Defending Against Active Exploitation of Citrix Net Scaler ADC and Gateway Appliances
Introduction In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler Gateway appliances. We have observed evidence that organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors were likely impacted by this exploitation campaign, which has been ongoing since at least early September. According to vendor disclosures, threat actors are also act
Read the original at Google Threat Intelligence ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-88772
- Related
- Citrix Net Scaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation Cyber Risks · Sep 28, 2026CVE-2026-88772: Citrix Net Scaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability Known Exploited Vulnerabilities · Sep 27, 2026University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026