At The Edge Clear: September 21 – 28, 2026
Summary: GreyNoise observed exploitation attempts against Citrix NetScaler CVE-2026-88771 on 24 September, more than three days before public disclosure, with behavioral detections labeling it malicious within seconds. CISA added CVE-2026-94127, an unauthenticated code execution flaw in BIG-IP Access Policy Manager, to its KEV catalog with a three-day federal deadline, and GreyNoise recorded an average of 3,551 malicious sources per full day on the Next.js middleware bypass, a flaw outside the KEV catalog.
What's compelling: Exploitation of CVE-2026-88771 began more than three days before public disclosure, and the Next.js middleware bypass drew an average of 3,551 malicious sources per day despite never appearing in the KEV catalog - so KEV listing is not a reliable proxy for what is actually being attacked.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-88771CVE-2026-94127
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026CVE-2026-88771: Citrix Net Scaler Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Sep 27, 2026CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Sep 22, 2026