🛡️ **BREAKING: Unpatched Citrix NetScaler Zero-Day Actively Exploited — Pre-Disclosure Attack Detected**
Published Monday, September 28, 2026 at 11:59 AM PT BLUF: Malicious actors actively exploited an unpatched zero-day vulnerability in Citrix NetScaler Gateway as of 24 September 2026. The attack was detected via behavioral analysis prior to public CVE disclosure. Organizations operating exposed NetScaler instances require immediate mitigation steps; patch availability and CVE assignment are pending. DETAILS: Attack timestamp: 24 September 2026 (pre-disclosure window). Malicious actor at IP 149.104.78.141 conducted exploitation attempt against a Citrix NetScaler Gateway instance. Detection method: GreyNoise identified the activity as fundamentally malicious via behavioral detections within seconds — CVE-specific signatures did not yet exist at time of attack. Vulnerability scope: Citrix has confirmed that two high-severity remote code execution (RCE) zero-days in NetScaler are under active exploitation. CVE assignment and technical details remain incomplete as of this alert. Attack surface: NetScaler Gateway is a perimeter-facing appliance; exploitation enables unauthenticated remote code execution on affected systems. Related threat precedent: Prior Citrix zero-day (CitrixBleed 2 / CVE-2025-5777) exploitation began before public proof-of-concept release, establishing pattern of pre-disclosure attacks against this product line. IMPACT: ...