Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems
Citrix disclosed four XenServer flaws that may let privileged guest users compromise or crash the host.
62
- Mentions · 7d0
- Mentions · 30d19
- All mentions40
- First seenSep 8, 2026
- Last mentioned15d ago
Timeline
40 articles · newest firstCitrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix patched four XenServer flaws, three of which could let a privileged guest compromise or crash the host.
62
12th October – Threat Intelligence Report
Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.
82
Citrix issues its weekly critical security patch for NetScaler ADC and NetScaler Gateway
Citrix patched critical NetScaler flaw CVE-2026-107406, a CVSS 9.5 memory overflow that can enable denial of service or code execution.
76
CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability
Citrix patched critical NetScaler flaw CVE-2026-107406, which can allow remote code execution or denial of service.
78
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
Citrix urges immediate patching of critical NetScaler ADC/Gateway memory-overflow flaw CVE-2026-107406 (CVSS 9.5) enabling RCE; no known exploits yet.
76
Critical Citrix NetScaler Vulnerability Allows Remote Code Execution Attacks – CVSS 9.5
Citrix disclosed CVE-2026-107406, a CVSS 9.5 NetScaler memory overflow that can allow remote code execution.
72
Hackers Exploit Critical Citrix NetScaler Flaw to Deploy Web Shells and Steal Configuration Data
Attackers are exploiting critical NetScaler flaw CVE-2026-88771 to plant web shells and steal appliance configurations.
88
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation
SOCRadar reports a large Citrix NetScaler exploitation operation around CVE-2026-88771.
78
CVE-2026-88779: Citrix NetScaler Zero-Day
Citrix patched CVE-2026-88779, a high-severity NetScaler memory overflow exploited as a zero-day.
82
5th October – Threat Intelligence Report
Check Point's weekly digest covers exploited Citrix and Cisco critical flaws, major breaches, and South African aviation ransomware.
65
CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks
CISA added actively exploited Citrix NetScaler CVE-2026-88779, a memory flaw that can deny service, to the KEV catalog.
80
CISA Warns of Citrix Vulnerability Active Exploitation in Attacks (CVE-2026-88779)
Citrix patched actively exploited NetScaler memory-overflow CVE-2026-88779, which CISA added to the KEV catalog.
76
Citrix NetScaler Targeted Via New Zero Day
Citrix NetScaler zero-day CVE-2026-88779 is under targeted attack and was added to CISA's KEV catalog.
82
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Citrix NetScaler zero-day CVE-2026-88779 is exploited in the wild against patched appliances, causing DoS with possible RCE; CISA added it to KEV.
93
Citrix NetScaler SAML Vulnerability Enables Unauthenticated Remote DoS Attacks
Citrix patched CVE-2026-88779, a CVSS 8.7 unauthenticated NetScaler SAML memory overflow enabling persistent remote DoS, reportedly exploited in targeted attacks.
78
Citrix NetScaler Appliances Reboot Repeatedly After 0-Day Security Update
Patched Citrix NetScaler appliances crash and reboot when malformed SAML requests hit the nsaaad service.
76
Citrix NetScaler Keeps Rebooting Following the 0-Day Patch
Citrix NetScaler appliances on zero-day fix 14.1-73.37 reboot after crafted SAML traffic crashes nsaaad.
76
Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response
A Dark Reading piece contrasts Kiteworks and Citrix zero-day responses, including a nine-hour shutdown and silence on reported attacks.
67
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
LevelBlue details post-exploitation of actively exploited Citrix NetScaler flaw CVE-2026-88771: superuser account creation, PHP web shells, and configuration theft.
93
AI-Found Vulnerabilities More Likely to Enable RCE, Google Says
GTIG finds 50% of likely AI-discovered vulnerabilities enable RCE versus 26% of others, as exploitation accelerates; BeyondTrust CVE-2026-1731 was exploited within four days.
58
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Mandiant links weeks-long NetScaler ADC/Gateway zero-day exploitation to suspected state actors, hitting 100+ government, finance, and legal organizations.
95
Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)
Suspected state-sponsored actors exploited NetScaler zero-day CVE-2026-88772 since early September, affecting dozens of organizations.
91
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
Mass exploitation of NetScaler CVE-2026-88772 grants attackers root access to deploy WHIPSHOT web shells and SLAPSHOT tunneler against government and financial targets.
88
Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Suspected state-sponsored actors mass-exploited Citrix NetScaler zero-day CVE-2026-88772 undetected for over three weeks, hitting dozens of organizations.
95
Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
Unknown attackers exploited critical Citrix NetScaler zero-days CVE-2026-88771/88772 since early September, deploying custom WHIPSHOT and SLAPSHOT malware for persistence and tunneling.
95
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Citrix NetScaler zero-day CVE-2026-88771 is under mass exploitation after a public proof of concept.
93
Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)
watchTowr dissects CVE-2026-88772, an in-the-wild-exploited pre-auth DTLS memory overflow in Citrix NetScaler enabling RCE, one of eight fixed flaws.
88
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
Actively exploited Citrix NetScaler zero-days CVE-2026-88772/88771 give attackers root access; Mandiant uncovers WHIPSHOT web shells and SLAPSHOT tunneler in ongoing campaign.
92
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers
Dual critical NetScaler zero-days in default configs give attackers broad access to Citrix customer networks.
88
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Citrix reports NetScaler ADC and Gateway zero-days CVE-2026-88771/88772 (CVSS 9.5) exploited in the wild, with over 50,000 exposed instances.
92
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Weekly recap led by actively exploited Citrix NetScaler ADC/Gateway flaws CVE-2026-88771 and CVE-2026-88772, plus the $387M Bitget hack and EvilTokens takedown.
82
Citrix security advisory (AV26-965)
CISA added Citrix NetScaler ADC/Gateway flaws CVE-2026-88771 and CVE-2026-88772 to the KEV catalog; Canadian Cyber Centre urges immediate patching.
78
Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)
watchTowr details CVE-2026-88771, a pre-auth command injection in Citrix NetScaler ADC/Gateway patched in bulletin CTX697096 and already exploited as a zero-day.
90
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
Citrix patched two actively exploited NetScaler zero-days (CVE-2026-88771/88772, CVSS 9.5); CISA added both to KEV amid global attacks.
94
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772
Citrix issued emergency patches for eight NetScaler flaws, including zero-days CVE-2026-88771 and CVE-2026-88772.
84
Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
Citrix confirms two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are actively exploited for remote code execution.
94
Citrix Confirms NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attack
Citrix confirms attackers are exploiting two critical unauthenticated NetScaler RCE zero-days, CVE-2026-88771 and CVE-2026-88772.
92
Citrix adds AI-powered browser activity analysis to SecurAccess
Citrix launched Session Insights for SecurAccess with Chrome Enterprise, using AI to record and analyze browser activity from users and autonomous agents.
30
2026-003: Multiple Vulnerabilities in Citrix NetScaler and Citrix ADC
Citrix NetScaler ADC and Gateway flaws enable memory information disclosure and user session mix-up; no active exploitation is observed yet.
55
Related CVEs
by mentions- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-8877278%9.5Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2026-887733%9.3HTTP request smuggling in Citrix NetScaler ADC and Gateway
- Predictable-value flaw in Citrix NetScaler ADC and Gateway
- CVE-2026-88776<1%8.8Memory overflow in Citrix NetScaler ADC and Gateway
- CVE-2026-88775<1%8.8Memory Overflow in Citrix NetScaler ADC and Gateway
- Memory overflow in Citrix NetScaler ADC and Gateway
- Feature Policy Bypass in Citrix NetScaler ADC and Gateway
- CVE-2026-1074062%9.5Memory overflow RCE/DoS in NetScaler ADC and Gateway
Appears with
- Citrixvendor · 23
- NetScaler ADCproduct · 15
- NetScaler Gatewayproduct · 15
- Mandiantorganization · 8
- CISAorganization · 8
- watchTowrorganization · 7
- NetScalerorganization · 7
- GreyNoiseorganization · 6
- Google Threat Intelligence Grouporganization · 5
- NetScalerproduct · 3
- Cloud Software Grouporganization · 3
- watchTowr Labsorganization · 3
- Google Threat Intelligenceorganization · 3
- NetScaler ADCorganization · 2
- XenServerproduct · 2
- Ciscoorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.