The breached flaws are two of eight total vulnerabilities identified in NetScaler ADC and Gateway platforms. CISA warned that CVE-2026-88771 allows unauthenticated command execution and CVE-2026-88772 enables remote code execution (RCE) when DTLS is enabled. Citrix has since released security updates and indicators of compromise to resolve all eight defects and protect affected customers.
Wednesday, October 21, 2026
Story
NetScaler Attacks Began Sept 3 and Hit Global Sectors
Cybersecurity21 days ago
Organisations across multiple North American and European industries were targeted by a software vulnerability long before the security community received official alerts. Researchers at Mandiant found that exploitation of the CVE-2026-88772 flaw began on Sept. 3, nearly four weeks before Citrix officially confirmed the activity on Sept. 27. This delay left entities in the government, financial services, education, telecom, and legal sectors compromised while network defenders worked without official vendor confirmation.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.