Attackers remained undetected for more than three weeks as they exploited a critical zero-day vulnerability affecting Citrix NetScaler appliances en masse. The earliest known instance of CVE-2026-88772 exploitation occurred Sept. 3, Mandiant researchers told CyberScoop Tuesday.
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
About this summary. This is a short, independently written summary of an article first published by CyberScoop. Cyber Security News did not report or verify the underlying story. Read the original: https://cyberscoop.com/citrix-netscaler-zero-day-attacks-three-weeks-undetected/
Source attribution: headline and facts are from CyberScoop (cyberscoop.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
The public still doesn’t know who is abusing a critical Citrix vulnerability exploited as a zero-day weeks before disclosure, but we now know that the unknown digital…
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
Introduction In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day…
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
Part 1 of this week's saga can be found here. This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution, enabling…
Citrix Patches Actively Exploited NetScaler ADC & NetScaler Gateway Vulnerabilities
Two critical zero-day vulnerabilities in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) are under active exploitation…
Citrix NetScaler ADC and Gateway Zero-day Vulnerabilities Exploited in Attacks (CVE-2026-88771 & CVE-2026-88772)
The Cybersecurity and Infrastructure Security Agency (CISA) has ordered agencies to secure their systems against two critical Citrix NetScaler vulnerabilities that have…
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
OverviewOn September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution…