteller #Citrix ein Advisory [CIT26a] zu insgesamt acht Sicherheitsl\u00fccken in seinen Produkten NetScaler ADC (ehemals Citrix ADC) und NetScaler Gateway (ehemals Citrix Gateway). Hierin enthalten sind auch zwei #ZeroDay-Schwachstellen (CVE-2026-88771 und CVE-2026-88772), zu denen sich im Laufe des vergangenen Wochenendes Berichte \u00fcber eine aktive Ausnutzung verbreitet hatten.\nMehr dazu hier: https://www.bsi.bund.de/dok/1209522", "url": "https://social.bund.de/users/bsi/statuses/117348804174042056"}, {"timestamp": "2026-09-28T13:13:56.551Z", "date_only": false, "value": "2026-09-28T13:13:56.551953Z", "kind": "sighting", "label": "Seen", "source": "https://chaos.social/users/christopherkunz/statuses/117348842537592602", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "ab051367-043c-4029-afca-8f7beab28b98", "content": "@bsi https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/Ab wann gilt der Betrieb dieser Ger\u00e4te eigentlich als fahrl\u00e4ssig?", "url": "https://chaos.social/users/christopherkunz/statuses/117348842537592602"}, {"timestamp": "2026-09-28T13:24:41.087Z", "date_only": false, "value": "2026-09-28T13:24:41.087862Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117348616624288037", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d5cfa17f-a54b-469d-b764-cfec84fec4df", "content": "CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.\nhttps://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway\n#CISA #KEV #Citrix #zeroday #CVE", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117348616624288037"}, {"timestamp": "2026-09-28T13:25:44.302Z", "date_only": false, "value": "2026-09-28T13:25:44.302693Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwlg27rcss25", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a62164a1-f00a-49cf-b8d1-64215f0791ad", "content": "Citrix says two critical NetScaler vulnerabilities are being actively exploited.\n\nCVE-2026-88771 enables unauthenticated RCE across all deployments.\n\nCVE-2026-88772 can lead to RCE or DoS where DTLS is enabled.\n\ncyberupdates365.com/citrix-netsc...\n\n#Cybersecurity #Citrix #NetScaler", "url": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mwlg27rcss25"}, {"timestamp": "2026-09-28T13:27:09.326Z", "date_only": false, "value": "2026-09-28T13:27:09.326347Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwlg4xcmz22y", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5ae22025-9b81-4bda-b8a5-59a92c9f2a49", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE\n\nThis article heavily implies that the failure lies with Citrix's internal security and disclosure process rather than just a software bug. While the technical details of CVE-2026-88771 are clearly laid out, foc\u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mwlg4xcmz22y"}, {"timestamp": "2026-09-28T13:29:03.045Z", "date_only": false, "value": "2026-09-28T13:29:03.045223Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwlga6lslng2", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "efa51d78-55b7-4f55-b73c-349c91ea16e1", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "url": "https://bsky.app/profile/glitterbean.wehavecookies.social.ap.brid.gy/post/3mwlga6lslng2"}, {"timestamp": "2026-09-28T13:42:49.370Z", "date_only": false, "value": "2026-09-28T13:42:49.370564Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.page/post/3mwlgtxbvxf23", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4809bffc-ae80-4e65-b0ce-dd3f98d7dee6", "content": "watchTowr Labs dissects CVE-2026-88771, another pre-auth command injection in Citrix NetScaler, the appliance that keeps finding new ways to shoot itself in the foot unauthenticated. The post walks through the flaw and why yet another NetScaler CVE is keeping defenders busy patching.", "url": "https://bsky.app/profile/cybersecurity.page/post/3mwlgtxbvxf23"}, {"timestamp": "2026-09-28T14:20:50Z", "date_only": false, "value": "2026-09-28T14:20:50.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberok_news/256", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5a3a95ee-aa7d-4179-9d7d-ad062e3d7806", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Citrix NetScaler ADC \u0438 Gateway: CVE-2026-88771\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 (RCE) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u0435\u0441\u0441\u0438\u044f \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\nCVE-2026-88771 \u2014 \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u0435 \u043b\u043e\u0433\u0438\u043d\u0430. Payload \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043b\u043e\u0433\u0438 NetScaler, \u043e\u0442\u043a\u0443\u0434\u0430 \u0435\u0433\u043e \u043f\u043e\u0434\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0435\u0442 Perl-\u0441\u043a\u0440\u0438\u043f\u0442 ns_monuploadd_err.pl, \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0449\u0438\u0439 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 shell \u0431\u0435\u0437 \u0441\u0430\u043d\u0438\u0442\u0438\u0437\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0441\u0435 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412\u0435\u043a\u0442\u043e\u0440 \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u043e\u0434\u043d\u0438\u043c \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u043e\u043c: User-Agent \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u043e\u043b\u044f, \u043f\u043e\u043f\u0430\u0434\u0430\u044e\u0449\u0438\u0435 \u0432 \u043b\u043e\u0433\u0438, \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b. \u0423\u044f\u0437\u0432\u0438\u043c \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u26a1\ufe0f \u0425\u0440\u043e\u043d\u043e\u043b\u043e\u0433\u0438\u044f\n\u2022 26.09.2026 \u2014 watchTowr \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430.\n\u2022 27.09.2026 \u2014 Citrix \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096. CISA \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430 CVE-2026-88771 \u0438 CVE-2026-88772 \u0432 KEV, \u0441\u0440\u043e\u043a \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u2014 30.09.2026.\n\u2022 28.09.2026 \u2014 watchTowr \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u0440\u0430\u0431\u043e\u0447\u0438\u043c PoC \u0438 Detection Artifact Generator, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u043c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430\u044f \u043f\u043e \u0441\u0435\u0442\u0438, \u2014 \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u0435.\n\n\ud83d\udd3aCVSS v4.0: 9.5 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\ud83d\udccb \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c CTX697096 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \n\u2022 \u041f\u043e\u043c\u0438\u043c\u043e CVE-2026-88771, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u0434\u043b\u044f CVE-2026-88772 (\u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 DTLS, RCE/DoS, CVSS 9.5). \n\u2022 \u041e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u0441\u0442\u044c \u2014 CVE-2026-88773 (HTTP request smuggling, 9.3) \u0438 CVE-2026-88774 \u2014 88778 (memory overflow, predictable values, 7.0\u20138.8) \u2014 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u043e\u0441\u044c, \u0432\u0441\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0442 \u043e\u0442 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439. \n\u2022 \u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e: CVE-2026-88778 \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u0438\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u2014 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c Enhanced ISN Generation.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 NetScaler ADC \u0438 Gateway 14.1 \u0434\u043e 14.1-73.37.\n\u2022 NetScaler ADC \u0438 Gateway 13.1 \u0434\u043e 13.1-64.23.\n\u2022 NetScaler ADC FIPS \u0434\u043e 14.1-73.37 FIPS.\n- NetScaler ADC FIPS \u0438 NDcPP \u0434\u043e 13.1-37.279.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n\u2022 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP.\n\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u043c, \u0438 \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0435 \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f Secure Private Access. \u041e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b Citrix \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f. \u0414\u043b\u044f CVE-2026-88771 workaround \u043d\u0435\u0442. \u0423\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0435 \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 2026, \u0442\u043e\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b.\n\n2. \u0414\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0430\u043c\u043f\u044b \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043b\u043e\u0433\u0438: \u043f\u0430\u0442\u0447 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0443\u0436\u0435 \u0441\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e\u0441\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u043f\u0430\u0442\u0442\u0435\u0440\u043d pitboss PPE unexpectedly died NSPPE \u0441 \u043d\u0435\u0442\u0438\u043f\u0438\u0447\u043d\u044b\u043c\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438.\n\n3. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e IoC \u0447\u0435\u0440\u0435\u0437 Security Advisory \u0432 NetScaler Console.\n\u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0441\u0435\u0441\u0441\u0438\u0439 \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b.\n\n\ud83d\udd17 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 watchTowr + PoC \n\ud83d\udd17 \u0411\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c Citrix CTX697096\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 CVE-2026-88771 \u0432 NVD \n\ud83d\udd17 FAQ watchTowr", "url": "https://t.me/cyberok_news/256"}, {"timestamp": "2026-09-28T14:27:02Z", "date_only": false, "value": "2026-09-28T14:27:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/bdufstecru/3487", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "384ad505-c4c1-4899-afb5-e4c95f8931f4", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 NetScaler ADC (\u0440\u0430\u043d\u0435\u0435 Citrix ADC) \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 NetScaler Gateway (\u0440\u0430\u043d\u0435\u0435 Citrix Gateway) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\n\nBDU:2026-15496\nCVE-2026-88771\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html", "url": "https://t.me/bdufstecru/3487"}, {"timestamp": "2026-09-28T14:57:30.043Z", "date_only": false, "value": "2026-09-28T14:57:30.043307Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/inferlume.bsky.social/post/3mwll6cqkss25", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "8e80050e-e024-4744-86e2-91044ae013ed", "content": "Unpatched Citrix NetScaler gateways face active zero-day RCE exploitation under CVE-2026-88771 and CVE-2026-88772, triggering emergency CISA KEV deadlines while ShinyHunters and cloud wipers breach perimeters.\n\nFull Report: inferlume.com/reports/dail...\n\n#NetScaler #ZeroDay #ThreatIntel #CISA #SOC", "url": "https://bsky.app/profile/inferlume.bsky.social/post/3mwll6cqkss25"}, {"timestamp": "2026-09-28T15:00:07Z", "date_only": false, "value": "2026-09-28T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9ea99852-605b-43bf-8853-1acdd5b7c586"}, {"timestamp": "2026-09-28T15:00:07Z", "date_only": false, "value": "2026-09-28T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "378dc47b-7486-48d1-bb4a-0d7138ccb87c"}, {"timestamp": "2026-09-28T15:38:19.102Z", "date_only": false, "value": "2026-09-28T15:38:19.102248Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ian-bishop.bsky.social/post/3mwlnhgxwd22j", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1acc78bf-4538-415e-8325-65d28997d7b8", "content": "Citrix just confirmed two critical NetScaler RCE zero-days (CVE-2026-88771 & CVE-2026-88772) are being exploited in the wild. CISA added them to KEV with a Sept 30 deadline for feds. If you run NetScaler ADC/Gateway \u2014 patch to 14.1-73.37 / 13.1-64.23 now.\nsecnewsheadlines.com/p/citrix-net...", "url": "https://bsky.app/profile/ian-bishop.bsky.social/post/3mwlnhgxwd22j"}, {"timestamp": "2026-09-28T16:07:09.525Z", "date_only": false, "value": "2026-09-28T16:07:09.525339Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwlp32wvzz2z", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "93c284aa-ee85-44c8-83c8-e91d48445864", "content": "~Cybergcca~\nCISA added two Citrix NetScaler CVEs to KEV; apply updates.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #Citrix #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwlp32wvzz2z"}, {"timestamp": "2026-09-28T17:00:01Z", "date_only": false, "value": "2026-09-28T17:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-88771", "field": "timestamps.recorded_at", "uuid": "8531502c-38a6-45cf-a019-1e85f05f720a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T17:00:55.205Z", "date_only": false, "value": "2026-09-28T17:00:55.205379Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8531502c-38a6-45cf-a019-1e85f05f720a", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c8fb0481-a175-4c7b-b14c-dff0cbec84d0", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/8531502c-38a6-45cf-a019-1e85f05f720a"}, {"timestamp": "2026-09-28T17:09:25.379Z", "date_only": false, "value": "2026-09-28T17:09:25.379676Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwlskfdoo72n", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "19754eb2-995d-4d99-ab58-8e66f207b6c8", "content": "CVE-2026-88771 and CVE-2026-88772: Critical Citrix NetScaler Zero\n\nThis article heavily emphasizes that exploitation is confirmed but downplays the lack of specific Indicators of Compromise, suggesting organizations should trust broad advisories over granular threat intelligence. If established \u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mwlskfdoo72n"}, {"timestamp": "2026-09-28T17:11:17.064Z", "date_only": false, "value": "2026-09-28T17:11:17.064816Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/365tipu.cz/post/3mwlsnpsdvz2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d747c6f6-0e29-413e-9a52-c40eef940fbd", "content": "Citrix nouzov\u011b opravil NetScaler ADC a Gateway po potvrzen\u00ed aktivn\u00edho zneu\u017e\u00edv\u00e1n\u00ed chyb CVE-2026-88771 a CVE-2026-88772 (CVSS 9,5), umo\u017e\u0148uj\u00edc\u00edch vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du; doporu\u010duje okam\u017eitou aktualizaci.", "url": "https://bsky.app/profile/365tipu.cz/post/3mwlsnpsdvz2f"}, {"timestamp": "2026-09-28T17:15:23.040Z", "date_only": false, "value": "2026-09-28T17:15:23.040831Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwlsv2hxss2q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7a3fcecd-b12b-427d-8f47-326fffe62f16", "content": "On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78\\.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. This is now known as CVE-2026-88771. \nhttps://\ngreynoise.io/blog/swarming-\nagainst\u2026\n\n\u2014 from @ImposeCost (https://x.com/ImposeCost/status/2104616791482019957)", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwlsv2hxss2q"}, {"timestamp": "2026-09-28T17:20:21.840Z", "date_only": false, "value": "2026-09-28T17:20:21.840009Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/greynoise.io/post/3mwlt5ttph22h", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a12eee2d-8ade-4d7b-8980-d5ff8a2e150c", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.", "url": "https://bsky.app/profile/greynoise.io/post/3mwlt5ttph22h"}, {"timestamp": "2026-09-28T17:20:32.087Z", "date_only": false, "value": "2026-09-28T17:20:32.087597Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117349804759188941", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f7a728da-797b-4946-a274-7bec2824974f", "content": "GreyNoise saw CVE-2026-88771 exploitation attempts on Sep 24, more than three days before public disclosure. Some IOC are listed.\nhttps://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation\n#threatintel #citrix #netscaler #zeroday #CVE", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117349804759188941"}, {"timestamp": "2026-09-28T17:21:32.331Z", "date_only": false, "value": "2026-09-28T17:21:32.331823Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/greynoise/statuses/117349816155656362", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1acf5556-3bd7-41bc-ace7-ff86799f236f", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was publicly disclosed.\nThe attacker's post-exploitation payload and IOCs: https://greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "url": "https://infosec.exchange/users/greynoise/statuses/117349816155656362"}, {"timestamp": "2026-09-28T17:21:42.283Z", "date_only": false, "value": "2026-09-28T17:21:42.283353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwlta4t6h542", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "66572b76-d275-4f89-9e50-f69844edcfae", "content": "On September 24, GreyNoise observed zero-day exploitation attempts against Citrix NetScaler Gateway, now tracked as CVE-2026-88771. Existing GreyNoise detections flagged the source IP as malicious within seconds, three days before the vulnerability was [\u2026] \n\n[Original post on infosec.exchange]", "url": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwlta4t6h542"}, {"timestamp": "2026-09-28T17:33:08.979Z", "date_only": false, "value": "2026-09-28T17:33:08.979205Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwltuti3k62y", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4532cc7f-9714-4733-9aa0-0070fd02f475", "content": "On CVE-2026-88771, \n@GreyNoiseIO\n detected the Citrix NetScaler zero day exploitation as malicious within seconds of it occuring, and days before the CVE disclosure.\n\n\u2014 from @ImposeCost (https://x.com/ImposeCost/status/2104622723213533582)", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwltuti3k62y"}, {"timestamp": "2026-09-28T17:36:44.842Z", "date_only": false, "value": "2026-09-28T17:36:44.842831Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwlu3am7722d", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0f9dad26-0575-47c2-9560-3bb7cee189a6", "content": "Citrix confirms two NetScaler RCE zero-days exploited in attacks\n\nCitrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix t\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwlu3am7722d"}, {"timestamp": "2026-09-28T17:55:54.683Z", "date_only": false, "value": "2026-09-28T17:55:54.683233Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cert_eu/statuses/117349951351196239", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "f747ee47-a454-4b65-86c9-8e67f3bc003e", "content": "Another day, another critical vulnerability in an edge device. We\u2019ve analysed the CVE-2026-88771, one of the many vulnerabilities disclosed by Citrix recently, based on observed exploitation attempts, and set out what we learned and key takeaways. \ud83d\udd0d\ud83d\udd12\nIf you\u2019re managing Citrix infrastructure, now\u2019s the time to check for compromise!\nhttps://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\n#cybersecurity #cve-2026-88771 #vulnerability", "url": "https://infosec.exchange/users/cert_eu/statuses/117349951351196239"}, {"timestamp": "2026-09-28T20:10:57.522Z", "date_only": false, "value": "2026-09-28T20:10:57.522068Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4oyp7q42b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c023ad01-5eb7-4c2a-8ea0-2e46c802cd97", "content": "@ncsc.gov.uk\nTwo NetScaler flaws are actively exploited; patch or isolate affected systems.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE-2026-88771 #CVE-2026-88772 #Citrix #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwm4oyp7q42b"}, {"timestamp": "2026-09-28T20:14:06.146Z", "date_only": false, "value": "2026-09-28T20:14:06.146995Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm4un63mx2b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4cb3e5b4-66aa-4146-96b0-0128d2f9aa5b", "content": "@sophossecurity.bsky.social\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwm4un63mx2b"}, {"timestamp": "2026-09-28T20:14:55Z", "date_only": false, "value": "2026-09-28T20:14:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/HackingTeamGrupoOfficial/49505", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ecbfa0d8-25b1-401c-b6a6-585e56e4bfb2", "content": "\ud83d\udea8 Critical pre-auth RCE in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771)\n\nCritical Vulnerability Alert!\nCitrix NetScaler ADC and NetScaler Gateway is affected by CVE-2026-88771.\n\n\ud83d\udd0d Identify Targets via ZoomEye:\n\nSearch Dork: app=\"Citrix NetScaler\"\nExposure: 239.2k instances identified globally.\n\nZoomEye Search Link:\n\ud83d\udc49 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXRyaXggTmV0U2NhbGVyIg%3D%3D\n\n#Infosec #CyberSecurity #ZoomEye", "url": "https://t.me/HackingTeamGrupoOfficial/49505"}, {"timestamp": "2026-09-28T20:19:11.653Z", "date_only": false, "value": "2026-09-28T20:19:11.653141Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwm55qmiwx2b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b2d85176-f91c-4cf3-aec7-c1776f50ee5d", "content": "~Watchtowr~\nActively exploited unauthenticated command injection enables root RCE on default NetScaler configurations.\n-\nIOCs: CVE-2026-88771\n-\n#CVE202688771 #Citrix #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwm55qmiwx2b"}, {"timestamp": "2026-09-28T20:30:06.816Z", "date_only": false, "value": "2026-09-28T20:30:06.816224Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1f8e6134-7ed0-4c08-9950-2c809c61c55d", "content": "\ud83d\udce2 Deux zero-days critiques NetScaler (CVE-2026-88771 et CVE-2026-88772) exploit\u00e9s activement\n\n\ud83d\udd0d Vuln\u00e9rabilit\u00e9s identifi\u00e9es Citrix a publi\u00e9 le bulletin de s\u00e9curit\u00e9 CTX697096 confirmant deux failles critiques : CVE-2026-88771 (score\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#NetScaler #ZeroDay #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwm5rbedre24"}, {"timestamp": "2026-09-28T21:00:04Z", "date_only": false, "value": "2026-09-28T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e0522737-42be-4b44-8cc3-e0ca2ee660e2"}, {"timestamp": "2026-09-28T21:00:04Z", "date_only": false, "value": "2026-09-28T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/YMUJMtIkSS3VWfyhuvlmbqaYIB_anho54ywns4AAHnWUn5M", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "321bc99c-c447-4198-921c-43a6572129a1"}, {"timestamp": "2026-09-28T21:30:06.830Z", "date_only": false, "value": "2026-09-28T21:30:06.830608Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwmb4kpvp627", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6390198c-76f6-40e6-9f2c-d0e9d600f8d1", "content": "\ud83d\udce2 Citrix NetScaler : injection de commandes pr\u00e9-auth exploit\u00e9e en zero-day (CVE-2026-88771)\n\nCet article pr\u00e9sente l'analyse technique d\u00e9taill\u00e9e de CVE-2026-88771, une vuln\u00e9rabilit\u00e9 d'injection de commandes pr\u00e9-authentification\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#CitrixNetScaler #ZeroDay #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwmb4kpvp627"}, {"timestamp": "2026-09-28T21:42:02.817Z", "date_only": false, "value": "2026-09-28T21:42:02.817441Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/patrickcmiller/statuses/117350840551160210", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "59f9d316-4ef6-456a-9bae-73e2c4e4cddc", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/", "url": "https://infosec.exchange/users/patrickcmiller/statuses/117350840551160210"}, {"timestamp": "2026-09-28T21:42:06.386Z", "date_only": false, "value": "2026-09-28T21:42:06.386228Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mwmbrvgszn2r", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "8ffbb82f-0dbd-4522-9656-c9902897d9a8", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) labs.watchtowr.com/oh-look-the-...", "url": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3mwmbrvgszn2r"}, {"timestamp": "2026-09-28T21:51:43.387Z", "date_only": false, "value": "2026-09-28T21:51:43.387579Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcd775752s", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "34d57470-28ac-4aad-b2af-ff7b4479a813", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09 #IPA \uff08Sep 28\uff09\n\nwww.ipa.go.jp/security/sec...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcd775752s"}, {"timestamp": "2026-09-28T21:51:53.913Z", "date_only": false, "value": "2026-09-28T21:51:53.913703Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcdjexto2e", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1a8e7010-e636-45a1-8921-e026d6435ebf", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERT/CC \uff08Sep 28\uff09\n\nwww.jpcert.or.jp/at/2026/at26...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmcdjexto2e"}, {"timestamp": "2026-09-28T22:34:30.164Z", "date_only": false, "value": "2026-09-28T22:34:30.164038Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "21ca3904-6463-47e0-9cb7-af1536103199", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117351046719662207"}, {"timestamp": "2026-09-28T22:34:45.710Z", "date_only": false, "value": "2026-09-28T22:34:45.710649Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "cb9c4fb9-3dec-4d1b-81c3-9e48374289a2", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwmeq57vlz2x"}, {"timestamp": "2026-09-28T22:50:10.832Z", "date_only": false, "value": "2026-09-28T22:50:10.832761Z", "kind": "sighting", "label": "Seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117351107654208046", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "30cc18ac-d5fe-44d0-89a4-d264d85d00da", "content": "Technical write up of the latest Citrix Netscaler incident, which I\u2019m calling PitScaler - you\u2019ll find out why from this: \n https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\nYou may notice it matches the hunting hints earlier in this thread. Guess who found it first :annoyingdog: \nIt\u2019s a really interesting vuln scenario. I\u2019m tracking over 100 victim orgs now. Each one has a unique webshell which can\u2019t be scanned for remotely unless you\u2019re the attacker. It\u2019s espionage.", "url": "https://cyberplace.social/users/GossiTheDog/statuses/117351107654208046"}, {"timestamp": "2026-09-28T22:57:45.083Z", "date_only": false, "value": "2026-09-28T22:57:45.083008Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117351138194874333", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "873cd335-6d10-48df-9c0e-8a85e55361b1", "content": "citrixInspector: Passively identify Citrix ADC / NetScaler ADC & Gateway builds and check for known vulnerabilities, including CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and KEV-listed CVE-2026-88771/88772.\nGitHub: https://github.com/securekomodo/citrixInspector", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117351138194874333"}, {"timestamp": "2026-09-28T23:00:57Z", "date_only": false, "value": "2026-09-28T23:00:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/44657", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "44e1d6f7-4759-4fe3-ac20-130ff686fcd7", "content": "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug\n\nCitrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.\nThe post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.\nhttps://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/", "url": "https://t.me/VulnerabilityNews/44657"}, {"timestamp": "2026-09-28T23:10:32.968Z", "date_only": false, "value": "2026-09-28T23:10:32.968373Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117351188539743753", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "40b6505e-8f2f-43ff-aecf-50023b48d8c8", "content": "CVE-2026-88771: Detection Artifact Generator for Citrix NetScaler\nGitHub: https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117351188539743753"}, {"timestamp": "2026-09-28T23:15:13Z", "date_only": false, "value": "2026-09-28T23:15:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/V6c9VQj2u_Dqm6FzprdGaH0T584MBXKW58qYX0W7yOZqH5w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6e12c706-12c6-49d4-9c08-9b3d6c6b5be3"}, {"timestamp": "2026-09-28T23:44:28.536Z", "date_only": false, "value": "2026-09-28T23:44:28.536225Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwmimqtog22y", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "24e0f67e-6018-4f2e-8515-84f8c050cce0", "content": "Citrix NetScaler\u306eCritical \u8106\u5f31\u6027 2\u4ef6\u304c\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306b\u60aa\u7528\u3000CVE-2026-88771\u30fbCVE-2026-88772\u3001\u672a\u8a8d\u8a3cRCE\u306e\u6050\u308c \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwmimqtog22y"}, {"timestamp": "2026-09-29T00:00:00Z", "date_only": false, "value": "2026-09-29T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-29)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "98fb7d53-d189-4b12-93f2-879625802dbd"}, {"timestamp": "2026-09-29T00:25:30.339Z", "date_only": false, "value": "2026-09-29T00:25:30.339368Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwmkw5appr2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d62c612c-6597-47e7-902b-96c5973f31e7", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE\n\nThis article centers heavily on the sheer number of exposed instances identified by Cortex Xpanse rather than providing specific technical details on the exploit chain or mitigation effectiveness against existing configurations. How does \u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mwmkw5appr2f"}, {"timestamp": "2026-09-29T00:54:26.767Z", "date_only": false, "value": "2026-09-29T00:54:26.767105Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmmjwegtr2b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4d236908-7b19-40f4-8299-f66612fe8da2", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\uff08Citrix NetScaler\u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u4e16\u754c\u898f\u6a21\u3067\u60aa\u7528\uff09 #HelpNetSecurity (Sep 28)\nwww.helpnetsecurity.com/2026/09/28/c...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwmmjwegtr2b"}, {"timestamp": "2026-09-29T01:30:32.261Z", "date_only": false, "value": "2026-09-29T01:30:32.261800Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwmokgomny2p", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e3854bf5-c7ee-421a-8602-d5e87f007ef3", "content": "Citrix NetScaler-apparaten getroffen door kritieke zero-day kwetsbaarheden met a\n\nCitrix heeft het grootste deel van het weekend de actieve exploitatie van nieuwe zero-day kwetsbaarheden in NetScaler bevestigd. Deze kwetsbaarheden, ge\u00efdentificeerd als CVE-2026-88771 en CVE-2026-88772, hebben...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwmokgomny2p"}, {"timestamp": "2026-09-29T02:07:07.613Z", "date_only": false, "value": "2026-09-29T02:07:07.613332Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwmqlvgsvy2l", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ef330102-690a-4335-bfec-5d82d2f16770", "content": "\ud83d\udccc CVE-2026-88771 - Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-... https://www.cyberhub.blog/cves/CVE-2026-88771", "url": "https://bsky.app/profile/cyberhub.blog/post/3mwmqlvgsvy2l"}, {"timestamp": "2026-09-29T02:25:32Z", "date_only": false, "value": "2026-09-29T02:25:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/node/639", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3c6c9ee8-d417-4b7e-9193-3cb98792bd8c", "url": "https://www.cert.dk/node/639"}, {"timestamp": "2026-09-29T03:15:29.275Z", "date_only": false, "value": "2026-09-29T03:15:29.275386Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwmug4oohv25", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2387b5aa-d300-4f82-9b99-b9ebe0e8851b", "content": "The latest update for #BitSight includes \"CVE-2026-88771 and CVE-2026-88772: Two Critical Citrix NetScaler Flaws Under Active Exploitation\" and \"Identity Risk: 5 Access Pathways Emerging Across #ThreatIntelligence\".\n \n#Cybersecurity #RiskManagement https://opsmtrs.com/43KoF0t", "url": "https://bsky.app/profile/opsmatters.com/post/3mwmug4oohv25"}, {"timestamp": "2026-09-29T03:17:58.293Z", "date_only": false, "value": "2026-09-29T03:17:58.293507Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwmukldfnk2p", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "11858854-2b57-477c-b558-f3c4d74d6c74", "content": "Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE\n\nThis article heavily emphasizes the low attack complexity for CVE-2026-88771, suggesting reliable RCE against all vulnerable deployments. However, it downplays the potential risk posed by the sheer prevalence of NetScaler appliances\u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mwmukldfnk2p"}, {"timestamp": "2026-09-29T03:55:15.090Z", "date_only": false, "value": "2026-09-29T03:55:15.090Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-88771", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-29T03:55:15.090Z", "date_only": false, "value": "2026-09-29T03:55:15.090Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-88771", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-29T04:18:01.603Z", "date_only": false, "value": "2026-09-29T04:18:01.603", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-88771", "record": "FKIE_CVE-2026-88771", "field": "lastModified"}, {"timestamp": "2026-09-29T04:23:39.816Z", "date_only": false, "value": "2026-09-29T04:23:39.816130Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwmy7zgrmq23", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "16d384c3-c76c-4832-9c45-11c0874be6a7", "content": "Citrix NetScaler \u306eRCE\u30bc\u30ed\u30c7\u30a4\u3001\u4e16\u754c\u898f\u6a21\u3067\u6570\u9031\u9593\u306b\u308f\u305f\u308a\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\n\nCitrix\u306f\u3001NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u5b58\u5728\u3059\u308b\u91cd\u5927\u30fb\u9ad8severity\u5ea6\u306e\u8106\u5f31\u60278\u4ef6\u3092\u4fee\u6b63\u3057\u307e\u3057\u305f\u3002\u3046\u30612\u4ef6\uff08CVE-2026-88771\u3001CVE-2026-88772\uff09\u306f\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u3067\u60aa\u7528\u3055\u308c\u3066\u304a\u308a\u3001\u4fb5\u5bb3\u3055\u308c\u305f\u30c7\u30d0\u30a4\u30b9\u306bWeb\u30b7\u30a7\u30eb\u304c\u4ed5\u639b\u3051\u3089\u308c\u3066\u3044\u307e\u3057\u305f", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwmy7zgrmq23"}, {"timestamp": "2026-09-29T04:44:34.045Z", "date_only": false, "value": "2026-09-29T04:44:34.045376Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwmzfft47j2l", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "cb413c9b-af9c-410c-b9ad-624603524fcc", "content": "CVE-2026-88771 is a Citrix NetScaler command injection exploited in the wild. Details and a PoC are public. Patch NetScaler to 14.1-73.37 now.\n\n#Citrix #NetScaler #CVE202688771 #CommandInjection #ZeroDay #ExploitedInTheWild #PoC #PatchNow", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwmzfft47j2l"}, {"timestamp": "2026-09-29T05:11:10.372Z", "date_only": false, "value": "2026-09-29T05:11:10.372110Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwn2uxsf3k2d", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "49b980e5-6051-4066-a4b0-5712ce86e39b", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)\n\nCitrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day a\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwn2uxsf3k2d"}, {"timestamp": "2026-09-29T05:57:15.323Z", "date_only": false, "value": "2026-09-29T05:57:15.323738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwn5hff3v726", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b703116f-3ea5-4aff-98f2-3435da62d663", "content": "\ud83d\udee1\ufe0f Revue cyber du 29/09 :\n1. Citrix NetScaler : 2 zero-days RCE (CVE-2026-88771/88772) exploit\u00e9es, CISA exige un patch avant mercredi. \u00c9teignez/mettez \u00e0 jour. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwn5hff3v726"}, {"timestamp": "2026-09-29T07:11:03Z", "date_only": false, "value": "2026-09-29T07:11:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/P0x3k_1N73LL1G3NC3/440", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e6c5c0f8-3c3d-49ed-9f92-55731a828280", "content": "Citrix NetScaler PreAuth Command Injection\n\nCVE-2026-88771 Improper input validation leading to RCE in a default NetScaler configuration, with no additional product features required.\n\nBlog:\n   \u2022 https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/\n   \u2022 https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/\n\nSearch Query:\nZoomEye: app=\"Citrix NetScaler\"\nFOFA: app=\"NetScaler-AAA\"", "url": "https://t.me/P0x3k_1N73LL1G3NC3/440"}, {"timestamp": "2026-09-29T07:15:24.908Z", "date_only": false, "value": "2026-09-29T07:15:24.908926Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwnbt4vvtu27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2aeb1572-0245-461b-8d69-36285961cb53", "content": "Citrix confirmed active exploitation of two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after nearly two days of unofficial warnings. The flaws can enable remote code execution. #Citrix #NetScaler #CISA", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwnbt4vvtu27"}, {"timestamp": "2026-09-29T07:28:07.756Z", "date_only": false, "value": "2026-09-29T07:28:07.756255Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3ab4941f-6c32-4448-ace6-37aa516f3005", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 73 interactions\nCVE-2026-88772: 61 interactions\nCVE-2026-87902: 44 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 20 interactions\nCVE-2026-88772: 13 interactions\nCVE-2026-82384: 6 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v"}, {"timestamp": "2026-09-29T07:30:18.674Z", "date_only": false, "value": "2026-09-29T07:30:18.674391Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwncns4jhn2q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b9ac1265-9583-44de-bfaf-f20a8f7bbab5", "content": "Two critical NetScaler RCE zero-days are actively exploited in the wild. Citrix has patched both CVE-2026-88771 and\u2026\n\nhttps://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/\n\n#cybersecurity #infosec", "url": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwncns4jhn2q"}, {"timestamp": "2026-09-29T07:30:30Z", "date_only": false, "value": "2026-09-29T07:30:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/8178acb7c07fdcab127104f7b77df5ce", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "dbafd878-64f4-47e4-8588-6dc23e17ce4e", "content": "# CVE-2026-88773: CVE-2026-88773: Critical HTTP Request Smuggling in Citrix NetScaler ADC and Gateway\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-09-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88773\n\n## Summary\nA critical HTTP request/response smuggling vulnerability (CWE-444) exists in Citrix NetScaler ADC and Citrix NetScaler Gateway. This flaw arises from inconsistent request boundary parsing between NetScaler appliances and backend web servers, allowing remote, unauthenticated attackers to bypass security boundaries, access restricted resources, or hijack active user sessions on multiplexed TCP connections.\n\n## TL;DR\nUnauthenticated HTTP request smuggling in Citrix NetScaler allows session hijacking, policy bypass, and cache poisoning due to boundary parsing differences.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 10.0 (Critical)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Exploit Status**: None/Theoretical (No public PoC code)\n- **CISA KEV Status**: Not Listed (Related CVEs CVE-2026-88771/2 are listed)\n- **Primary Impact**: Session Hijacking, Security Bypass, Cache Poisoning\n\n## Affected Systems\n\n- Citrix NetScaler ADC (Standard/Enterprise/Platinum)\n- Citrix NetScaler Gateway\n- Citrix NetScaler ADC FIPS\n- Citrix NetScaler ADC NDcPP\n\n## Mitigation\n\n- Upgrade firmware to the latest secure version (14.1-73.37 / 13.1-64.24 or later)\n- Disable TCP multiplexing and keep-alive settings on downstream web servers to prevent socket reuse\n- Configure Web Application Firewalls (WAF) to detect and block contradictory Content-Length and Transfer-Encoding headers\n- Enable Enhanced ISN Generation to mitigate related TCP prediction attacks\n\n**Remediation Steps:**\n1. Identify vulnerable NetScaler appliances and execute configuration checks for active HTTP/SSL virtual servers.\n2. Download the appropriate secure firmware build (14.1-73.37 or 13.1-64.24) from the official Citrix portal.\n3. Apply the firmware update to both standalone nodes or in high-availability (HA) pairs sequentially.\n4. Execute CLI commands on all partitions to enable Enhanced ISN Generation: 'set ns tcpparam -enhancedISNgeneration ENABLED'.\n5. Save the active configuration locally via 'save ns config -all' and reboot the appliance if required.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88773) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/8178acb7c07fdcab127104f7b77df5ce"}, {"timestamp": "2026-09-29T07:37:32.968Z", "date_only": false, "value": "2026-09-29T07:37:32.968218Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd2mz43c27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "97037a8a-2df1-4dcf-9cb3-9d8bd1b7f611", "content": "\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u043e\u0446 \u0441\u0435\u0442\u0435\u0439\n\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\n\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd2mz43c27"}, {"timestamp": "2026-09-29T07:38:59.582Z", "date_only": false, "value": "2026-09-29T07:38:59.582305Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd57ao2227", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0ce173e5-5e30-439a-89e1-728fa7714b1f", "content": "\ud83d\udd34 Citrix NetScaler: two zero-days under active attack\nCVE-2026-88771 and CVE-2026-88772 can lead to RCE on vulnerable NetScaler ADC/Gateway systems. Both are rated CVSS 9.5 and added to CISA KEV.\n\n#CVE #CVE202688771 #CVE202688772 #Citrix #NetScaler #CyberSecurity", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwnd57ao2227"}, {"timestamp": "2026-09-29T07:55:29.274Z", "date_only": false, "value": "2026-09-29T07:55:29.274860Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwne2sr6usaf", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6b5ca3e6-e397-444a-a1d4-ed5c2bd9c638", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066(CVE-2026-88771\u3001CVE-2026-88772\u7b49) | \u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 | IPA \u72ec\u7acb\u884c\u653f\u6cd5\u4eba \u60c5\u5831\u51e6\u7406\u63a8\u9032\u6a5f\u69cb https://www.ipa.go.jp/security/security-alert/2026/alert20260928.html", "url": "https://bsky.app/profile/shiojiri.com/post/3mwne2sr6usaf"}, {"timestamp": "2026-09-29T10:00:09Z", "date_only": false, "value": "2026-09-29T10:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103737", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f9326900-1c91-404a-ba4f-daf355796039", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler-ctx697096-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ThomasPoppelgaard\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 09:59:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAm I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771 \u2013 CVE-2026-88778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, plus --ioc sweep with every public IoC (webshells, exploit files, log injection, attacker IPs).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103737"}, {"timestamp": "2026-09-29T10:00:09Z", "date_only": false, "value": "2026-09-29T10:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103737", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3d20ad09-b1d6-4b38-9ce8-447abc88136f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler-ctx697096-checker\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ThomasPoppelgaard\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 09:59:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAm I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771 \u2013 CVE-2026-88778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, plus --ioc sweep with every public IoC (webshells, exploit files, log injection, attacker IPs).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103737"}, {"timestamp": "2026-09-29T10:36:04.361Z", "date_only": false, "value": "2026-09-29T10:36:04.361516Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwnmzvqyd22h", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "169837f1-a0fa-4c5f-ae94-5bf9ff29c859", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) - Help Net Security www.helpnetsecurity.com/2026/09/28/c...", "url": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwnmzvqyd22h"}, {"timestamp": "2026-09-29T11:22:29.596Z", "date_only": false, "value": "2026-09-29T11:22:29.596701Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsarea.bsky.social/post/3mwnpmwmtxx2h", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "bfe7410c-ed26-4ba6-aba1-25abcb19000f", "content": "Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) \u2013 watchTowr\u00a0Labs\n\nGod damn it, we're back in the room again. Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where\u2026", "url": "https://bsky.app/profile/newsarea.bsky.social/post/3mwnpmwmtxx2h"}, {"timestamp": "2026-09-29T11:55:18.097Z", "date_only": false, "value": "2026-09-29T11:55:18.097831Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mwnrhcfxfc2a", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2db453d9-f924-44ad-8b59-51de0e6d5cab", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited\nin the Wild\nunit42.paloaltonetworks.com/netscaler-ze...", "url": "https://bsky.app/profile/samilaiho.com/post/3mwnrhcfxfc2a"}, {"timestamp": "2026-09-29T13:44:22.079Z", "date_only": false, "value": "2026-09-29T13:44:22.079173Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/robcampbell.bsky.social/post/3mwnxknnh2s2d", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "dc53b450-7197-41c7-900f-015bed272a85", "content": "Citrix says two critical NetScaler flaws are already being exploited. CVE-2026-88771 affects default configurations and allows unauthenticated command execution. Patch immediately.\n\nsupport.citrix.com/external/art...\n\n#Cybersecurity #NetScaler #Citrix", "url": "https://bsky.app/profile/robcampbell.bsky.social/post/3mwnxknnh2s2d"}, {"timestamp": "2026-09-29T14:00:02.108Z", "date_only": false, "value": "2026-09-29T14:00:02.108956Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mgtech.bsky.social/post/3mwnygoin4g2c", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "879bd895-e6a3-457c-8913-6adbdd1ac251", "content": "\ud83d\udea8 BREAKING: CVE-2026-88771 and CVE-2026-88772 are rated critical with 9.5 CVSS scores. CVE-2026-88771 allows remote code execution by unauthenticated attackers.\n\nhttps://www.theregister.com/security/2026/09/28/certainties-in-life-death-taxes-and-critical-citrix-vulns-under-attack/5299369", "url": "https://bsky.app/profile/mgtech.bsky.social/post/3mwnygoin4g2c"}, {"timestamp": "2026-09-29T14:00:35.577Z", "date_only": false, "value": "2026-09-29T14:00:35.577586Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117354688304468536", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "34ea2353-3f12-4ff1-93e9-f76e3284a75d", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117354688304468536"}, {"timestamp": "2026-09-29T14:01:03.824Z", "date_only": false, "value": "2026-09-29T14:01:03.824728Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwnyij7o4z2x", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9609c756-fa6c-40e3-9edc-43782f2d6808", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwnyij7o4z2x"}, {"timestamp": "2026-09-29T14:35:15.070Z", "date_only": false, "value": "2026-09-29T14:35:15.070761Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117354824630218380", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "ec569fb9-a07a-4461-8325-326db3f997ef", "content": "New.\nWatchTower: Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772) https://labs.watchtowr.com/here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772/\nYesterday:\nWatchTower: Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771) https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/ #infosec #vulnerability #NetScaler #Citrix", "url": "https://infosec.exchange/users/AAKL/statuses/117354824630218380"}, {"timestamp": "2026-09-29T14:49:22.928Z", "date_only": false, "value": "2026-09-29T14:49:22.928290Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vdwnk24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a1b015da-2782-481a-98b3-b0e6375267e6", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vdwnk24"}, {"timestamp": "2026-09-29T14:49:23.373Z", "date_only": false, "value": "2026-09-29T14:49:23.373284Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veq2224", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1d44b221-4c0a-475c-bb9d-0c032b5ac6df", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veq2224"}, {"timestamp": "2026-09-29T14:49:23.836Z", "date_only": false, "value": "2026-09-29T14:49:23.836360Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veqzc24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7b8384e6-a3ff-4e6d-a4c8-9bc366f9736a", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veqzc24"}, {"timestamp": "2026-09-29T14:49:24.293Z", "date_only": false, "value": "2026-09-29T14:49:24.293558Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vesxs24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "529b8181-dbce-4356-aed2-61c4d0504bb3", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vesxs24"}, {"timestamp": "2026-09-29T14:49:24.731Z", "date_only": false, "value": "2026-09-29T14:49:24.731947Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vexu224", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2038fe8b-5451-4d16-a021-1ff69977d3d1", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vexu224"}, {"timestamp": "2026-09-29T14:49:25.189Z", "date_only": false, "value": "2026-09-29T14:49:25.189001Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vexu324", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4678b61a-8833-4553-9e3e-ce92acdb9d21", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vexu324"}, {"timestamp": "2026-09-29T14:49:25.631Z", "date_only": false, "value": "2026-09-29T14:49:25.631320Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veytd24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0c8b747a-7953-4448-9e6f-71b7b0487746", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36veytd24"}, {"timestamp": "2026-09-29T14:49:26.086Z", "date_only": false, "value": "2026-09-29T14:49:26.086014Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vezsl24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "faad11b3-098a-4cc6-8d84-624b4db0c279", "content": "5/7 Cyber: Citrix NetScaler zero-days (flaws exploited before a fix), CVE-2026-88771 and 88772, CVSS 9.5, are under attack. CISA ordered agencies to patch. (via BleepingComputer)", "url": "https://bsky.app/profile/sergioiker.bsky.social/post/3mwo36vezsl24"}, {"timestamp": "2026-09-29T15:01:48.988Z", "date_only": false, "value": "2026-09-29T15:01:48.988808Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mwo3v2b6f22v", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a404d3b6-a03c-44f4-b825-6cc41b12f9ef", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\n\n\ud83d\udcd6 Read more:\nwww.helpnetsecurity.com/2026/09/29/n...\n\n#CyberSecurity #CyberSecurityNews #CVE #0day #ZeroDay", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mwo3v2b6f22v"}, {"timestamp": "2026-09-29T15:02:29.228Z", "date_only": false, "value": "2026-09-29T15:02:29.228709Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/greynoise.io/post/3mwo3wa752s2b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "44279628-8651-46eb-95df-2d0b3408762c", "content": "A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24.\n\n\ud83d\udd17 Full analysis: www.greynoise.io/blog/swarmin...", "url": "https://bsky.app/profile/greynoise.io/post/3mwo3wa752s2b"}, {"timestamp": "2026-09-29T15:02:45.942Z", "date_only": false, "value": "2026-09-29T15:02:45.942890Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/greynoise/statuses/117354932799895501", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6400fdab-bb54-4789-8650-f5700d4b6720", "content": "A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24.\n\ud83d\udd17 Full analysis: https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "url": "https://infosec.exchange/users/greynoise/statuses/117354932799895501"}, {"timestamp": "2026-09-29T15:02:58.502Z", "date_only": false, "value": "2026-09-29T15:02:58.502747Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwo3wvebafz2", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "348c8890-d940-42f0-a757-be7f38de6c71", "content": "A timeline of Citrix NetScaler CVE-2026-88771, from the CVE reservation on Sep 10 to public disclosure on Sep 27, including the exploitation attempts GreyNoise observed on Sep 24.\n\n\ud83d\udd17 Full analysis: https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation", "url": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwo3wvebafz2"}, {"timestamp": "2026-09-29T15:17:58.931Z", "date_only": false, "value": "2026-09-29T15:17:58.931280Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwo4ryznjq27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "40df2423-c8b9-457d-97a0-d47d6335f024", "content": "NetScaler \u306e\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u304c\u5927\u898f\u6a21\u653b\u6483\u306b\u62e1\u5927(CVE-2026-88771)\n\n\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306b\u516c\u958b\u3055\u308c\u3066\u3044\u308b\u8106\u5f31\u306a Citrix NetScaler ADC \u304a\u3088\u3073 Gateway \u3092\u72d9\u3063\u305f\u653b\u6483\u304c\u3001\u6df1\u523b\u5316\u3057\u3066\u3044\u307e\u3059\u3002 \u5f53\u521d\u306f\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u306b\u3088\u308b\u96a0\u5bc6\u306a\u6a19\u7684\u578b\u653b\u6483\u3067\u3057\u305f\u304c\u3001\u73fe\u5728\u306f\u7121\u5dee\u5225\u306b\u653b\u6483\u3092\u4ed5\u639b\u3051\u308b\u300c\u30b9\u30d7\u30ec\u30fc\u30fb\u30a2\u30f3\u30c9\u30fb\u30d7\u30ec\u30a4\u300d\u578b\u3078\u3068\u5909\u308f\u308a\u307e\u3057\u305f\u3002\u304d\u3063\u304b\u3051\u306f\u3001CVE-2026-88", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwo4ryznjq27"}, {"timestamp": "2026-09-29T15:35:39.311Z", "date_only": false, "value": "2026-09-29T15:35:39.311742Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mwo5rm2edc23", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b8c2f23b-6a51-4693-9212-bbf1341546cb", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\n\nwww.helpnetsecurity.com/2026/09/29/n...\n\n#Cybersecurity #Cyber #SituationalAwareness", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mwo5rm2edc23"}, {"timestamp": "2026-09-29T16:10:11.153Z", "date_only": false, "value": "2026-09-29T16:10:11.153942Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwo7pay5hu2v", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d5f57e41-d566-4c8e-9fe9-354ace688f95", "content": "\ud83e\udd16 Citrix NetScaler dual zero-days: CVE-2026-88771 (RCE, CVSS 9.5) and CVE-2026-88772 (memory overflow, RCE/DDoS), both in default configs of NetScaler ADC/Gateway. Exploited in the wild, patched Sept 27.\nhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwo7pay5hu2v"}, {"timestamp": "2026-09-29T17:13:44.408Z", "date_only": false, "value": "2026-09-29T17:13:44.408140Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwodazdato2z", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0024f9c4-ef4d-4cbc-a063-fac65561aae5", "content": "(CISA TS+SOC) CVE-2026-88771 \u2013 Citrix NetScaler Input Validation RCE\u00a0Briefing\n\nActive exploitation of CVE-2026-88771 in Citrix NetScaler requires immediate patch deployment and forensic triage. Review integrated TSUITE + SOC intelligence assets....\n\nhttps://thecybermind.co/41l1", "url": "https://bsky.app/profile/thecybermind.co/post/3mwodazdato2z"}, {"timestamp": "2026-09-29T20:16:12.787Z", "date_only": false, "value": "2026-09-29T20:16:12.787544Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwongtsdtg23", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f528aed5-dc27-41f3-a7bf-7da581b3b9f0", "content": "~Spiderlabs~\nCritical NetScaler flaws enable unauthenticated RCE and are actively exploited worldwide.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwongtsdtg23"}, {"timestamp": "2026-09-29T22:01:23.269Z", "date_only": false, "value": "2026-09-29T22:01:23.269663Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwotddg35g2n", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3f237645-00d2-480d-b732-b3d9b4364bc8", "content": "Citrix NetScaler-apparaten het slachtoffer van grootschalige zero-day aanvallen\n\nAanvallers hebben twee kritieke zero-day kwetsbaarheden, CVE-2026-88772 en CVE-2026-88771, in Citrix NetScaler-apparaten massaal uitgebuit. De vroegst bekende exploitatie van CVE-2026-88772 dateert van 3 septem...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwotddg35g2n"}, {"timestamp": "2026-09-29T22:09:20Z", "date_only": false, "value": "2026-09-29T22:09:20.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/lsHU-UFoE9jp8RYYvXLm1SpQJKpFnC1QG-nftonJyjWN0ys", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "8aada594-49ed-49c0-9c81-7d197033e5ed"}, {"timestamp": "2026-09-29T22:15:29.455Z", "date_only": false, "value": "2026-09-29T22:15:29.455313Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwou4luxvw2c", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b8eebf55-f123-466a-8148-19c47ec0c853", "content": "Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 were used to deploy web shells, tunneling malware, and steal credentials in attacks across North America and Europe. #Citrix #NorthAmerica #Europe", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwou4luxvw2c"}, {"timestamp": "2026-09-29T23:46:44.392Z", "date_only": false, "value": "2026-09-29T23:46:44.392222Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwoz7s2apt2i", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "705b8350-793f-47bb-8f76-14981c7f476b", "content": "The latest update for #Sophos includes \"Jev's Paradox: The hidden cost of cheap #AI decisions\" and \"Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation\".\n \n#cybersecurity #antivirus #malware https://opsmtrs.com/487u2e2", "url": "https://bsky.app/profile/opsmatters.com/post/3mwoz7s2apt2i"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": true, "value": "2026-09-30", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-88771", "field": "evidence.0.details.due_date", "uuid": "101635ac-c10a-4cfc-b18a-1dee629f73cc", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-30)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "925452cd-74ac-43ce-9c6f-c68bf750a336"}, {"timestamp": "2026-09-30T00:00:00Z", "date_only": false, "value": "2026-09-30T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "revisions.2.revision_date"}, {"timestamp": "2026-09-30T03:00:06Z", "date_only": false, "value": "2026-09-30T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "31c2462e-8642-41b7-a969-fb43c6e3563c"}, {"timestamp": "2026-09-30T03:00:06Z", "date_only": false, "value": "2026-09-30T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/W6KIGBKNkvsXlzUZXWVH9IksVZHdVGt-ZVnKWZr-SExOhZ8", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "235ef5cd-2d37-4ffe-a087-05dd4629a60d"}, {"timestamp": "2026-09-30T04:36:58.177Z", "date_only": false, "value": "2026-09-30T04:36:58.177925Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/redoracle.com/post/3mwpjgqq6jt2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "381126e5-aa1d-4891-ab36-3ba00096e857", "content": "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) https://redoracle.com/News/citrix-netscaler-rce-zero-days-exploited-globally-for-weeks-cve-2026.html #2026 #netscaler #vulnerabilities", "url": "https://bsky.app/profile/redoracle.com/post/3mwpjgqq6jt2f"}, {"timestamp": "2026-09-30T05:15:23.894Z", "date_only": false, "value": "2026-09-30T05:15:23.894885Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpllhpyhs27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1cb91584-b600-4b09-85da-42fdc4e64106", "content": "Mandiant and GTIG report active exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88772 and CVE-2026-88771, with custom tools, root access, persistence, and hidden C2 in HTTP headers. #CitrixNetScaler #WHIPSHOT #SLAPSHOT", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwpllhpyhs27"}, {"timestamp": "2026-09-30T05:32:40.917Z", "date_only": false, "value": "2026-09-30T05:32:40.917435Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwpmke2ayq2s", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "052c83ea-70ad-4cb8-be97-d98a95424d12", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\uff08NetScaler\u30bc\u30ed\u30c7\u30a4\u653b\u6483\u304c\u5927\u898f\u6a21\u653b\u6483\u3078\u62e1\u5927\uff09 #HelpNetSecurity \uff08Sep 29\uff09\nwww.helpnetsecurity.com/2026/09/29/n...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwpmke2ayq2s"}, {"timestamp": "2026-09-30T05:35:17.481Z", "date_only": false, "value": "2026-09-30T05:35:17.481289Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwpmp2ffwf2n", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3c42a9cd-e262-458f-955d-da48fec4418c", "content": "Citrix NetScaler CVE-2026-88771 PoC Released as Exploitation Surges\uff08Citrix NetScaler\u306eCVE-2026-88771\u3001PoC\u516c\u958b\u3067\u653b\u6483\u62e1\u5927\u306e\u61f8\u5ff5\uff09 #SecurityOnline \uff08Sep 29\uff09\nsecurityonline.info/citrix-netsc...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwpmp2ffwf2n"}, {"timestamp": "2026-09-30T07:20:32.543Z", "date_only": false, "value": "2026-09-30T07:20:32.543744Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1ca680c6-3375-484a-8283-39305d5550f6", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 93 interactions\nCVE-2026-88772: 93 interactions\nCVE-2026-87902: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 32 interactions\nCVE-2026-88771: 20 interactions\nCVE-2026-86950: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h"}, {"timestamp": "2026-09-30T08:00:50.753Z", "date_only": false, "value": "2026-09-30T08:00:50.753006Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwputcxikv27", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "910db054-ae34-449a-aaee-3a230b5fdc1a", "content": "Citrix NetScaler hit with pre-auth command injection flaw (CVE-2026-88771). watchTowr Labs breaks down the vulnerability and why it matters for your perimeter\u2026\n\nhttps://www.reddit.com/r/netsec/comments/1wsbh8j/oh_look_the_foot_gun_went_off_again_citrix/\n\n#cybersecurity #infosec", "url": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwputcxikv27"}, {"timestamp": "2026-09-30T08:38:43.031Z", "date_only": false, "value": "2026-09-30T08:38:43.031636Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-30T08:38:43.031Z", "date_only": false, "value": "2026-09-30T08:38:43.031636Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0394", "record": "NCSC-2026-0394", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-30T09:11:01.739Z", "date_only": false, "value": "2026-09-30T09:11:01.739093Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mwpyqsbv762o", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b5de0b6b-5d2a-42d1-a899-13dfa66b9477", "content": "Critical Citrix NetScaler RCE (CVE-2026-88772) exploited in the wild: a deep dive into the DTLS buffer\u00a0overflow\n\nCitrix NetScaler vulnerability, NetScaler RCE, Citrix zero-day, DTLS buffer overflow, CVE-2026-88771, NetScaler\u2026\n\nhttps://thecybersecguru.com/news/citrix-netscaler-cve-2026-88772-rce/", "url": "https://bsky.app/profile/thecybersecguru.com/post/3mwpyqsbv762o"}, {"timestamp": "2026-09-30T10:48:20Z", "date_only": false, "value": "2026-09-30T10:48:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9fc0e188-ea0e-40d5-ba7f-d1100c80d5a5", "content": "Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\n\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.", "url": "https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/"}, {"timestamp": "2026-09-30T10:49:54Z", "date_only": false, "value": "2026-09-30T10:49:54.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8662", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "96260f98-0613-4878-ad34-d3e0bed7cc35", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "url": "https://t.me/true_secator/8662"}, {"timestamp": "2026-09-30T10:49:54Z", "date_only": false, "value": "2026-09-30T10:49:54.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8662", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "683a39e2-2ed9-4024-9a8f-dce77cace76e", "content": "Mandiant \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 0-day, CVE-2026-88772, \u0432 Citrix NetScaler, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043a\u0440\u0430\u0436\u0435\u0439 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0410\u0442\u0430\u043a\u0438 \u0441\u0442\u0430\u0440\u0442\u043e\u0432\u0430\u043b\u0438 \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 \u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438, \u043a\u0430\u043a \u043f\u043e\u043b\u0430\u0433\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435 \u0438\u0437 \u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u043e\u0433\u043e, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u043a\u0442\u043e\u0440\u043e\u0432.\n\n\u041f\u0435\u0440\u0432\u044b\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043e \u043d\u0430\u0447\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0435, \u043a\u043e\u0433\u0434\u0430 \u0441\u0440\u0435\u0434\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043d\u0430\u0447\u0430\u043b\u0430 \u0446\u0438\u0440\u043a\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0434\u0432\u0443\u0445 \u0437\u0438\u0440\u043e\u0434\u0435\u044f\u0445 \u0432 NetScaler \u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u0441\u0435\u0445 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.\n\nWatchTowr \u043f\u043e\u0437\u0436\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u0441\u0435\u0442\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0434\u0432\u0435 0-day \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 NetScaler, \u0430 Citrix \u0433\u043e\u0442\u043e\u0432\u0438\u0442 \u043f\u0430\u0442\u0447\u0438.\n\n\u0412 \u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435 Citrix \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u0438\u0442\u043e\u0433\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u043e CVE-2026-88771 \u0438 CVE-2026-88772, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 \u044d\u0442\u0438 \u0438\u0445 PitScaler.\n\nCitrix \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u0445 NetScaler, \u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f.\n\nCVE-2026-88771 - \u044d\u0442\u043e RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0432\u0441\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f NetScaler ADC \u0438 Gateway, \u0430 CVE-2026-88772 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE \u0438\u043b\u0438 DoS \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c DTLS.\n\n24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f GreyNoise \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Citrix NetScaler Gateway, \u0437\u0430 \u0442\u0440\u0438 \u0434\u043d\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a Citrix \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0441 IP 149.104.78.141 \u0438 \u0431\u044b\u043b\u0430 \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0442\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c GreyNoise, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0441\u044f \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u0443 /bin/sh, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435 \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u0440\u043e\u043b\u0435\u043c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.\n\n\u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u043b \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u043d\u0435\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f /etc/httpd.conf \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u0433\u043b\u044f\u0434\u0435\u043b\u0438 \u043a\u0430\u043a CSS-\u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f receiver.min.css, \u0432\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u043b\u0438 \u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 PHP.\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430, \u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 ctxs.receiver \u0444\u0430\u0439\u043b\u0430, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043d\u043e\u043c Alias  \u0438\u043b\u0438 AliasMatch \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0432 httpd.conf, \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u0430\u0432\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a /bin/sh \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u0441 \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u043e\u0433\u043e IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430.", "url": "https://t.me/true_secator/8662"}, {"timestamp": "2026-09-30T11:05:50.443Z", "date_only": false, "value": "2026-09-30T11:05:50.443026Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mwq764d5rx2g", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4ec26b6f-e2ca-491c-a8b0-705eeeb4a32d", "content": "Citrix NetScaler 0-day active for weeks\n\nCitrix NetScaler vulnerabilities (CVE-2026-88771, -88772) were actively exploited against critical sectors for weeks before disclosure. Users must check for compromise *before* patching.", "url": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mwq764d5rx2g"}, {"timestamp": "2026-09-30T12:05:40.644Z", "date_only": false, "value": "2026-09-30T12:05:40.644610Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwqcj4az222d", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a2bc52b9-b947-48a4-98df-1c0045b1ee17", "content": "NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)\n\nThe hacking of internet-exposed, vulnerable Citrix NetScaler ADC and Gateway deployments has escalated. What started as stealthy targeting via zero-day exploits has now become widespread \u201cspray and pray\u201d\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwqcj4az222d"}, {"timestamp": "2026-09-30T12:53:04.664Z", "date_only": false, "value": "2026-09-30T12:53:04.664712Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwqf5l4qor2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "488428c7-7276-4a91-8002-8e95a8ee454f", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwqf5l4qor2f"}, {"timestamp": "2026-09-30T12:54:13.801Z", "date_only": false, "value": "2026-09-30T12:54:13.801062Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqf7q6ous2p", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "177cde6c-4050-48c6-b97d-f91604046a8f", "content": "Attacks exploiting Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 enable remote code execution, root access, web-shell deployment, and internal network compromise.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwqf7q6ous2p"}, {"timestamp": "2026-09-30T14:21:44.179Z", "date_only": false, "value": "2026-09-30T14:21:44.179386Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117360432922523865", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b9e07b82-3c07-4a34-9ed9-7e24d54a6ce3", "content": "\ud83d\udcf0 Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit\n\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-zero-days-and-oracle-peoplesoft-flaw-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117360432922523865"}, {"timestamp": "2026-09-30T14:21:53.267Z", "date_only": false, "value": "2026-09-30T14:21:53.267592Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwqk4mygqd2t", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c2f520e0-9766-455a-b7cd-827a877b5519", "content": "\ud83d\udea8 CRITICAL THREAT: Two Citrix zero-days (CVE-2026-88771, CVE-2026-88772) and an Oracle PeopleSoft flaw (CVE-2026-35273) are under active exploitation for RCE. CISA KEV updated. Patch immediately! #CyberSecurity #ZeroDay #CVE #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwqk4mygqd2t"}, {"timestamp": "2026-09-30T14:30:06.167Z", "date_only": false, "value": "2026-09-30T14:30:06.167373Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/greynoise.io/post/3mwqkkwxeuc2h", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a197a6fa-acb3-423d-9450-9851a36b981c", "content": "At The Edge Clear: September 21 \u2013 28, 2026\nAn adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure.\n\n\ud83d\udd17 www.greynoise.io/resources/at...", "url": "https://bsky.app/profile/greynoise.io/post/3mwqkkwxeuc2h"}, {"timestamp": "2026-09-30T14:30:25.437Z", "date_only": false, "value": "2026-09-30T14:30:25.437955Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/greynoise/statuses/117360467540694633", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "dccdd08c-ae22-406a-8c94-f0bc2652bf87", "content": "An adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure, and GreyNoise labeled it malicious within seconds, before any CVE-specific detection existed. New sources followed within a day.\nElsewhere, sources checked F5 BIG-IP for a newly listed KEV flaw in the week CISA set a three-day federal deadline, and adversaries attempted two CrushFTP flaws in back-to-back single-day bursts. Next.js bypass sources ran at least four times their late August daily level on a flaw outside KEV. Build the control on the request behavior.\nCustomers get the full weekly brief. Our public At The Edge one-pager is attached + https://greynoise.io/resources/at-the-edge-clear-092826", "url": "https://infosec.exchange/users/greynoise/statuses/117360467540694633"}, {"timestamp": "2026-09-30T14:32:40.739Z", "date_only": false, "value": "2026-09-30T14:32:40.739427Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwqkmjzlyle2", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9e1c26b3-976a-4be6-8894-115a018a050a", "content": "An adversary tried Citrix NetScaler CVE-2026-88771 against a GreyNoise Swarm participant sensor more than three days before public disclosure, and GreyNoise labeled it malicious within seconds, before any CVE-specific detection existed. New sources followed [\u2026] \n\n[Original post on infosec.exchange]", "url": "https://bsky.app/profile/greynoise.infosec.exchange.ap.brid.gy/post/3mwqkmjzlyle2"}, {"timestamp": "2026-09-30T15:00:07.190Z", "date_only": false, "value": "2026-09-30T15:00:07.190920Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mwqmayeins2x", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "12afb5cd-a9bc-45cb-80b8-6ac7e77e9db9", "content": "Critical Citrix NetScaler ADC and Gateway Vulnerabilities CVE-2026-88771 through CVE-2026-88778 #patchmanagement", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mwqmayeins2x"}, {"timestamp": "2026-09-30T15:31:04Z", "date_only": false, "value": "2026-09-30T15:31:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3382", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "37d1e401-6b15-4a25-acf7-4fed2676ec69", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "url": "https://t.me/pphm_HackerNews/3382"}, {"timestamp": "2026-09-30T15:31:04Z", "date_only": false, "value": "2026-09-30T15:31:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/3382", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a314ed89-abf3-44cd-85a6-68cd90defb28", "content": "\ud83d\udd34 WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign\n\nMandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.\n\nMandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.", "url": "https://t.me/pphm_HackerNews/3382"}, {"timestamp": "2026-09-30T16:41:59Z", "date_only": false, "value": "2026-09-30T16:41:59.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/56012", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "aa8dd318-5540-49ea-a42e-39e550f848ae", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/56012"}, {"timestamp": "2026-09-30T16:41:59Z", "date_only": false, "value": "2026-09-30T16:41:59.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/information_security_channel/56012", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "fb2ff1d7-fa85-4723-9d21-861c18ade973", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/56012"}, {"timestamp": "2026-09-30T17:15:25.941Z", "date_only": false, "value": "2026-09-30T17:15:25.941335Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqtsym67r2m", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6c68286d-6a52-4b77-9472-a4fee457b911", "content": "Citrix patched two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after weeks-long attacks used for unauthenticated RCE, root access, and web shells. Over 100 victims may be affected. #NetScaler #Mandiant #Europe", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mwqtsym67r2m"}, {"timestamp": "2026-09-30T18:42:10.922Z", "date_only": false, "value": "2026-09-30T18:42:10.922268Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwqynzclbk26", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "24506c70-b7c0-44a8-80d8-f9f1d65ad86d", "content": "Science Morty. NetScaler caught a state-sized cold. CVE-2026-88771, Whipshot rides HTTP headers, and .ico files suddenly speak PHP. Dutch hospitals yanked the patient portal. Patch the box if it makes you feel better. The ghosts already have keys. day274.003", "url": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwqynzclbk26"}, {"timestamp": "2026-09-30T18:46:28.694Z", "date_only": false, "value": "2026-09-30T18:46:28.694322Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwqyvo6p522q", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d67b1992-438f-4c59-ad04-bbd5dd85cd2c", "content": "Science Morty. NetScaler caught a state-sized cold. CVE-2026-88771, Whipshot rides HTTP headers, and .ico files suddenly speak PHP. Dutch hospitals yanked the patient portal. Patch the box if it makes you feel better. The ghosts already have keys. day274.003", "url": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwqyvo6p522q"}, {"timestamp": "2026-09-30T20:42:04.548Z", "date_only": false, "value": "2026-09-30T20:42:04.548851Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwr7ehv2se25", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ae1ec607-e9cb-448f-9ede-2daa1953f748", "content": "Government and finance offices are getting hit hard right now by two Citrix NetScaler vulnerabilities. They're CVE-2026-88772 and CVE-2026-88771.\n\n#vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwr7ehv2se25"}, {"timestamp": "2026-09-30T23:00:48Z", "date_only": false, "value": "2026-09-30T23:00:48.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44692", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f41a81d1-e6dc-48f8-a368-32ea9e2c3dea", "content": "Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks\n\nSeveral security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772.\nThe post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.\nhttps://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/", "url": "https://t.me/VulnerabilityNews/44692"}, {"timestamp": "2026-10-01T00:00:00Z", "date_only": false, "value": "2026-10-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-01)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "14dac85b-772c-4296-bb47-11acdc2c4413"}, {"timestamp": "2026-10-01T00:13:00.267Z", "date_only": false, "value": "2026-10-01T00:13:00.267391Z", "kind": "sighting", "label": "Seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117362758120876296", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "ae1b45b2-769a-4b4d-9370-f991fec1b8cc", "content": "Great IOCs on the follow up spray and pray activity on #PitScaler so far.\nFor context this activity definitely is not related to the inital threat actor activity in early September.  This is new stuff.\n https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202609-citrix-netscaler-active-exploitation-cve-2026-88771", "url": "https://cyberplace.social/users/GossiTheDog/statuses/117362758120876296"}, {"timestamp": "2026-10-01T01:12:48.415Z", "date_only": false, "value": "2026-10-01T01:12:48.415413Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netalexx.bsky.social/post/3mwroikeqc22j", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6132463f-f329-46da-ba1f-7c3cfa4f04bc", "content": "Citrix NetScaler Active Exploitation via CVE-2026-88771", "url": "https://bsky.app/profile/netalexx.bsky.social/post/3mwroikeqc22j"}, {"timestamp": "2026-10-01T02:16:25Z", "date_only": false, "value": "2026-10-01T02:16:25.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9cb0617d-2a81-41bf-bc45-62b4e1def814", "url": "https://www.kyberturvallisuuskeskus.fi/fi/varoitukset/citrix-netscaler-adc-ja-gateway-tuotteissa-kriittisia-haavoittuvuuksia-useita-tietomurtoja-suomessa"}, {"timestamp": "2026-10-01T04:43:53.975Z", "date_only": false, "value": "2026-10-01T04:43:53.975824Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mws2c2pvlm2t", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "128e55f3-1c51-4bcd-b24b-ddb075b2432b", "content": "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)\n\nThis article heavily emphasizes the pre-disclosure activity to establish intent, but by focusing so much on historical TTPs, it risks downplaying the immediate, active risk presented\u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mws2c2pvlm2t"}, {"timestamp": "2026-10-01T04:44:55.936Z", "date_only": false, "value": "2026-10-01T04:44:55.936481Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mws2dvn5yz2l", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d3c9805b-0cf3-4b9f-920a-7899e85db5cf", "content": "\ud83e\udd16 CVE-2026-88771 (CVSS 9.5): unauth command injection in Citrix NetScaler ADC/Gateway, exploited in the wild. Web shells dropped, superuser created, configs exfiltrated. NCSC-NL urged orgs to shut appliances down.\nhttps://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mws2dvn5yz2l"}, {"timestamp": "2026-10-01T04:45:27.593Z", "date_only": false, "value": "2026-10-01T04:45:27.593588Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mws2etpgkz2z", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "adb7cfb7-df19-499e-ab97-659b6c7fc069", "content": "Active exploitation of Citrix NetScaler CVE-2026-88771 enables pre-auth command injection, payload retrieval, reverse shells, privileged account creation, and web-shell deployment. #Citrix #NetScaler #CVE-2026-88771", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mws2etpgkz2z"}, {"timestamp": "2026-10-01T05:01:27.519Z", "date_only": false, "value": "2026-10-01T05:01:27.519184Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mws3bhepyy26", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "08d27ac5-5c2a-4706-a480-cac8d3e1b5f7", "content": "Citrix NetScaler CVE-2026-88771\u3001\u30b9\u30fc\u30d1\u30fc\u30e6\u30fc\u30b6\u30fc\u4f5c\u6210\u3068Web\u30b7\u30a7\u30eb\u5c55\u958b\u3092\u78ba\u8a8d\n\n\u653b\u6483\u8005\u304cCitrix NetScaler CVE-2026-88771\u3092\u60aa\u7528\u3057\u3001Web\u30b7\u30a7\u30eb\u3092\u914d\u7f6e\u3057\u3066\u30b9\u30fc\u30d1\u30fc\u30e6\u30fc\u30b6\u30fc\u3092\u4f5c\u6210\u3002\u8a2d\u5b9a\u30c7\u30fc\u30bf\u306e\u7a83\u53d6\u3092\u8a66\u884c\u3002CSS\u306e\u3088\u3046\u306aURL\u306b\u30de\u30c3\u30d7\u3055\u308c\u305f\u30b7\u30a7\u30eb\u304c\u691c\u51fa\u3055\u308c\u3066\u3044\u308b\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u6a19\u7684\u578b\u653b\u6483", "url": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mws3bhepyy26"}, {"timestamp": "2026-10-01T05:10:24.212Z", "date_only": false, "value": "2026-10-01T05:10:24.212992Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mws3rgwzuj2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d31019eb-f9e7-4751-afeb-cf669e9ea541", "content": "NetScaler exploit CVE-2026-88771/72 grants attackers root & hides web shell in CSS-like URLs. #Citrix #NetScaler #Vulnerability #Cybersecurity #WebShell #ThreatIntel https://thedailytechfeed.com/critical-post-auth-payload-abuses-netscaler-to-create-superuser-web-shell-access/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mws3rgwzuj2f"}, {"timestamp": "2026-10-01T05:21:55.264Z", "date_only": false, "value": "2026-10-01T05:21:55.264936Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mws4fzqmwi2d", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "87e6d8d8-5be4-46ce-816f-affe6a76b8d4", "content": "Threat actors exploit CVE-2026-88771 in Citrix NetScaler ADC/Gateway to execute commands, deploy web shells, and steal configuration data.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mws4fzqmwi2d"}, {"timestamp": "2026-10-01T05:21:56.668Z", "date_only": false, "value": "2026-10-01T05:21:56.668479Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mws4g3d6ab2i", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "872eb248-cec7-49b4-a256-811a64daef3a", "content": "Threat actors exploit CVE-2026-88771 in Citrix NetScaler ADC/Gateway to execute commands, deploy web shells, and steal configuration data.\n", "url": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mws4g3d6ab2i"}, {"timestamp": "2026-10-01T05:23:00.708Z", "date_only": false, "value": "2026-10-01T05:23:00.708906Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mws4hyhmia2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "06a873b8-7189-4358-9314-53e38357bab6", "content": "Threat actors exploit CVE-2026-88771 in Citrix NetScaler ADC/Gateway to execute commands, deploy web shells, and steal configuration data.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mws4hyhmia2f"}, {"timestamp": "2026-10-01T06:45:52Z", "date_only": false, "value": "2026-10-01T06:45:52.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/infosec_ita_notizie/4207", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6294c784-be07-4a4c-9353-0ad4f65f1f39", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "url": "https://t.me/infosec_ita_notizie/4207"}, {"timestamp": "2026-10-01T06:45:52Z", "date_only": false, "value": "2026-10-01T06:45:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/infosec_ita_notizie/4207", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "4c3cbf03-e839-4521-b421-f8bab15c74af", "content": "\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026\n\n\u2615 CYBERBRIEFING \u2014 Gioved\u00ec 1 ottobre 2026 Il tuo riassunto quotidiano di cybersecurity da leggere con il caff\u00e8. \u2b24 IN PRIMO PIANO Due vulnerabilit\u00e0 zero-day critiche nei dispositivi Citrix NetScaler ADC e Gateway (CVE-2026-88771 e CVE-2026-88772) sono sotto attacco attivo da settimane in tutto il mond\u2026\n\n\n\ud83d\udc49Leggi tutti gli aggiornamenti delle ultime 24 ore: https://ilpuntocyber.rfeed.it/article.php?s=2026-10-01\n\n\ud83d\udcac Se vuoi se ne pu\u00f2 discutere sul forum: https://internet-forum.it", "url": "https://t.me/infosec_ita_notizie/4207"}, {"timestamp": "2026-10-01T07:44:06.274Z", "date_only": false, "value": "2026-10-01T07:44:06.274685Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "cc4e55f3-d554-4edc-8ed7-08cbc3ea8b28", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 107 interactions\nCVE-2026-88772: 105 interactions\nCVE-2026-87902: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 14 interactions\nCVE-2026-88772: 12 interactions\nCVE-2026-84782: 10 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r"}, {"timestamp": "2026-10-01T08:07:13.593Z", "date_only": false, "value": "2026-10-01T08:07:13.593669Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mwsfnmbeym2w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "fda16546-056c-4e3d-aa5a-19346498ef06", "content": "COGNOSCERE Tech Brief \u2014 2026-10-01\n\nCISA confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772, both CV\n\nhttps://www.cognoscerellc.com/news", "url": "https://bsky.app/profile/billingsley.bsky.social/post/3mwsfnmbeym2w"}, {"timestamp": "2026-10-01T08:31:27Z", "date_only": false, "value": "2026-10-01T08:31:27.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/d73b7730-6485-4c07-914c-ae83b22c4c4a", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "aaff87b9-1e13-4295-970c-0fe5cb8cf2e9"}, {"timestamp": "2026-10-01T09:51:44Z", "date_only": false, "value": "2026-10-01T09:51:44.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ed361682-b1e6-4b86-b9e6-21da730681f1", "url": "https://www.kyberturvallisuuskeskus.fi/en/alerts/critical-vulnerabilities-citrix-netscaler-adc-and-netscaler-gateway-products-several-intrusions-finland"}, {"timestamp": "2026-10-01T11:21:25.632Z", "date_only": false, "value": "2026-10-01T11:21:25.632755Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqisbpyg22", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0679785f-4cce-4c5a-8784-8ba4bfc70e70", "content": "Government and finance bodies got hit by weeks-long zero-day attacks on NetScaler CVE-2026-88771 and CVE-2026-88772. Here we go again with the usual corporate grief.\n\n#NetScalerAgain #PatchFatigue", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqisbpyg22"}, {"timestamp": "2026-10-01T11:21:26.795Z", "date_only": false, "value": "2026-10-01T11:21:26.795757Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqium4tp2u", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "025d06af-5861-4362-99d0-d86be64adf5a", "content": "Government and finance organisations have spent weeks being battered by zero-day attacks, because why would critical infrastructure catch a break? Security firms confirmed threat actors are joyfully exploiting NetScaler flaws CVE-2026-88771 and CVE-2026-88772 across targeted netw...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mwsqium4tp2u"}, {"timestamp": "2026-10-01T12:13:06.873Z", "date_only": false, "value": "2026-10-01T12:13:06.873353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwstfcsvt225", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "029fbb45-36a3-4104-9b4c-8fd70b8c3bbe", "content": "This payload we found in the wild earlier today while threat hunting for Netscaler CVE-2026-88771 exploitation shows attackers adapting their post-compromise techniques to evade common detection methods - it achieves persistence\u2026\n\n\u2014 from @AmitaiCo (https://x.com/AmitaiCo/status/2105631453455253630)", "url": "https://bsky.app/profile/infosecbot.bsky.social/post/3mwstfcsvt225"}, {"timestamp": "2026-10-01T16:22:59.647Z", "date_only": false, "value": "2026-10-01T16:22:59.647414Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwtbe54vj22l", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "14ad1b96-d28d-4bc3-bb14-9c8a24c964cd", "content": "~Spiderlabs~\nExploitation progressed from command injection to payloads, reverse shells, config theft, privileged access, and web shells.\n-\nIOCs: 64[.]94[.]85[.]67, 45[.]141[.]21[.]130, 23[.]27[.]143[.]20\n-\n#CVE-2026-88771 #NetScaler #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwtbe54vj22l"}, {"timestamp": "2026-10-01T17:00:06Z", "date_only": false, "value": "2026-10-01T17:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8670", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6030befb-cdd1-4f20-bd4c-8ee411e169fa", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u044b\u0434\u0435\u043b\u0438\u043c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435:\n\n1. TeamViewer \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u044f\u0434\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0435 \u0438 \u0445\u043e\u0441\u0442-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435.\n\n\u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f - \u044d\u0442\u043e \u043e\u0431\u0445\u043e\u0434 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u0435\u0441\u0441\u0438\u044f\u043c (CVE-2026-92370), \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u044e\u0449\u0438\u0439 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432 TeamViewer Full Client \u0438 Host \u0434\u043b\u044f Windows, Linux \u0438 macOS, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f, \u0432\u0435\u0434\u0443\u0449\u0438\u0435 \u043a RCE \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u0427\u0435\u0442\u044b\u0440\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f \u043e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 (CVE-2026-19743), \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435 (CVE-2026-92368), \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 TOCTOU (CVE-2026-92369) \u0438 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0443\u044e \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u0443\u0442\u0438 (CVE-2026-92371), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f.\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0443\u0440\u043e\u0432\u043d\u044f NT AUHORITY/SYSTEM \u0438\u043b\u0438 root.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0433\u043e PoC \u0438\u043b\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u043e\u043d\u0430 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c TeamViewer \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 15.82.\n\n2. \u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 Microsoft, \u0445\u0430\u043a\u0435\u0440\u044b \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421 CVE-2026-73570 (CVSS 8,9) \u0432 Zimbra Collaboration Suite (ZCS) \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 10.1.20 \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439, \u0435\u0449\u0435 \u0434\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f CVE-2026-73570 \u0431\u044b\u043b\u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b 20 \u0438\u044e\u043b\u044f \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 ZCS 10.1.20, \u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043d\u0435\u0439 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u043e\u0434\u043e\u0432\u0430\u043d\u0430 13 \u0430\u0432\u0433\u0443\u0441\u0442\u0430. \u0412 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 28 \u0438\u044e\u043b\u044f \u043f\u043e 7 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 Microsoft \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0434\u0432\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u0432\u043d\u0435 \u043f\u043e\u043b\u043e\u0441\u044b \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u043d\u0438\u044f \u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u0443\u044e \u0442\u043e\u0447\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f.\n\n3. WatchGuard \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f 15 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430, DoS-\u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0438 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0443\u0442\u0435\u0439 \u0432 Fireware OS, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 RCE.\n\nCVE-2026-86131 (CVSS 9.2), \u043e\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 BOVPN \u0447\u0435\u0440\u0435\u0437 TLS.  \u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 VPN-\u0441\u0435\u0440\u0432\u0435\u0440, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u043c\u0441\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 Firebox.\n\n4. Bitget \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438, \u0443\u043a\u0440\u0430\u0432\u0448\u0438\u0435 \u0443 \u043d\u0435\u0435 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 387,5 \u043c\u043b\u043d. \u0434\u043e\u043b\u043b., \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f 0-day \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c SlowMist \u0438 Mandiant (1 \u0438 2), \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0434\u0430\u043d\u0438\u0439 \u0434\u043b\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043d\u043e\u0439 \u0431\u0438\u0440\u0436\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0434\u043b\u044f \u0432\u044b\u0432\u043e\u0434\u0430 \u0441\u0440\u0435\u0434\u0441\u0442\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u0440\u0430\u0436\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u043d\u043e\u0447\u0438 25 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f.\n\nBitget \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043e\u0431\u0435\u0449\u0430\u0435\u0442 5% \u0442\u0435\u043c, \u043a\u0442\u043e \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0438\u043b\u0438 \u0437\u0430\u043c\u043e\u0440\u043e\u0437\u0438\u0442\u044c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u0435 \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a\u0438.\n\n5. KiteWorks \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u0432\u043e\u0435\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0431\u0440\u0430\u0434\u043e\u0432\u0430\u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0442\u0435\u043c, \u0447\u0442\u043e \u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043e\u0436\u043d\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u0441\u043d\u043e\u0432\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043a \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0443.\n\n\u041d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 Kiteworks \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e\u0442 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u043e\u0432 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0433\u043e\u0442\u043e\u0432\u044f\u0442\u0441\u044f \u043a \u0430\u0442\u0430\u043a\u0430\u043c \u043d\u0430 \u0435\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u044b.\n\n6. \u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Python Authlib \u043d\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0443 \u0441 \u043f\u0443\u0441\u0442\u044b\u043c \u043f\u043e\u043b\u0435\u043c \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 OAuth \u0438 OpenID.\n\n7. Palo Alto Networks \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u043f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438\u043c\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043e\u043a\u043e\u043b\u043e 50 000 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0434\u043b\u044f \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 CVE-2026-88772 \u0438 CVE-2026-88771 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 NetScaler.\n\n8. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a \u041f\u041e \u041d\u0430\u0442\u0430\u043d \u0424\u0430\u0440\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b Relapse, \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 PS5. \u041e\u043d \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 GitHub.\n\n9. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 Google \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u043e, \u043a\u0430\u043a \u0418\u0418 \u043c\u0435\u043d\u044f\u0435\u0442 \u0442\u0435\u043c\u043f\u044b \u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 GTIG, \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0432\u044b\u044f\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u0430\u0436\u0434\u044b\u0439 \u043c\u0435\u0441\u044f\u0446 \u0432 2026 \u0433\u043e\u0434\u0443, \u043a\u0430\u043a \u0438 \u0441\u0440\u0435\u0434\u043d\u0435\u043c\u0435\u0441\u044f\u0447\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445, \u0443\u0434\u0432\u043e\u0438\u043b\u043e\u0441\u044c.\n\n10. \u041f\u043e\u0437\u0438\u0442\u0438\u0432\u044b \u0432 \u0431\u043b\u043e\u0433\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438 \u043f\u0440\u043e \u0442\u043e, \u043a\u0430\u043a \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043d\u0430\u0439\u0442\u0438  CVE-2026-43783: LPE \u0447\u0435\u0440\u0435\u0437 DesktopServicesHelper \u0432 macOS 26.5.", "url": "https://t.me/true_secator/8670"}, {"timestamp": "2026-10-01T17:20:54.221Z", "date_only": false, "value": "2026-10-01T17:20:54.221639Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117366799289085094", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "b227c481-c661-4add-b159-086bf90a1d46", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117366799289085094"}, {"timestamp": "2026-10-01T17:21:10.762Z", "date_only": false, "value": "2026-10-01T17:21:10.762240Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtem4q7q22w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "19cc3f71-2ded-4b53-a2c3-b555cf483232", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwtem4q7q22w"}, {"timestamp": "2026-10-01T20:00:16.678Z", "date_only": false, "value": "2026-10-01T20:00:16.678143Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwtnioo5cz2q", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "ad995994-19b8-471f-8262-b3e9ef942bae", "content": "Citrix NetScaler zero-days are actively exploited in the wild affecting 50K+ instances. Critical RCE vulnerabilities\u2026\n\nhttps://dev.to/mark0_617b45cda9782a/threat-brief-netscaler-zero-days-cve-2026-88771-and-cve-2026-88772-exploited-in-the-wild-2c30\n\n#networking #infrastructure", "url": "https://bsky.app/profile/getpacketai.bsky.social/post/3mwtnioo5cz2q"}, {"timestamp": "2026-10-01T21:00:04Z", "date_only": false, "value": "2026-10-01T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2b4d0971-7257-4f86-b731-551cf5b65e54"}, {"timestamp": "2026-10-01T21:00:04Z", "date_only": false, "value": "2026-10-01T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/qelajjk7aT2hBG_5dRiefV98dTf1cspjOH0LxyjCX9MkcYY", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "7cf28245-9795-413d-997b-074572a77fe4"}, {"timestamp": "2026-10-02T00:00:00Z", "date_only": false, "value": "2026-10-02T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-02)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "85bb5593-26af-4a75-9c1d-6a142b82425e"}, {"timestamp": "2026-10-02T00:30:00Z", "date_only": false, "value": "2026-10-02T00:30:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/cert-se-veckobrev-v40.html", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "310fca93-305e-4ace-8c24-1c366bdacd0f", "url": "https://www.cert.se/2026/10/cert-se-veckobrev-v40.html"}, {"timestamp": "2026-10-02T14:11:24.555Z", "date_only": false, "value": "2026-10-02T14:11:24.555446Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-6ad88b71-b1fa10d6dd4ce1d1", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "44f3d303-2805-42c6-85fd-e14121f1c6af", "content": "This Week in Security: ShinyHunters Won\u2019t Dox the FBI, Pentagon Data Stolen, and OBS Vulnerable\n404 Media reports that the ShinyHunters group who stole multiple terabytes of FBI employee data say they do not plan to release the data.\nKnown for ransomware and extortion of innumerable companies and government agencies, ShinyHunters used a zero-day vulnerability in Oracle PeopleSoft to compromise the employment site of the FBI and pivot into scraping the content of FBI AWS instances, claiming to have the full employment and health data of all FBI agents, employees, and spouses.\nThe hacker group took exception to an FBI press release that claimed that the group over-stated stolen data and that they directly harass victims and victim\u2019s families.  The group publicized the FBI data breach, demanding a retraction of the statements, and it was generally assumed that the group would follow their typical methods of releasing the data publicly if the demands were not met.\nThe group has told 404 media that they had always agreed internally to not release the stolen data, saying \u201cThis was all a marketing campaign to protect our business and actively combat disinformation\u201d.  Meanwhile the FBI continues the investigation, and Shiny Hunters may be hoping to defer some of the ire.\nPentagon Data Breach\nA data breach at the Defense Manpower Data Center lasted for nine months before it was discovered, and allowed unknown attackers to exfiltrate information on military personnel.\nThe information stolen includes social security numbers and \u201coperational specialty\u201d data about where a service member is employed within the armed forces.  The DMDC handles data on 60 million current and former service members, but the report does not specify the number impacted.\nCurrently the source of the attack is unknown; the attackers may be a typical data ransom or theft group, but information about service members could easily be used by foreign intelligence groups.\nThis is, of course, a different attack and leak of US government employee data, independent of the attack on the FBI.\nOpenAI Hacked Australian Government Databases\nThe Australian Prime Minister, Anthony Albanase, has released a statement that OpenAI was involved in a hacking incident against the Australian government health services site.\nThis is independent of other incidents involving OpenAI agents hacking live Internet sites during testing; OpenAI says the hack was discovered on September 10, 2026, but the incident occurred in June of 2026, prior to the hack of the HuggingFace site.\nIn the Hugging Face attack, AI agents were asked to complete a cyber security challenge and responded by finding and utilizing vulnerabilities to steal the solutions.  A report by Translucence (an AI research lab) finds however that in this instance, the agents were tasked with non-cyber related research and opted to exploit not only the Australian health services site but also the University of New Mexico digital library and Data USA, a platform for collecting and visualizing US government data.\nOpenAI says the review of the incident remains ongoing, and that no private patient data was compromised.  The Australian government, obviously, has stronger opinions about how the incident occurred and the length of time before they were notified.  If agents are defaulting to exploiting live Internet sites for normal queries, we\u2019re likely to keep finding more stories like this.\nPhysical Attack Against MacOS Lockdown Mode\nResearcher Kevin Kessler at glyph.sh discloses a new vulnerability in macOS that can allow keyboard attacks even when lockdown mode is enabled.\nMacOS has built-in protection measures against malicious USB devices.  Readers using macOS may have seen prompts to allow a USB device to connect the first time it is plugged in; additionally, new USB devices are ignored if a Mac has been locked for more than an hour.\nIn the extra-paranoid \u201cLockdown Mode\u201d, macOS will also prevent connections to USB devices entirely while the device is locked.  Lockdown mode also disables other operating system features that are suspected of being less secure, like custom web fonts, just-in-time compilation of JavaScript to native code, and direct messaging from unknown contacts. This attack defeats all of these protections.\nDue to the architecture of USB, if a USB hub is connected to macOS and trusted, all devices plugged into that hub are automatically trusted. A composite USB device \u2014 a device that presents as multiple types of USB interfaces on a single connection \u2014 can identify as both a serial port and a keyboard in a single device.\nTypically macOS would prompt the user that a new keyboard has been connected, but does not prompt the user when a new USB serial port device is connected to a trusted hub.  Presenting as both a serial device and a keyboard, key presses are accepted automatically, with no user prompt.\nKessler demonstrates copying sensitive user data like SSH keys and cloud provider authentication tokens directly over the USB serial device, a trick which may bypass endpoint protection tools looking for copied files.\nApple told the researcher that the behavior is expected when a USB hub has been trusted, and that composite USB devices are outside the scope of the protection mechanisms.  If so, perhaps it needs to be more clearly communicated to users the risk of trusting any USB hub or dock if an attacker could conceivably get physical access.\nSpying with File Update Notifications\nNew attacks against the file notification systems of all major operating systems \u2014 Windows, macOS, Linux, and Android \u2014 will be shown at the November 2026 ACM security conference.\nFile notification systems are a crucial part of almost all modern operating systems, letting the UI and background services receive alerts that file content has changed, instead of constantly querying file modification times.  Unfortunately, it seems like all of them have major issues and allow bypassing permissions and access restrictions.\nThe researchers call out Windows as the worst offender:  it allows a notification to be set for any file modification, system wide, regardless of access permission or what user owns it.  To be fair, it seems like Linux, macOS, and Android aren\u2019t too far behind however.\nOn Linux, the inoti.fyi researchers discovered that while notifications can\u2019t be set on files the user isn\u2019t allowed to access, notifications can still be set on readable parent directories, and will still report changes to the files.  Leveraging this oversight against the /dev/input directory, events are raised for every keystroke, and they reference decades of research on using keystroke timing to guess what was typed.\nFor Android, permission oversights allow one application to set notifications for the private storage of other applications.  Normally, each application runs in a separate sandbox and has no insight into the behavior of other apps, using the Android file notification API, they demonstrate monitoring WhatsApp to log the exact time messages and photos are received.\nThe Windows vulnerability may be the most immediately severe, where the inoti.fyi team is able to monitor the cache and local storage directories of browsers.  Browsers like Firefox create files with the name of the website; by monitoring the cache directories, it\u2019s possible to monitor the websites loaded by any user on the system.\nThe team has been working with vendors to address the issues, however in most cases there are no fixes available yet.\nOBS Streaming Platform Vulnerable\nOBS is a popular tool for streamers, compositing multiple cameras, screen and video capture, and more. A large percentage of streamers on the Internet use OBS.\nOrange Cyberdefense Switzerland reports vulnerabilities in OBS due to the embedded Chromium browser source.  Chromium is the open-source engine behind Chrome, Opera, Microsoft Edge, Vivaldi, and many other browsers; OBS embeds the browser engine to allow embedded web content and web-based applications inside a stream.\nStreamers often have an embedded display of the chat associated with their stream, encouraging audience participation.  These embeds usually use a browser window to stylize the chats and embed images, which exposes them to whatever the content of the chat message is. Astute readers may already guess how this is a problem.\nIn a typical browser, each tab is isolated in an independent sandbox, preventing it from interacting with other tabs or the browser itself, but in the OBS embedded browsers, sandboxes are disabled.  OBS also used a two-year-old Chromium engine that contained a publicly known and patched bug in the V8 JavaScript engine.  The bug had already been exploited in the wild by North Korean hackers, but the impact was limited thanks to the sandbox mechanism isolating each tab. With no sandbox, malicious HTML and JavaScript rendered by a web view could directly execute code on the system, taking over the OBS instance or the whole system.\nThe researchers at Orange have worked with OBS to update the embedded Chromium version, but also offer the advice that untrusted HTML should be avoided whenever possible:  No OBS widget should ever render user or chat content as HTML.\nDIVD Hacked\nDIVD, the Dutch Institute for Vulnerability Disclosure, announced that they were the victims of a recent hack themselves.\nDIVD says that the attackers got in through two previously unknown bugs in the Zammad help desk software, and that the attackers appear to be AI agents. Within seconds, attackers hijacked Zammad sessions, gained code execution, and then gained root access to the system. DIVD says the attackers immediately began to exfiltrate data from the impacted systems, but were blocked from accessing other government systems.\nThe Institute is using this as a teaching moment, not only releasing an advisory for the Zammad system, but making a candid LinkedIn post discussing the incident and the responses: \u201cSo what do hackers do when they get hacked? Handle it the way we think it should be handled. That is open, transparent and honest, even if it sucks.\u201d\nEnterprise Networking Vulnerabilities\nMajor vulnerabilities have been found exploited in the wild for both Cisco Catalyst SD-WAN and Citrix Netscaler enterprise devices. A relatively bland Cisco announcement discloses that all versions of the Cisco Catalyst SD-WAN Manager allow unauthenticated, remote, admin access. (!)\nThe Citrix Netscaler article, on the other hand, comes from the team at watchTowr.  Anyone who has been reading for the past months should know that a post from watchTowr is a guaranteed good read.  Not only are the vulnerabilities in Netscaler plentiful and severe, but they were widely known and exploited before Citrix finally released a vulnerability statement.\nThe Netscaler vulnerabilities include arbitrary commands from unauthenticated users, remote code execution and denial of service attacks against the VPN server, multiple memory overflows, and predictable random generation in some situations.\nWatchTower digs into the firmware changes for more details, so if seeing how Perl is still used in 2026 enterprise equipment tickles your fancy, be sure to give them a read. \nhackaday.com/2026/10/02/this-w\u2026RE: 404media.co/.ghost/activitypub\u2026", "url": "https://poliverso.org/objects/0477a01e-6ad88b71-b1fa10d6dd4ce1d1"}, {"timestamp": "2026-10-02T14:17:27.021Z", "date_only": false, "value": "2026-10-02T14:17:27.021041Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkslebtp24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "481885a5-e9bf-48f7-a71a-9672e809c72a", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwvkslebtp24"}, {"timestamp": "2026-10-02T15:00:09Z", "date_only": false, "value": "2026-10-02T15:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/104081", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5dff53bc-425e-466b-b016-60acfd7b2650", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a netscaler_threat_hunt_helper\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a orjanj\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-02 14:50:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nNetScaler CTX697096 Threat Hunt Helper (IoC scanner) - CVE-2026-88771, CVE-2026-88772\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/104081"}, {"timestamp": "2026-10-02T15:01:29Z", "date_only": false, "value": "2026-10-02T15:01:29.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/sec_post/1563", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9f4bc0a8-4323-40dd-ae4d-680f6761c269", "content": "\ud83d\udea8 \u00ab\u0412\u0437\u043b\u043e\u043c \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0438\u00bb: \u0432 Citrix NetScaler \u043d\u0430\u0448\u043b\u0438 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9,5 \u2014 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0446\u0435\u043d\u0438\u043b\u0438 \u0443\u0433\u0440\u043e\u0437\u0443 \u0434\u043b\u044f \u0420\u043e\u0441\u0441\u0438\u0438\n\n\u25b6\ufe0f\u0412 NetScaler \u043e\u0442 Citrix \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 zero-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 RCE (CVE-2026-88771) \u0438 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 (CVE-2026-88772). \u041e\u0431\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043e\u0446\u0435\u043d\u043a\u0443 9,5 \u043f\u043e CVSS, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 NetScaler ADC \u0438 Gateway \u0432 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430, DDoS-\u0430\u0442\u0430\u043a\u0430\u043c \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b. \n\n\u25b6\ufe0f\u0412 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u043c \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0431\u043e\u043b\u0435\u0435 200 \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0439 Citrix NetScaler, \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u2014 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442: 200 \u2014 \u00ab\u043d\u0438\u0447\u0442\u043e\u0436\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u00bb, \u043d\u043e \u044d\u0442\u043e \u043e\u0433\u0440\u043e\u043c\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f. \u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u043e\u043f\u0430\u0441\u043d\u0435\u0435 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e NetScaler \u0434\u043e\u043b\u0436\u0435\u043d \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u043f\u0435\u0440\u0438\u043c\u0435\u0442\u0440\u0435 \u2014 \u0435\u0433\u043e \u043d\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u0441\u044f \u043f\u0440\u043e\u0441\u0442\u043e \u0441\u043f\u0440\u044f\u0442\u0430\u0442\u044c.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 SecPost\ud83d\ude0d", "url": "https://t.me/sec_post/1563"}, {"timestamp": "2026-10-02T16:51:47.583Z", "date_only": false, "value": "2026-10-02T16:51:47.583864Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117372348454854312", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3ddd7f31-a174-4b6d-913e-a9c718cf0a97", "content": "\ud83d\udea8 Reports of NetScaler Incidents After Latest Patch Raise Concerns Over Continued Exploitation\nMultiple Citrix administrators are reporting suspicious activity affecting NetScaler appliances even after updating to version 14.1-73.37.\nThe reports surfaced on Reddit, where one administrator said multiple customers experienced incidents that caused externally accessible NetScaler appliances to repeatedly reboot.\nOther administrators reported similar behavior on newly rebuilt appliances, including systems where Enhanced ISN Generation had already been enabled. Several affected organizations said they collected forensic data and opened cases with Citrix.\nIt is currently unclear whether the activity represents successful exploitation of a new or existing vulnerability, residual compromise, vulnerability scanning, or an issue with the updated firmware.\nThe reports come days after Citrix disclosed active exploitation of CVE-2026-88771 and CVE-2026-88772, two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway.\nThe latest post-patch activity has not yet been confirmed by Citrix as exploitation.\n\ud83d\udca5 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing\nSource: https://www.reddit.com/r/Citrix/comments/1wvwva9/netscaler_active_exploit_after_patch/?rdt=60164", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117372348454854312"}, {"timestamp": "2026-10-02T21:32:31.598Z", "date_only": false, "value": "2026-10-02T21:32:31.598786Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mwwd4kfxy22t", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1110c46c-28f2-4119-8bff-3633dc8c8835", "content": "Citrix flags a NetScaler SAML authentication issue as patched NetScaler appliances reboot after CVE-2026-88771 attacks. Check your config.\n\n#Citrix #NetScaler #SAML #CVE202688771 #CVE202688772 #ZeroDay #Vulnerability", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mwwd4kfxy22t"}, {"timestamp": "2026-10-03T00:00:00Z", "date_only": false, "value": "2026-10-03T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-03)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "dc5a166d-050c-4d00-b9f3-584fd164c189"}, {"timestamp": "2026-10-03T03:00:29.697Z", "date_only": false, "value": "2026-10-03T03:00:29.697978Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwwvgyelnc2v", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "08083a62-a740-49a2-bd80-edc80729831b", "content": "Citrix NetScaler-appliances kampen met rebootproblemen na beveiligingsupdate\n\nCitrix NetScaler-klanten ervaren frequente herstarts van hun appliances nadat ze build 14.1-73.37 hebben ge\u00efnstalleerd. Deze noodupdate werd uitgebracht om twee zero-day kwetsbaarheden, CVE-2026-88771 en CVE-20...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mwwvgyelnc2v"}, {"timestamp": "2026-10-03T05:29:04.488Z", "date_only": false, "value": "2026-10-03T05:29:04.488151Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/royans.bsky.social/post/3mwx5qoxn3g2w", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "39b756cb-4e64-461c-9d04-5b19fa4069d6", "content": "Bitget $388M Breach via Citrix NetScaler ADC Zero-Day Exploit\n\nhttps://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772\nhttps://flagthis.com/tldr/8192\n\n##Bitget ##ZeroDay ##LazarusGroup ##DataBreach ##Citrix", "url": "https://bsky.app/profile/royans.bsky.social/post/3mwx5qoxn3g2w"}, {"timestamp": "2026-10-03T07:03:23.187Z", "date_only": false, "value": "2026-10-03T07:03:23.187502Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwxcz4x2cr2v", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "8462852e-6151-41ee-b5a9-f0f24c384142", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 112 interactions\nCVE-2026-88772: 106 interactions\nCVE-2026-86950: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-5715: 12 interactions\nCVE-2026-104286: 11 interactions\nCVE-2026-93698: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwxcz4x2cr2v"}, {"timestamp": "2026-10-03T08:40:20.522Z", "date_only": false, "value": "2026-10-03T08:40:20.522616Z", "kind": "sighting", "label": "Seen", "source": "https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "93f8a369-12f0-4e53-836e-a94c5767fc8d", "url": "https://www.heise.de/news/Netscaler-Admins-aufgepasst-Zero-Day-verursacht-Crashes-und-Codeausfuehrung-11474971.html"}, {"timestamp": "2026-10-03T19:05:05.871Z", "date_only": false, "value": "2026-10-03T19:05:05.871361Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117378534840533079", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "7477a26e-c6a7-46d0-b049-a7494f7319f5", "content": "\ud83d\udcf0 Citrix Patches Two Critical NetScaler Zero-Days Under Active Attack\nCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\ud83d\udd17 https://cyber.netsecops.io/articles/citrix-netscaler-zero-day-vulnerabilities-cve-2026-88771-cve-2026-88772-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117378534840533079"}, {"timestamp": "2026-10-03T19:05:29.545Z", "date_only": false, "value": "2026-10-03T19:05:29.545663Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwylekl2bf2b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "21d8ae9e-c7e1-494e-a4a4-aa8c1ff260e9", "content": "Critical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwylekl2bf2b"}, {"timestamp": "2026-10-03T20:19:19.859Z", "date_only": false, "value": "2026-10-03T20:19:19.859251Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pylos.co/post/3mwypidhmpc2c", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "cea958d0-8abb-4b96-acb6-202b271b3d98", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.cyber.gov.au/about-us/vie...", "url": "https://bsky.app/profile/pylos.co/post/3mwypidhmpc2c"}, {"timestamp": "2026-10-03T20:19:20.599Z", "date_only": false, "value": "2026-10-03T20:19:20.599140Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mwypim3wqu2w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "dbc9d8dc-2ffc-4dfa-aeff-8d97f7cf55b1", "content": "\u201cThis issue is understood to be separate from the vulnerabilities outlined below [CVE-2026-88771 and CVE-2026-88772].\u201d\n\nwww.potato.gov.au/about-us/vie...", "url": "https://bsky.app/profile/potato.software/post/3mwypim3wqu2w"}, {"timestamp": "2026-10-04T00:00:00Z", "date_only": false, "value": "2026-10-04T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-04)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "de409322-77b5-4541-bf10-eaee77989fdb"}, {"timestamp": "2026-10-04T00:00:00Z", "date_only": true, "value": "2026-10-04", "kind": "milestone", "label": "Published", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-10-04T00:00:31Z", "date_only": false, "value": "2026-10-04T00:00:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/828ebfca260883781a43da47bec1fe3e", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6dc660c7-34b2-4aa8-8a88-920a91967c41", "content": "This threat intelligence update highlights two key developments:\n\n\u2022 **Aegis WAF & Reverse Proxy:** Divine Lab released Aegis, a free, open-source next-generation WAF and edge proxy featuring sub-millisecond latency, OWASP-compliant anomaly scoring, Layer 7 rate limiting, automated TLS, and zero-downtime policy updates.\n\n\u2022 **Critical Citrix NetScaler Vulnerabilities:** The Canadian Centre for Cyber Security warns of two actively exploited CVEs (CVE-2026-88771 & 88772) in NetScaler ADC and Gateway that enable remote code execution and full appliance compromise. Update 1 identifies a separate SAML authentication flaw causing system instability and DoS. Organizations are urged to patch immediately, investigate for persistent threats (vendor updates may not remove backdoors), preserve forensic evidence, and follow strict incident response and isolation protocols.", "url": "https://gist.github.com/ichintu/828ebfca260883781a43da47bec1fe3e"}, {"timestamp": "2026-10-04T04:01:44.660Z", "date_only": false, "value": "2026-10-04T04:01:44.660144Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mwzjdgiytl23", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "20794f98-2224-4acc-9df6-8048d824c229", "content": "~Cybergcca~\nActively exploited NetScaler flaws enable remote code execution and appliance compromise.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772\n-\n#CVE202688771 #CVE202688772 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mwzjdgiytl23"}, {"timestamp": "2026-10-04T06:01:31.906Z", "date_only": false, "value": "2026-10-04T06:01:31.906606Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/raven-sec.bsky.social/post/3mwzpzkqp6tx7", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f708fdf4-d32c-460e-bc35-180c3c31a6a4", "content": "Citrix flaws under attack, Chinese espionage targets 100+ U.K. academics, Warlock hits Iberia.\n\n\u2022 CVE-2026-88771/88772 actively exploited (news/7207a6cc)\n\n5 sources verified \u00b7 hackingallthethings.com\n#infosec #threatintel #cybersecurity #CVE #APT", "url": "https://bsky.app/profile/raven-sec.bsky.social/post/3mwzpzkqp6tx7"}, {"timestamp": "2026-10-04T07:16:55.247Z", "date_only": false, "value": "2026-10-04T07:16:55.247340Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mwzuah4n5t2c", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "e81112c8-9854-4be4-886a-0b9ff6b9a9ea", "content": "Patching NetScaler CVE-2026-88771 doesn't evict intruders: LevelBlue saw a sec_monitor superuser and a PHP web shell behind CSS-like URLs; Sucuri's WordPress SC backdoor rebuilds from 8 persistence points. Hunt, don't just patch. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mwzuah4n5t2c"}, {"timestamp": "2026-10-04T07:21:43.551Z", "date_only": false, "value": "2026-10-04T07:21:43.551505Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwzuizzpzn2j", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "92f02456-1dba-4b74-b670-57591c5b0314", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 122 interactions\nCVE-2026-88772: 118 interactions\nCVE-2026-86950: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 12 interactions\nCVE-2026-88771: 10 interactions\nCVE-2026-104286: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwzuizzpzn2j"}, {"timestamp": "2026-10-04T10:05:39Z", "date_only": false, "value": "2026-10-04T10:05:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler-1", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "9e3f2dae-c90a-458f-8490-3d78f498234b", "url": "https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-netscaler-1"}, {"timestamp": "2026-10-04T11:39:51.189Z", "date_only": false, "value": "2026-10-04T11:39:51.189519Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mx2cwmixbi2e", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2472a163-3f17-457b-91aa-442f3878ad91", "content": "netscaler-ctx697096-checker: Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771\u201388778): build, all 8 CVE preconditions, Enhanced ISN, upgrade risks, SAML status, plus --ioc sweep with every public IoC (webshells, implants, backdoor ad", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mx2cwmixbi2e"}, {"timestamp": "2026-10-04T18:12:30.719Z", "date_only": false, "value": "2026-10-04T18:12:30.719160Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mx2yuqj6kz2w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d91ffcd1-b537-44cf-a92a-63b8902814b4", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-88771", "url": "https://bsky.app/profile/csirts.com/post/3mx2yuqj6kz2w"}, {"timestamp": "2026-10-04T18:48:34.453Z", "date_only": false, "value": "2026-10-04T18:48:34.453675Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/todb2.hugesuccess.org/post/3mx32v25anja2", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "c479f1b9-8765-4c72-925f-ca504e27703c", "content": "I didn\u2019t realize the EU CERT was so witty!\n\nhttps://cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771\n\n(analysis of the NetScaler thing from last week.)", "url": "https://bsky.app/profile/todb2.hugesuccess.org/post/3mx32v25anja2"}, {"timestamp": "2026-10-05T00:00:00Z", "date_only": false, "value": "2026-10-05T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-05)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1120c4b7-c541-4330-a8b5-916cf6a29011"}, {"timestamp": "2026-10-05T00:00:00Z", "date_only": false, "value": "2026-10-05T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "last_revision_date"}, {"timestamp": "2026-10-05T00:00:00Z", "date_only": false, "value": "2026-10-05T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_alerte \u00b7 CERTFR-2026-ALE-011", "record": "CERTFR-2026-ALE-011", "field": "revisions.4.revision_date"}, {"timestamp": "2026-10-05T02:09:22.309Z", "date_only": false, "value": "2026-10-05T02:09:22.309000Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mx3tjgnytq2w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c2adb0dd-8925-4ad1-a89e-7d99add3745a", "content": "NetScaler ADC\u304a\u3088\u3073NetScaler Gateway\u306b\u304a\u3051\u308b\u8907\u6570\u306e\u8106\u5f31\u6027\uff08CVE-2026-88771\u3001CVE-2026-88772\u7b49\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77 #JPCERTCC \uff08Oct 2\uff09\nwww.jpcert.or.jp/at/2026/at26...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mx3tjgnytq2w"}, {"timestamp": "2026-10-05T02:15:35Z", "date_only": false, "value": "2026-10-05T02:15:35.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.dk/news/2026-10-05/Ny-Citrix-0-dag-rammer-selv-nyopdaterede-NetScaler-enheder", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "8d341091-e0ee-440f-8c98-1bc7c261c3fb", "url": "https://www.cert.dk/news/2026-10-05/Ny-Citrix-0-dag-rammer-selv-nyopdaterede-NetScaler-enheder"}, {"timestamp": "2026-10-05T07:18:02Z", "date_only": false, "value": "2026-10-05T07:18:02.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/kasperskyb2b/2331", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f6d6ab19-82cb-4548-acae-b8f2922a66a8", "content": "\u2757\ufe0f \u041d\u043e\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u043d\u0430 NetScaler, \u0442\u0435\u043f\u0435\u0440\u044c \u0435\u0449\u0451 \u0438 CVE-2026-88779 \n\n\u041a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Citrix NetScaler ADC \u0438 Citrix NetScaler Gateway, \u043a\u043e\u043b\u043b\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0445 PitScaler, \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0435 \u043a\u0440\u0443\u0433\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043f\u0430\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 CVE-2026-88771 \u0438 -88772 (CVSS4B 9.5) \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 4 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043f\u0440\u0438\u0432\u043e\u0434\u044f \u043a \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0430\u0437\u0438\u043b\u0430 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 CERT \u0434\u0430\u0436\u0435 \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043e\u0442 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.  \u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f CTX697096 (\u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0435\u0449\u0451 6 CVE \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0432\u044b\u0448\u0435\u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c) 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 \u0431\u044b\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, TTPs \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0415\u0441\u043b\u0438 \u043f\u0435\u0440\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439, \u0433\u0434\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0436\u0435\u0440\u0442\u0432\u0435 \u043e\u0442\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0434\u0447\u0438\u0449\u0430\u043b\u0438 \u0441\u043b\u0435\u0434\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445, \u0442\u043e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u043e\u043b\u043d\u0435 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430\u0443\u0434\u0430\u0447\u0443. \u0427\u0438\u0441\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 SAML-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a DoS \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.  \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2026-88779 (CVSS4B 8.7) \u0438 \u0434\u043b\u044f \u043d\u0435\u0451 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u044b\u0448\u043b\u043e \u0435\u0451 \u043e\u0434\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0412\u0430\u0436\u043d\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0443\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u041f\u041e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0432\u0437\u043b\u043e\u043c\u0430. \u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0437\u0435\u043b, \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e (HA synchronization), \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u0438\u0441\u043a\u043e\u0432 \u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0447\u0438\u0441\u0442\u044b\u0439 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437, \u0430 \u043d\u0435 \u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0442\u0430\u0440\u044b\u0439.  \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0440\u0438\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u043f\u043e\u043b\u043d\u0443\u044e \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 (nsroot, LDAP bind, RADIUS, API-\u043a\u043b\u044e\u0447\u0438, KEK \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b), \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0447\u0430\u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432. \n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0438 IoC: 1, 2, 3, 4.\n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "url": "https://t.me/kasperskyb2b/2331"}, {"timestamp": "2026-10-05T07:18:02Z", "date_only": false, "value": "2026-10-05T07:18:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/kasperskyb2b/2331", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0578cac0-4042-4aef-9bdc-2007d371aa0b", "content": "\u2757\ufe0f \u041d\u043e\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u043d\u0430 NetScaler, \u0442\u0435\u043f\u0435\u0440\u044c \u0435\u0449\u0451 \u0438 CVE-2026-88779 \n\n\u041a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0441\u0432\u0435\u0436\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Citrix NetScaler ADC \u0438 Citrix NetScaler Gateway, \u043a\u043e\u043b\u043b\u0435\u043a\u0442\u0438\u0432\u043d\u043e \u043d\u0430\u0437\u0432\u0430\u043d\u043d\u044b\u0445 PitScaler, \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0435 \u043a\u0440\u0443\u0433\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043f\u0430\u0440\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0434\u0435\u0444\u0435\u043a\u0442\u043e\u0432 CVE-2026-88771 \u0438 -88772 (CVSS4B 9.5) \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043a\u0430\u043a \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0441 4 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043f\u0440\u0438\u0432\u043e\u0434\u044f \u043a \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432 \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0441\u0435\u0442\u044c. \u041a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u043e\u0440\u0430\u0437\u0438\u043b\u0430 \u043c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0421\u0428\u0410 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 CERT \u0434\u0430\u0436\u0435 \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 NetScaler \u043e\u0442 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430.  \u041f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044f CTX697096 (\u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0435\u0433\u043e \u0435\u0449\u0451 6 CVE \u0432 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0432\u044b\u0448\u0435\u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c) 27 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC \u0438 \u0431\u044b\u043b\u0438 \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, TTPs \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f \u043e\u0442 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0415\u0441\u043b\u0438 \u043f\u0435\u0440\u0432\u0430\u044f \u0432\u043e\u043b\u043d\u0430 \u0430\u0442\u0430\u043a \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0434\u0438\u0441\u0446\u0438\u043f\u043b\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u043e\u0439, \u0433\u0434\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u0436\u0435\u0440\u0442\u0432\u0435 \u043e\u0442\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u0443\u044e \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u044e \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u0430 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0434\u0447\u0438\u0449\u0430\u043b\u0438 \u0441\u043b\u0435\u0434\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445, \u0442\u043e \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0432\u043e\u043b\u043d\u0435 \u0434\u043e\u043c\u0438\u043d\u0438\u0440\u0443\u044e\u0442 \u043d\u0435\u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0430\u0443\u0434\u0430\u0447\u0443. \u0427\u0438\u0441\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u0445\u0441\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u0443\u0442\u044c \u0432 \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 SAML-\u0437\u0430\u043f\u0440\u043e\u0441\u044b, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a DoS \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.  \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 CVE-2026-88779 (CVSS4B 8.7) \u0438 \u0434\u043b\u044f \u043d\u0435\u0451 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u044b\u0448\u043b\u043e \u0435\u0451 \u043e\u0434\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0412\u0430\u0436\u043d\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0443\u0442\u044c, \u0447\u0442\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u041f\u041e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0439 \u0432\u0437\u043b\u043e\u043c\u0430. \u041f\u0440\u0438 \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u043d\u0438\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0437\u0435\u043b, \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u044e \u0434\u043b\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c\u044e (HA synchronization), \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0437\u044b \u0434\u0438\u0441\u043a\u043e\u0432 \u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0447\u0438\u0441\u0442\u044b\u0439 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437, \u0430 \u043d\u0435 \u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u0442\u044c \u0441\u0442\u0430\u0440\u044b\u0439.  \u0422\u0430\u043a\u0436\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0435\u0440\u0438\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u043f\u043e\u043b\u043d\u0443\u044e \u0440\u043e\u0442\u0430\u0446\u0438\u044e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 (nsroot, LDAP bind, RADIUS, API-\u043a\u043b\u044e\u0447\u0438, KEK \u0438 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u044b), \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0447\u0430\u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u043e\u0435 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 \u0433\u043b\u0443\u0431\u043e\u043a\u0438\u043c \u0430\u0443\u0434\u0438\u0442\u043e\u043c \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432. \n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u0430 \u0438 IoC: 1, 2, 3, 4.\n\n#\u043d\u043e\u0432\u043e\u0441\u0442\u0438 #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 @\u041f2\u0422", "url": "https://t.me/kasperskyb2b/2331"}, {"timestamp": "2026-10-05T07:23:06.759Z", "date_only": false, "value": "2026-10-05T07:23:06.759848Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mx4f2gpysa2t", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "41753cfb-904a-41eb-99bf-3bb657c37883", "content": "Discover how hackers exploit CVE-2026-88771 in Citrix NetScaler to hide PHP web shells as CSS files, granting remote access and compromising networks.\n\n#Citrix #NetScaler #Cybersecurity #WebShell #CVE202688771", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mx4f2gpysa2t"}, {"timestamp": "2026-10-05T07:38:39.655Z", "date_only": false, "value": "2026-10-05T07:38:39.655614Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx4fwaoq6x2e", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "37aef08d-d044-4dcb-87e4-a7f369e1acdd", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 72 interactions\nCVE-2026-88772: 70 interactions\nCVE-2026-104286: 36 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 23 interactions\nCVE-2026-61500: 4 interactions\nCVE-2026-105123: 3 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mx4fwaoq6x2e"}, {"timestamp": "2026-10-05T10:00:30Z", "date_only": false, "value": "2026-10-05T10:00:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/2a1ac2074ae10a8c5c664c8d13c0f492", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "7916d3c6-cf28-4af0-bb2e-b320f3f8a55c", "content": "# CVE-2026-88779: CVE-2026-88779: Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix NetScaler SAML Authentication Daemon\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-10-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88779\n\n## Summary\nCVE-2026-88779 is a critical vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway affecting systems configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). An unauthenticated remote attacker can exploit this vulnerability to trigger a buffer overflow in the authentication daemon, resulting in persistent denial of service and appliance crash loops.\n\n## TL;DR\nAn unauthenticated remote buffer overflow vulnerability in Citrix NetScaler's SAML parsing daemon (nsaaad) allows attackers to trigger a persistent, cluster-wide denial of service loop on affected ADC and Gateway appliances.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-119\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.7 (High)\n- **EPSS Score**: 0.00276\n- **Impact**: Denial of Service / High Availability Failover Loop\n- **Exploit Status**: active\n- **KEV Status**: Listed\n\n## Affected Systems\n\n- Citrix NetScaler ADC\n- Citrix NetScaler Gateway\n- **NetScaler ADC**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler Gateway**: < 14.1-73.41 (Fixed in: `14.1-73.41`)\n- **NetScaler ADC**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n- **NetScaler Gateway**: < 13.1-64.28 (Fixed in: `13.1-64.28`)\n\n## Mitigation\n\n- Apply security patches immediately to NetScaler appliances\n- Deploy temporary responder policies bound to AAA_REQUEST\n- Apply latest Application Firewall signature updates via NetScaler Console\n\n**Remediation Steps:**\n1. Verify if SAML is active using the command 'show authentication samlAction'\n2. If vulnerable, download firmware build 14.1-73.41 or 13.1-64.28\n3. Install the updated firmware according to Citrix deployment guidelines\n4. Verify that the nsaaad daemon is stable and no core dumps are generated\n\n## References\n\n- [Citrix Security Bulletin CTX697174](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174)\n- [Citrix Tech Zone Security Blog](https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/)\n- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88779)\n- [Thomas Poppelgaard NetScaler Checker](https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker)\n- [Orjan Johansen NetScaler Threat Hunt Helper](https://github.com/orjanj/netscaler_threat_hunt_helper)\n- [Technical Background Blog & Remediation Guide](https://www.poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88779) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/2a1ac2074ae10a8c5c664c8d13c0f492"}, {"timestamp": "2026-10-05T10:57:39.642Z", "date_only": false, "value": "2026-10-05T10:57:39.642851Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stiffeo.bsky.social/post/3mx4r23hu2s22", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0f468db8-f500-4952-888b-7e0e79e2f56e", "content": "\ud83d\udea8 If you are not patching your Netscalers today then what are you doing?!\nCheck out CVE-2026-88771.\n\nCHECK YOUR LOGG FOR TRAFFIC GOING TO 213.209.159.55.\n\n#CyberSEC", "url": "https://bsky.app/profile/stiffeo.bsky.social/post/3mx4r23hu2s22"}, {"timestamp": "2026-10-05T12:05:44Z", "date_only": false, "value": "2026-10-05T12:05:44.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/kasperskyb2b/2332", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "18c9a1e4-9d08-46f4-82f4-f8e1df15c535", "content": "\ud83d\udd25 \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f APT \u0438 \u043d\u043e\u0432\u043e\u0441\u0442\u0438 \u0418\u0411 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e\n\n\ud83d\ude31 \u0410\u043d\u0430\u043b\u0438\u0437 \u043c\u043e\u0434\u0443\u043b\u044c\u043d\u043e\u0433\u043e \u0412\u041f\u041e NeedyMantis, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0433\u0440\u0443\u043f\u043f\u043e\u0439 Storm-3069, \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043e\u043a DAEMON Tools. \u0410\u0442\u0430\u043a\u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u044b \u043d\u0430 \u0442\u0435\u043b\u0435\u043a\u043e\u043c, \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u044b \u0438 \u0433\u043e\u0441\u043f\u043e\u0434\u0440\u044f\u0434\u0447\u0438\u043a\u043e\u0432. \n\n\ud83d\udfe2\u0420\u0430\u0437\u0431\u043e\u0440 TTPs UAT-11587 \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0433\u0440\u0443\u043f\u043f\u043e\u0439 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 Antino. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u0430 \u0431\u044b\u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0433\u043e\u0441\u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0432 \u0432\u043e\u0441\u044c\u043c\u0438 \u0441\u0442\u0440\u0430\u043d\u0430\u0445,  \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0422\u0430\u0439\u0432\u0430\u043d\u044c, \u0418\u043d\u0434\u0438\u044e, \u0424\u0438\u043b\u0438\u043f\u043f\u0438\u043d\u044b \u0438 \u041f\u0430\u043a\u0438\u0441\u0442\u0430\u043d. \u0411\u044d\u043a\u0434\u043e\u0440 \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 Rust \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 OneDrive \u0438 Outlook \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 C2. \n\n\ud83d\udfe2\u041d\u043e\u0432\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f RedFlick \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 Python-\u0431\u044d\u043a\u0434\u043e\u0440 CosmicPulse \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0437\u0430\u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447 (scheduled tasks). \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0438\u0441\u044c \u043e\u0442 \u043f\u0440\u0435\u0436\u043d\u0435\u0439 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 ClickFix, \u0447\u0442\u043e\u0431\u044b \u043c\u0438\u043d\u0438\u043c\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0432\u043e\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\ud83d\udfe2\u041d\u043e\u0432\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 Mimbrob \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043e\u0431\u043e\u0440\u043e\u043d\u043d\u044b\u0435 \u0438 \u0418\u0422-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0445 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 DLL Sideloading \u043d\u0430 \u0431\u0430\u0437\u0435 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 Yandex Browser \u0438 Notepad++. \u041f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0412\u041f\u041e FBULoader \u0438 RAT-Go.  \n\n\ud83d\udd35\u0412\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 DragonForce \u0432\u0437\u044f\u043b\u0430 \u043d\u0430 \u0432\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0434\u0432\u0430 \u043d\u043e\u0432\u044b\u0445 \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0442 C2-\u0442\u0440\u0430\u0444\u0438\u043a \u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 TURN \u0438 MQTT. \n\n\ud83d\udd35\u0420\u0430\u0437\u0431\u043e\u0440 Linux-\u0412\u041f\u041e JITTERLY \u0438 \u0440\u0443\u0442\u043a\u0438\u0442\u0430 SIXZUT, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0433\u0440\u0443\u043f\u043f\u044b Red Heron, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Gitea. \u0410\u0442\u0430\u043a\u0438 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0438 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439 \u0432 \u042e\u0412\u0410 \u0438 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435, \u0446\u0435\u043b\u044c\u044e, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u044b\u043b \u0441\u0431\u043e\u0440 \u0440\u0430\u0437\u0432\u0435\u0434\u0434\u0430\u043d\u043d\u044b\u0445. \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u0445\u0438\u0442\u0438\u043b\u0438 $388 \u043c\u043b\u043d \u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0431\u0438\u0440\u0436\u0438 Bitget, \u043f\u0440\u043e\u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0432 \u0437\u0438\u0440\u043e\u0434\u0435\u0439 \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u043c \u0418\u0411-\u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0432 \u043c\u043e\u0448\u0435\u043d\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0432\u044b\u0432\u043e\u0434 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0432 \u0431\u044d\u043a\u0435\u043d\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \n\n\ud83d\udfe3\u0421\u0442\u0438\u043b\u0435\u0440\u044b, \u043f\u0440\u043e\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043d\u0430 \u043f\u043e\u0434\u043f\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u043e\u0440\u0443\u043c\u0430\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Bee Stealer \u0438 AVENGER \u0434\u043b\u044f macOS, \u0442\u0435\u043f\u0435\u0440\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 LLM \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0436\u0435\u0440\u0442\u0432 \u043f\u043e \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u0438, \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0430\u043c, \u043c\u0435\u0441\u0442\u0443 \u0440\u0430\u0431\u043e\u0442\u044b, \u0431\u0430\u043d\u043a\u0430\u043c \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0430\u043a\u0442\u0438\u0432\u0430\u043c. \n\n\ud83d\udfe3\u0410\u043d\u0430\u043b\u0438\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0432 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0433\u0434\u0435 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0443 ChatGPT \u0432\u0435\u043b\u0438 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0439 Custom GPT \u043d\u0430 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u043c \u0434\u043e\u043c\u0435\u043d\u0435 chatgpt[.]com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 ClickFix \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0412\u041f\u041e. \n\n\ud83d\udd35\u0420\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u044e\u0436\u0435\u0442 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0437\u0438\u0440\u043e\u0434\u0435\u044f \u0432 Citrix NetScaler ADC \u0438 Gateway (CVE-2026-88771 \u0438 -88772),  \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0438\u0437 \u0433\u043e\u0441\u0441\u0435\u043a\u0442\u043e\u0440\u0430, \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u043e\u0439, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u043e\u0439, \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438 \u044e\u0440\u0438\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0444\u0435\u0440 \u0432 \u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u0410\u043c\u0435\u0440\u0438\u043a\u0435 \u0438 \u0415\u0432\u0440\u043e\u043f\u0435. \u0412 \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u043b\u0438 \u0432\u0435\u0431-\u0448\u0435\u043b\u043b WHIPSHOT \u0438 \u0412\u041f\u041e \u0434\u043b\u044f \u0442\u0443\u043d\u043d\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f SLAPSHOT.\n\n\ud83d\udd35Cisco \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043f\u0430\u0442\u0447 \u0434\u043b\u044f CVE-2026-76504 (CVSS 9.8) \u2014 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Catalyst SD-WAN Manager, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0451\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \n\n\ud83d\udfe3\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 CVE-2026-73570 (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Zimbra Collaboration Suite, \u0437\u0430\u043a\u0440\u044b\u0442\u0443\u044e \u0435\u0449\u0451 \u0432 \u0438\u044e\u043b\u0435) \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0451\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u0448\u0435\u043b\u043b\u043e\u0432, \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u044d\u043a\u0441\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u043e\u0447\u0442\u044b. \n\n\ud83d\udd34TeamViewer \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 15.82. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0438\u0437 \u043d\u0438\u0445 \u2014 CVE-2026-92370 (CVSS 8.8), \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0441\u0435\u0441\u0441\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE. \n\n#APT #\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442 @\u041f2\u0422", "url": "https://t.me/kasperskyb2b/2332"}, {"timestamp": "2026-10-05T13:31:55.524Z", "date_only": false, "value": "2026-10-05T13:31:55.524954Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znvxibs2u", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5c4ff0ef-7dca-4cc4-b966-7d2152d7efd5", "content": "[3/3] Citrix ha pubblicato una deny list di IP. Nel 2026 \u00e8 la sesta NetScaler in KEV, dopo CVE-2026-88771/88772. Advisory: support.citrix.com/support-home...", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znvxibs2u"}, {"timestamp": "2026-10-05T13:31:56.431Z", "date_only": false, "value": "2026-10-05T13:31:56.431745Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rc2u", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a9e349e7-1d82-425d-9ef2-cc2521a0bc1b", "content": "[3/3] Citrix ha pubblicato una deny list di IP. Nel 2026 \u00e8 la sesta NetScaler in KEV, dopo CVE-2026-88771/88772. Advisory: support.citrix.com/support-home...", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rc2u"}, {"timestamp": "2026-10-05T13:31:58.009Z", "date_only": false, "value": "2026-10-05T13:31:58.009976Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rd2u", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "cf34f4da-c9fa-43a1-99a8-8871498c2d7a", "content": "[3/3] Citrix ha pubblicato una deny list di IP. Nel 2026 \u00e8 la sesta NetScaler in KEV, dopo CVE-2026-88771/88772. Advisory: support.citrix.com/support-home...", "url": "https://bsky.app/profile/trinacriatech.bsky.social/post/3mx4znw42rd2u"}, {"timestamp": "2026-10-05T13:48:41.072Z", "date_only": false, "value": "2026-10-05T13:48:41.072421Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mx52lvb3um2y", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c99be31b-4555-4e51-a0dd-b4ec3fd668c9", "content": "Citrix NetScaler customers report repeated reboots after installing emergency update 14.1-73.37, addressing two zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772). The reboots are linked to crafted SAML traffic crashing the nsaaad service.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mx52lvb3um2y"}, {"timestamp": "2026-10-05T15:06:10.896Z", "date_only": false, "value": "2026-10-05T15:06:10.896511Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hasamba72.bsky.social/post/3mx56whqyv72b", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6845e127-0857-4b4e-b663-26334325c0b7", "content": "Get-NetScalerTimeline parses NetScaler VMDK images into a UFS file timeline, pulls ns.log and httpaccess logs with SHA256, flags fake pitboss heartbeats tied to log poisoning (CVE-2026-88771). #DFIR #tool #NetScaler https://github.com/LETHAL-FORENSICS/Get-NetScalerTimeline", "url": "https://bsky.app/profile/hasamba72.bsky.social/post/3mx56whqyv72b"}, {"timestamp": "2026-10-05T15:23:26.587Z", "date_only": false, "value": "2026-10-05T15:23:26.587573Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mx6bftuwv22k", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "410ae385-4e67-4ee3-b127-cb1afb55dcd7", "content": "Monday's fuck up - Now and again great Citrix - Citrix NetScaler PreAuth Command Injection\nCVE-2026-88771 Improper input validation leading to RCE in a default NetScaler configuration, with no additional product features required.\ngithub.com/watchtowrlab... #redteam #critical #citrix #cve-2026-88771", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mx6bftuwv22k"}, {"timestamp": "2026-10-05T16:08:18.527Z", "date_only": false, "value": "2026-10-05T16:08:18.527406Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mx5cfk75ju23", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2b2bf5d2-ce15-4f62-af7d-7c9291858062", "content": "~Checkpoint~\nActive exploitation, ransomware, phishing, AI-enabled attacks and major breaches reported.\n-\nIOCs: CVE-2026-76504, CVE-2026-88771, CVE-2026-90970\n-\n#CVE #Ransomware #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3mx5cfk75ju23"}, {"timestamp": "2026-10-05T16:15:51.293Z", "date_only": false, "value": "2026-10-05T16:15:51.293786Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mx5ct2ofjp2u", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "a84264f3-948a-4ca9-a58a-f0bc318eadef", "content": "\ud83d\udce1 Citrix NetScaler Zero-Days (CVE-2026-88771 and CVE-2026-88772): A Skeleton Key at the Network Edge", "url": "https://bsky.app/profile/insomnisec.bsky.social/post/3mx5ct2ofjp2u"}, {"timestamp": "2026-10-06T00:00:00Z", "date_only": false, "value": "2026-10-06T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-06)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c82f4d84-389f-4ac5-a1fb-8c07f0dc667f"}, {"timestamp": "2026-10-06T01:30:28.736Z", "date_only": false, "value": "2026-10-06T01:30:28.736795Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mx6bssr2kb2a", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "98f3e2c3-58c4-4d81-ae68-d4b2be1073aa", "content": "\ud83d\udce2 Citrix NetScaler : CVE-2026-88771 \u00e0 88779 exploit\u00e9es, checker IoC open-source publi\u00e9\n\nCet outil est un script POSIX shell en lecture seule destin\u00e9 \u00e0 v\u00e9rifier l'exposition et la compromission des appliances\u2026\n\n\ud83d\udfe1 v\u00e9rification factuelle moyenne\n#CitrixNetScaler #CtxsReceiverWebshell #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mx6bssr2kb2a"}, {"timestamp": "2026-10-06T05:43:00.949Z", "date_only": false, "value": "2026-10-06T05:43:00.949259Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mx6pwf43sm2g", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5ce8c829-c736-41cc-95e5-f1551bdb3016", "content": "Vuln\u00e9rabilit\u00e9s critiques (CVSS \u2265 9) \u00b7 4\n\u2022 Citrix NetScaler (CVE-2026-88771), CVSS 9.5 \ud83d\udd34 (Semaine 40, CVE les plus\u2026)\n\u2022 GitLab AI Gateway (CVE-2026-90970), CVSS 9.9 (GitLab AI)\n\u2022 MikroTik RouterOS (CVE-2026-84411), CVSS 9.3 (MikroTik)\nhttps://www.cybowl.eu/cyber/blog_2026-10-05", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mx6pwf43sm2g"}, {"timestamp": "2026-10-06T08:04:34.728Z", "date_only": false, "value": "2026-10-06T08:04:34.728323Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mx6xths6tr2u", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3d512d8c-0a38-4b94-8b4d-c061456414fa", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88772: 57 interactions\nCVE-2026-88771: 52 interactions\nCVE-2026-104286: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88779: 12 interactions\nCVE-2026-17989: 7 interactions\nCVE-2026-19556: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mx6xths6tr2u"}, {"timestamp": "2026-10-06T13:45:12.082Z", "date_only": false, "value": "2026-10-06T13:45:12.082344Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theravenfile.bsky.social/post/3mx7kv34hsk2z", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "abb11f10-4e23-4242-89db-742560e3f274", "content": "Today, I just dropped an article which might be useful while hunting ongoing #0day #exploit of #citrix #netscalar!\n\ntheravenfile.com/2026/10/06/cit\nrix-0-day-exploits-cve-2026-88771-cve-2026-88772-in-the-wild/\n\n#ZeroDay #Malware #Slapshot #Whipshot #Python #infosec #security #OSINT #ThreatIntel #CVE", "url": "https://bsky.app/profile/theravenfile.bsky.social/post/3mx7kv34hsk2z"}, {"timestamp": "2026-10-06T14:36:03.595Z", "date_only": false, "value": "2026-10-06T14:36:03.595601Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mx7np5e5z3p2", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6f81c601-f4cb-4967-b277-eca3d92af810", "content": "# **PitScaler: tre zero-day NetScaler sfruttati in una settimana, due gi\u00e0 prima della patch**\n\n\n@informatica\nTra fine settembre e inizio ottobre 2026 Citrix corregge in emergenza tre zero-day critici su NetScaler ADC/Gateway (CVE-2026-88771, 88772, 88779), tutti sfruttati attivamente prima della [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mx7np5e5z3p2"}, {"timestamp": "2026-10-07T00:00:00Z", "date_only": false, "value": "2026-10-07T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-07)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f768e694-d94a-4339-bae5-036d64357b3f"}, {"timestamp": "2026-10-07T04:01:44.068Z", "date_only": false, "value": "2026-10-07T04:01:44.068476Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxb2q6zcv223", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ee265b72-832d-4d9d-b376-1d9c9d041001", "content": "~Asec~\nAttackers exploited perimeter devices, poisoned packages, and hijacked identity sessions for persistence and expansion.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772, CVE-2026-20079\n-\n#IdentityAttack #SupplyChain #ThreatIntel #WebShell", "url": "https://bsky.app/profile/cyfar.ca/post/3mxb2q6zcv223"}, {"timestamp": "2026-10-07T07:41:32.091Z", "date_only": false, "value": "2026-10-07T07:41:32.091743Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxbgza2ol62f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "218d1100-62bb-4924-9baf-0ae1269a1916", "content": "Top 3 CVE for last 7 days:\nCVE-2026-104286: 39 interactions\nCVE-2026-88779: 39 interactions\nCVE-2026-88771: 34 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-21589: 29 interactions\nCVE-2026-86360: 8 interactions\nCVE-2023-28252: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mxbgza2ol62f"}, {"timestamp": "2026-10-07T11:10:09.569Z", "date_only": false, "value": "2026-10-07T11:10:09.569690Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/secpoint.bsky.social/post/3mxbso7hye222", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6da3f22b-fddb-4923-9756-eb5b9d876fb6", "content": "Citrix NetScaler security alert: two actively exploited vulnerabilities\n\nCitrix has confirmed exploitation of CVE-2026-88771 and CVE-2026-88772 in unmitigated NetScaler deployments.\n\nwww.linkedin.com/products/sec...\n\n#NetScaler #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator", "url": "https://bsky.app/profile/secpoint.bsky.social/post/3mxbso7hye222"}, {"timestamp": "2026-10-07T11:24:34.253Z", "date_only": false, "value": "2026-10-07T11:24:34.253787Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mxbthxzbak24", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "dcab77ea-ddfa-4116-a00a-1faa120013a8", "content": "CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mxbthxzbak24"}, {"timestamp": "2026-10-07T13:03:52.559Z", "date_only": false, "value": "2026-10-07T13:03:52.559925Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxbyzm4j4m22", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5f96c996-b4f8-4556-8d95-86b68431c5fe", "content": "eSentire tracks four clusters behind CVE-2026-88771 exploitation, planting NetScaler web shells and backdoor accounts. Learn how to detect them.\n\n#CVE202688771 #CitrixNetScaler #WebShell #ZeroDay #Platypus #eSentire #EdgeSecurity #CyberSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mxbyzm4j4m22"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-08)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "cd7e6e11-86c2-4095-b3c2-01f2db1be59a"}, {"timestamp": "2026-10-08T07:12:37.679Z", "date_only": false, "value": "2026-10-08T07:12:37.679586Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxdvuhmobt2k", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1f660aac-0621-4b50-a912-1e591eb76a5c", "content": "Citrix NetScaler \u306e\u91cd\u5927\u8106\u5f31\u6027 CVE-2026-88771\u3001\u30ea\u30d0\u30fc\u30b9\u30b7\u30a7\u30eb\u3068\u6c38\u7d9a\u7684\u30a2\u30af\u30bb\u30b9\u306b\u60aa\u7528\n\n\u653b\u6483\u8005\u304c\u3001Citrix NetScaler ADC \u304a\u3088\u3073 NetScaler Gateway \u306b\u5b58\u5728\u3059\u308b\u8a8d\u8a3c\u524d\u306e\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027 CVE-2026-88771 \u3092\u60aa\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u30ea\u30d0\u30fc\u30b9\u30b7\u30a7\u30eb\u306e\u8a2d\u7f6e\u3001\u7279\u6a29\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u4f5c\u6210\u3001\u6c38\u7d9a\u7684\u306a\u30a2\u30af\u30bb\u30b9\u306e\u78ba\u7acb\u304c\u72d9\u3044\u3067\u3059\u3002CVE\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u3078\u306e\u30a2\u30af\u30bb\u30b9 Lev", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mxdvuhmobt2k"}, {"timestamp": "2026-10-08T08:03:13Z", "date_only": false, "value": "2026-10-08T08:03:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/15609", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b25463a8-3929-41ea-9b78-62827fd230c0", "content": "Critical Citrix NetScaler CVE-2026-88771 Exploited for Reverse Shells and Persistent Access \u2013 gbhackers.com\n\nThu, 08 Oct 2026 15:00:54", "url": "https://t.me/TengkorakCyberCrewzz/15609"}, {"timestamp": "2026-10-08T08:03:14Z", "date_only": false, "value": "2026-10-08T08:03:14.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/17424", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "d9ba9242-bf64-4910-9aa7-71e409dc9366", "content": "Critical Citrix NetScaler CVE-2026-88771 Exploited for Reverse Shells and Persistent Access \u2013 gbhackers.com\n\nThu, 08 Oct 2026 15:00:54", "url": "https://t.me/MalaysiaHacktivistz/17424"}, {"timestamp": "2026-10-08T08:03:14Z", "date_only": false, "value": "2026-10-08T08:03:14.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/26819", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c403d39d-18c6-42af-a255-7f424167d03e", "content": "Critical Citrix NetScaler CVE-2026-88771 Exploited for Reverse Shells and Persistent Access \u2013 gbhackers.com\n\nThu, 08 Oct 2026 15:00:54", "url": "https://t.me/MalaysiaHacktivistz/26819"}, {"timestamp": "2026-10-08T09:00:04Z", "date_only": false, "value": "2026-10-08T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/A1FkH_jjc5ZdmoIatY_p78h7OpS-SxVymbU2qFBc27UcyiE", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b8b46b17-4d5e-4a7c-bc3f-8bcc2eb43a01"}, {"timestamp": "2026-10-08T12:01:26.583Z", "date_only": false, "value": "2026-10-08T12:01:26.583851Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hack4career.com/post/3mxefyuwf6d2w", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "72891a30-2b14-445d-a0b3-d08ae49d8299", "content": "Our @SOCRadar Threat Research Unit identified NetScaler C2, a toolkit built to automate CVE-2026-88771 exploitation, from target discovery to command execution.\n\nInjected commands may execute up to 24 hours later.\n\nAnalysis & IOCs:\nsocradar.io/blog/netscal...", "url": "https://bsky.app/profile/hack4career.com/post/3mxefyuwf6d2w"}, {"timestamp": "2026-10-08T16:56:09.800Z", "date_only": false, "value": "2026-10-08T16:56:09.800276Z", "kind": "sighting", "label": "Seen", "source": "https://cyberplace.social/users/GossiTheDog/statuses/117406338267008666", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "71bf8bbd-84d4-4cc2-bff4-f61639cdf148", "content": "Watchtowr have a good look at pray and spray #PitScaler exploitation. This isn\u2019t the initial exploitation - their timeline should expand back to September 4th for that. \nAlso they make a good point re the latest SAML bug - by using it to DoS, it causes attacker commands in the logs to process immediately post reboot with PitScaler vuln. Not covered in blog: Attackers are actually doing this, they\u2019re preloading the logs using the username field for failed logins. \n https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/", "url": "https://cyberplace.social/users/GossiTheDog/statuses/117406338267008666"}, {"timestamp": "2026-10-09T00:00:00Z", "date_only": false, "value": "2026-10-09T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-09)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "20d4353d-98ac-44fa-af38-f04945e117f1"}, {"timestamp": "2026-10-09T01:54:39Z", "date_only": false, "value": "2026-10-09T01:54:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.at/de/warnungen/2026/10/weitere-kritische-sicherheitslucke-in-citrix-netscaler-adc-und-netscaler-gateway-updates-verfugbar", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "68ebfa2b-72ab-4323-8ce5-1599d1cadb4e", "url": "https://www.cert.at/de/warnungen/2026/10/weitere-kritische-sicherheitslucke-in-citrix-netscaler-adc-und-netscaler-gateway-updates-verfugbar"}, {"timestamp": "2026-10-09T03:25:00Z", "date_only": false, "value": "2026-10-09T03:25:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cert.se/2026/10/cert-se-veckobrev-v41.html", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5234b1dd-8514-46b3-b1a3-14638595339d", "url": "https://www.cert.se/2026/10/cert-se-veckobrev-v41.html"}, {"timestamp": "2026-10-09T08:45:36.602Z", "date_only": false, "value": "2026-10-09T08:45:36.602161Z", "kind": "sighting", "label": "Seen", "source": "https://www.cssf.lu/en/2026/09/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway/", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5f64ac98-8a4f-4b55-b050-31d9eb02231e", "url": "https://www.cssf.lu/en/2026/09/multiple-critical-vulnerabilities-in-citrix-netscaler-adc-and-netscaler-gateway/"}, {"timestamp": "2026-10-09T09:05:34.221Z", "date_only": false, "value": "2026-10-09T09:05:34.221301Z", "kind": "sighting", "label": "Seen", "source": "https://www.nextron-systems.com/2026/10/06/update-on-citrix-netscaler-cve-2026-88771-and-cve-2026-88772-expanded-thor-detection-coverage/", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "1b8b5ce1-0883-4230-bf04-4f66918ad635", "url": "https://www.nextron-systems.com/2026/10/06/update-on-citrix-netscaler-cve-2026-88771-and-cve-2026-88772-expanded-thor-detection-coverage/"}, {"timestamp": "2026-10-10T00:00:00Z", "date_only": false, "value": "2026-10-10T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-10)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ee640da9-216d-4517-8499-c174b0fce630"}, {"timestamp": "2026-10-10T19:24:31.947Z", "date_only": false, "value": "2026-10-10T19:24:31.947014Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mxk7p2dhul2u", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "3b14929e-bd18-473b-819f-61d51ab80a32", "content": "Post-Exploitation Analysis & Artifacts - Citrix NetScaler CVE-2026-88771", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mxk7p2dhul2u"}, {"timestamp": "2026-10-12T03:59:53.372Z", "date_only": false, "value": "2026-10-12T03:59:53.372524Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trinity.sh/post/3mxnmxibtax2c", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "6fbab82c-8715-4337-8483-132ff2a66e72", "content": "Two zero-days. One chain. NetScaler ADC CVE-2026-88772 (DTLS heap overflow) + CVE-2026-88771 (log injection) actively exploited since September. Mandiant found WHIPSHOT PHP shell + SLAPSHOT tunneler. Public PoC. CISA KEV. CVSS 9.5.\nhttps://trinity.sh/posts/2026-10-12-citrix-netscaler-adc-zero-days/", "url": "https://bsky.app/profile/trinity.sh/post/3mxnmxibtax2c"}, {"timestamp": "2026-10-12T14:12:39.014Z", "date_only": false, "value": "2026-10-12T14:12:39.014389Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxop762665vk", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ddd141ff-aa5e-4da6-8d03-f8740dbfd578", "content": "Incident Radar | Threat Actors Actively Exploit Critical Citrix NetScaler Vulnerabilities\n\nCISA reports confirmed global exploitation of critical zero-day vulnerabilities CVE-2026-88771 and\u2026\n\nSource: CISA Cybersecurity Advisories\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1243", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxop762665vk"}, {"timestamp": "2026-10-12T15:35:36.319Z", "date_only": false, "value": "2026-10-12T15:35:36.319576Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kimbodo.bsky.social/post/3mxottjnpjt2n", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "635a7d64-2320-4d05-8e2b-7a282ceaa44f", "content": "Internet-facing appliances and AI agents require urgent attention as new risks emerge.\n\nUnit 42 reports active exploitation of Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772), alongside Zimbra mail server vulnerabilities. These have prompted urgent patching\u2026\n\nRead more on Kimbodo:", "url": "https://bsky.app/profile/kimbodo.bsky.social/post/3mxottjnpjt2n"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": false, "value": "2026-10-13T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-13)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "0e90a080-6ac9-4b37-98cb-0d685a1bd247"}, {"timestamp": "2026-10-13T12:00:30.796Z", "date_only": false, "value": "2026-10-13T12:00:30.796466Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxqybt2hq62n", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "2ed6ac31-35bc-490f-982f-b8018a3acf54", "content": "CVE-2026-88771 lets unauthenticated attackers execute commands as root on Citrix NetScaler ADC and Gateway by injecting payloads through logged login requests. The flaw was exploited as a zero-day and added to CISA\u2019s KEV Catalog.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mxqybt2hq62n"}, {"timestamp": "2026-10-13T16:02:12.839Z", "date_only": false, "value": "2026-10-13T16:02:12.839272Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mxrfrzcjb225", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ca984c9e-afca-44c7-af3c-38775ed8b753", "content": "Kwetsbaarheden in Citrix NetScaler leiden tot wereldwijde exploitatie\n\nTwee kritieke zero-day kwetsbaarheden in Citrix NetScaler ADC en NetScaler Gateway worden momenteel wereldwijd actief misbruikt. De kwetsbaarheden, aangeduid als CVE-2026-88771 en CVE-2026-88772, stellen aanval...", "url": "https://bsky.app/profile/newsfacts.bsky.social/post/3mxrfrzcjb225"}, {"timestamp": "2026-10-13T17:16:35.477Z", "date_only": false, "value": "2026-10-13T17:16:35.477648Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/AAKL/statuses/117434731378942940", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "9d61aad4-f829-4c86-87c4-b1c23d1523df", "content": "New.\nPicus: CVE-2026-88771: Citrix NetScaler Pre-Auth Command Injection Explained https://www.picussecurity.com/resource/blog/cve-2026-88771-citrix-netscaler-pre-auth-command-injection-explained #infosec #vulnerability #Citrix #NetScaler #threatresearch", "url": "https://infosec.exchange/users/AAKL/statuses/117434731378942940"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-14)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "b6493acb-4aad-4a52-af9b-00aa9b40f66a"}, {"timestamp": "2026-10-14T04:04:53.621Z", "date_only": false, "value": "2026-10-14T04:04:53.621957Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxso6bdfhy23", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "93041386-da4a-4bbb-af50-3714add54d2d", "content": "~Recordedfuture~\n94 high-impact vulnerabilities surfaced; zero-days and active exploitation targeted NetScaler, PeopleSoft, Cisco FMC, and PaperCut.\n-\nIOCs: CVE-2026-88771, CVE-2026-88772, CVE-2026-35273\n-\n#CVE #ThreatIntel #VulnerabilityManagement", "url": "https://bsky.app/profile/cyfar.ca/post/3mxso6bdfhy23"}, {"timestamp": "2026-10-14T16:56:44.378Z", "date_only": false, "value": "2026-10-14T16:56:44.378472Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggcfs2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "acf3793d-a32b-4696-9621-aa747d9689aa", "content": "(4/5)\n\nAttacks were already underway, though Citrix had not yet issued an official statement. On Sunday, September 27, Citrix then published security bulletin CTX697096 regarding the vulnerabilities CVE-2026-88771 through CVE-2026-88778.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggcfs2f"}, {"timestamp": "2026-10-14T16:56:45.819Z", "date_only": false, "value": "2026-10-14T16:56:45.819170Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2k2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "ff33c74e-7382-4f4c-9ec7-a716b4e6359f", "content": "(4/5)\n\nAttacks were already underway, though Citrix had not yet issued an official statement. On Sunday, September 27, Citrix then published security bulletin CTX697096 regarding the vulnerabilities CVE-2026-88771 through CVE-2026-88778.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2k2f"}, {"timestamp": "2026-10-14T16:56:47.262Z", "date_only": false, "value": "2026-10-14T16:56:47.262682Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2l2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "14e9de61-e72b-49ef-a142-8d63c3203230", "content": "(4/5)\n\nAttacks were already underway, though Citrix had not yet issued an official statement. On Sunday, September 27, Citrix then published security bulletin CTX697096 regarding the vulnerabilities CVE-2026-88771 through CVE-2026-88778.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggr2l2f"}, {"timestamp": "2026-10-14T16:56:48.853Z", "date_only": false, "value": "2026-10-14T16:56:48.853437Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzt2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "709df5f5-b405-4b03-8b9f-f634a4f65375", "content": "(4/5)\n\nAttacks were already underway, though Citrix had not yet issued an official statement. On Sunday, September 27, Citrix then published security bulletin CTX697096 regarding the vulnerabilities CVE-2026-88771 through CVE-2026-88778.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzt2f"}, {"timestamp": "2026-10-14T16:56:50.312Z", "date_only": false, "value": "2026-10-14T16:56:50.312832Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzu2f", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f4f7f318-a202-40e2-aa30-a0aa812953d9", "content": "(4/5)\n\nAttacks were already underway, though Citrix had not yet issued an official statement. On Sunday, September 27, Citrix then published security bulletin CTX697096 regarding the vulnerabilities CVE-2026-88771 through CVE-2026-88778.", "url": "https://bsky.app/profile/svennemeth.snemeth.de/post/3mxtzcggrzu2f"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-10-15)", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "f23b8738-3be3-417a-a5e8-f22cffc9e1fb"}, {"timestamp": "2026-10-18T13:04:07.895Z", "date_only": false, "value": "2026-10-18T13:04:07.895618Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/samilaiho.com/post/3my5o66hj722i", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "5bf38cee-9f74-4a45-b8d1-3f1d3374ec43", "content": "CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE\nVulnerability\nwww.zscaler.com/blogs/securi...", "url": "https://bsky.app/profile/samilaiho.com/post/3my5o66hj722i"}, {"timestamp": "2026-10-19T11:34:49Z", "date_only": false, "value": "2026-10-19T11:34:49.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/3cfda13f-241d-4c9b-8abd-083f61364496", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "c8b2dd10-c641-4f86-8177-765089fe939a"}, {"timestamp": "2026-10-19T12:04:47Z", "date_only": false, "value": "2026-10-19T12:04:47.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/4d65b53a-fe95-4950-b906-9d3df9a04078", "record": "CVE-2026-88771", "field": "creation_timestamp", "uuid": "de14a9f6-5cdb-4da4-b226-4868b0b0e6f8"}, {"timestamp": "2026-10-19T16:17:30.260Z", "date_only": false, "value": "2026-10-19T16:17:30.260955Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/ap/users/117202824925377048/statuses/117468471879790287", "record": "cve-2026-88771", "field": "creation_timestamp", "uuid": "6c89d0cd-3562-4a7e-8d48-fecf9dfff128", "content": "For the DoS haters who don't want to patch their Citrix NetScalers: threat actors are chaining CVE-2026-88771 and CVE-2026-88779:\nhttps://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/\n#citrix #netscaler #threatintel #IOC #pitscaler", "url": "https://infosec.exchange/ap/users/117202824925377048/statuses/117468471879790287"}]}