The Finland intrusions are part of a global wave of attacks targeting NetScaler ADC and Gateway products via eight total flaws. Two critical remote code execution vulnerabilities, including CVE-2026-88772, have been exploited since at least Sept 3, targeting the financial, telecom, and legal sectors in North America and Europe. While CISA and Citrix have issued alerts and updates, watchTowr researchers found that hackers can use 120 crafted DTLS records to gain root access, hide PHP web shells, and deploy SLAPSHOT Python tunnelers to steal credentials.
Tuesday, October 20, 2026
Story
Finland Warns Patching Citrix NetScaler Will Not Evict Existing Attackers
Cybersecurity19 days ago
Corporate and government networks throughout Finland remain compromised even after the installation of recent security updates for Citrix NetScaler. The National Cyber Security Centre of Finland has contacted owners of hundreds of affected instances to warn that patching alone will not evict adversaries who have already established a presence in those systems. One of the specific vulnerabilities, CVE-2026-88771, enables attackers to execute commands on the targeted devices without any authentication.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.