Breaking-Alert

Published Monday, September 28, 2026 at 11:59 AM PT BLUF: Malicious actors actively exploited an unpatched zero-day vulnerability in Citrix NetScaler Gateway as of 24 September 2026. The attack was detected via behavioral analysis prior to public CVE disclosure. Organizations operating exposed NetScaler instances require immediate mitigation steps; patch availability and CVE assignment are pending. DETAILS: Attack timestamp: 24 September 2026 (pre-disclosure window). Malicious actor at IP 149.104.78.141 conducted exploitation attempt against a Citrix NetScaler Gateway instance. Detection method: GreyNoise identified the activity as fundamentally malicious via behavioral detections within seconds — CVE-specific signatures did not yet exist at time of attack. Vulnerability scope: Citrix has confirmed that two high-severity remote code execution (RCE) zero-days in NetScaler are under active exploitation. CVE assignment and technical details remain incomplete as of this alert. Attack surface: NetScaler Gateway is a perimeter-facing appliance; exploitation enables unauthenticated remote code execution on affected systems. Related threat precedent: Prior Citrix zero-day (CitrixBleed 2 / CVE-2025-5777) exploitation began before public proof-of-concept release, establishing pattern of pre-disclosure attacks against this product line. IMPACT: ...

Published Monday, September 28, 2026 at 11:58 AM PT BLUF: Citrix NetScaler devices are under active exploitation for CVE-2026-88771 and CVE-2026-88772. Unit 42 confirms both vulnerabilities are being weaponized in the wild. Organizations running NetScaler should audit for signs of compromise and apply patches immediately when available. Status of public patches is not yet confirmed from provided material. DETAILS Unit 42 Palo Alto Networks has confirmed active, in-the-wild exploitation of CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler Citrix has publicly acknowledged both vulnerabilities; disclosure status and patch availability are not specified in available material Unit 42 reports “possible 0-day activity”—indicating either pre-disclosure exploitation or rapid weaponization post-disclosure; exact timeline unclear from provided brief No technical details (CVSS score, affected versions, attack vector) are included in the provided summary Threat actor identity and specific targeting patterns are not disclosed in available material IMPACT ...

Published Monday, September 28, 2026 at 11:58 AM PT BLUF — Two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) are being actively exploited in real-world attacks. Citrix has released emergency patches. All organizations running affected NetScaler appliances must apply updates immediately; unpatched systems are under active targeting. DETAILS Vulnerabilities: CVE-2026-88771 and CVE-2026-88772 are zero-day flaws in Citrix NetScaler ADC and NetScaler Gateway. Both carry critical severity ratings. Active Exploitation Confirmed: Citrix has confirmed that attackers are exploiting both vulnerabilities in the wild against production systems. Remediation Available: Emergency security patches have been released by Citrix; specific version numbers and affected versions not detailed in available source material. Attack Surface: NetScaler ADC and Gateway are internet-facing appliances commonly used for VPN, application delivery, and network security; compromise could grant attackers direct access to corporate networks. Timeline Uncertainty: Public disclosure date and patch availability timeline are not fully specified in source material; treat as urgent regardless. IMPACT ...

Published Monday, September 28, 2026 at 05:57 AM PT Citrix NetScaler ADC and NetScaler Gateway deployments are under active, ongoing attack from two critical unauthenticated remote code execution (RCE) zero-day vulnerabilities (CVE-2026-88771, CVE-2026-88772). Patch deployment must begin today; deferred patching until Monday is confirmed too late. Citrix has released patches. CISA is amplifying the alert to federal agencies. Globally scoped exploitation. ...

Published Monday, September 28, 2026 at 05:56 AM PT BLUF: Rapid expansion of satellite communications infrastructure (18,000+ active satellites) is creating new attack surface for state-backed threat actors targeting IoT, utilities, and critical infrastructure. Telecom and OT sector already under active campaign pressure. Alert status: UNCONFIRMED EVENT — monitoring pattern. No specific recent incident confirmed; core threat is structural exposure. ...

Published Monday, September 28, 2026 at 05:55 AM PT BLUF: Senators Warner and Cruz have introduced a bipartisan bill mandating a voluntary telecom cybersecurity framework with third-party certification requirements in direct response to the Salt Typhoon campaign, which achieved widespread compromise of U.S. telecom infrastructure. The measure signals imminent regulatory tightening in telecom security posture; telecom operators and their supply chain should expect certification requirements and potential statutory obligations in coming months. ...

Published Sunday, September 27, 2026 at 05:54 PM PT BLUF: Citrix NetScaler ADC and Gateway appliances are being actively exploited for multiple critical remote code execution (RCE) vulnerabilities. CISA has designated these as Known Exploited Vulnerabilities and is directing government agencies to patch immediately. Organizations running NetScaler in any capacity must assess exposure and apply fixes without delay. ...

Published Sunday, September 27, 2026 at 11:53 AM PT BLUF: Citrix has confirmed two remote code execution (RCE) zero-days in NetScaler are actively exploited in ongoing attacks. No patches are available. Organizations running affected NetScaler instances should assume compromise and implement network segmentation immediately. DETAILS: Citrix officially confirmed two separate RCE zero-day flaws in NetScaler products are being exploited in the wild by threat actors. Both vulnerabilities remain unpatched as of publication; Citrix has not released remediation code. Attacks are confirmed active and ongoing—this is not theoretical or in-the-wild proof-of-concept stage. Multiple independent security research outlets (BleepingComputer, The Hacker News, Security Affairs) have independently corroborated the findings. The flaws permit unauthenticated or low-privilege remote code execution on vulnerable NetScaler appliances. IMPACT: ...

Published Sunday, September 27, 2026 at 11:52 AM PT BLUF: Two unpatched remote code execution zero-day vulnerabilities in Citrix NetScaler are actively exploited in the wild with no patches available. Any organization operating NetScaler appliances is at immediate risk. Inventory deployments now and implement network isolation where possible pending patch release. DETAILS Two high-severity RCE vulnerabilities confirmed by Citrix — both capable of remote code execution; CVE identifiers not yet specified in available reporting. Active exploitation confirmed — multiple independent security sources (BleepingComputer, SecurityAffairs, The Hacker News, Tenable) report ongoing attacks in the wild; no patch release date announced as of this alert. No mitigation patches available — Citrix has not released fixes; timeline for patches is unconfirmed. CISA directive to government agencies — Cybersecurity and Infrastructure Security Agency has urged federal agencies to immediately patch/defend; implies critical infrastructure targeting. Initial attack surface unknown but broad — reporting does not specify whether exploitation requires authenticated access or is unauthenticated; scope of affected NetScaler versions not detailed in available summaries. IMPACT ...

Published Sunday, September 27, 2026 at 11:51 AM PT BLUF: Citrix has confirmed two zero-day remote code execution (RCE) vulnerabilities in NetScaler are actively being exploited in the wild. These flaws permit unauthenticated attackers to execute arbitrary code on affected gateways. Organizations running NetScaler should immediately assess exposure and coordinate emergency patching. CISA is urging government agencies to prioritize remediation. DETAILS: ...