Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Suspected state-sponsored actors mass-exploited Citrix NetScaler zero-day CVE-2026-88772 undetected for over three weeks, hitting dozens of organizations.
Mandiant reports earliest known exploitation of Citrix NetScaler zero-day CVE-2026-88772 occurred Sept. 3, with dozens of organizations in North America and Europe across government, financial services, education, telecom, legal and professional services compromised before attacks were confirmed late last week. A second zero-day, CVE-2026-88771, has been exploited since at least Sept. 24 per GreyNoise. Citrix patched both flaws plus six additional vulnerabilities Sunday; Mandiant expects broad, opportunistic exploitation of both zero-days by varied threat actors.
- CVE-2026-88772 exploited since at least Sept. 3, undetected for three-plus weeks
- Dozens of government, finance, telecom, education and legal organizations impacted
- Attributed to advanced, suspected state-sponsored threat actors
- Second zero-day CVE-2026-88771 exploited since at least Sept. 24
- Attackers used novel tunneler malware for internal reconnaissance and credential theft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88782 | Stored XSS via unsanitized link URIs in Kubio AI Page Builder | 6.8 | — |
From the original article
3 min read at cyberscoop.com
Mandiant researchers said dozens of organizations have been impacted by attacks attributed to advanced and suspected state-sponsored threat groups. They expect more attacks to come. The post Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.