> TritonInfoSec News
Home / Oct 01, 2026 / Story
0
#2 CyberScoop general September 29, 2026 at 21:30 UTC

Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected

By Matt Kapko

AI Summary

Mandiant researchers confirmed that dozens of organizations were compromised via a Citrix NetScaler zero-day (CVE-2026-88771/CVE-2026-88772) for at least three weeks before detection, with attacks attributed to advanced and suspected state-sponsored threat groups. Attackers deployed web shells mapped to CSS-like URLs and created superuser accounts for persistent access. Mandiant expects additional exploitation waves as technical details are now public.

Read full article → https://cyberscoop.com/citrix-netscaler-zero-day-a…

Relevance score: 91.0/100

# More from October 01

  1. 1
    Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution The Hacker News
  2. 3
    Cisco warns of new SD-WAN zero-day exploited in attacks BleepingComputer
  3. 4
    Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets The Hacker News
  4. 5
    Bitget hacked via zero-day in third-party security products BleepingComputer
  5. 6
    New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses The Hacker News
  6. 7
    Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT The Hacker News
  7. 8
    Alleged ShinyHunters leader arrested in the Netherlands CyberScoop
  8. 9
    Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks SecurityWeek
  9. 10
    Over 543,000 valid credentials exposed in public GitHub repositories BleepingComputer