[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuMsEjKFtERSDNyKc-mZteQfQZm5Z5uKEK7ijEuK4ZSc":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"588b3d1a-7af7-4ce7-92bc-babf27b1d750","Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier","exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier-07ebf1","Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched. The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek.","Citrix has confirmed exploitation of a new zero-day vulnerability, CVE-2026-88779, affecting NetScaler ADC and Gateway instances. This high-severity memory overflow issue, dubbed PitScaler 2, emerged just days after patches for two other actively exploited zero-days were released. While initially reported as a Denial of Service (DoS) vulnerability, there are indications it may also allow for remote code execution, with observed attacks attempting to plant web shells and exfiltrate data.","Citrix NetScaler zero-day CVE-2026-88779 exploited in the wild shortly after patches for other flaws.","https:\u002F\u002Fwww.securityweek.com\u002Fexploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002FCitrix-vulnerability.jpeg","2026-10-05T05:14:48+00:00","2026-10-05T06:00:12.224727+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":27},"SAML","technology",{"name":29,"type":27},"web shells","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61],{"type":55,"value":56,"context":57},"cve","CVE-2026-88779","New zero-day vulnerability in Citrix NetScaler ADC and Gateway.",{"type":55,"value":59,"context":60},"CVE-2026-88771","Previously exploited zero-day in Citrix NetScaler.",{"type":55,"value":62,"context":60},"CVE-2026-88772",[23,18,21],{"controls":65,"vendors":153},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":125,"name":126,"problem":127,"products":128},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[154],{"slug":155,"name":23,"logo_path":156,"roles":157},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[158],"affected",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":175},"zero-day-strikes-citrix-netscaler-appliances-days-after-prior-patches","Zero-Day Strikes Citrix NetScaler Appliances Days After Prior Patches","The exploitation of CVE-2026-88779 (PitScaler 2) highlights the dangerous reality of cascading zero-days, where threat actors aggressively probe freshly patched systems for adjacent, undisclosed vulnerabilities. Organizations that patched promptly for the prior two zero-days still found themselves exposed within days, demonstrating that patch cadence alone is insufficient when adversaries are actively researching the same attack surface. The escalation from an apparent DoS vulnerability to potential remote code execution — with observed web shell implantation and data exfiltration — underscores how initial vulnerability severity assessments can be dangerously underestimated. This matters because internet-facing network appliances like ADCs and gateways sit at the perimeter of enterprise environments, making successful exploitation a gateway to broader network compromise.",[164,165,166,167,168,169,170,171,172,173,174],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management","NIST SI-2 – Flaw Remediation","NIST IR-4 – Incident Handling","NIST SC-7 – Boundary Protection","NIST RA-5 – Vulnerability Monitoring and Scanning","ITIL – Change Management \u002F Emergency Change Procedure","MITRE ATT&CK – T1190 Exploit Public-Facing Application","MITRE ATT&CK – T1505.003 Server Software Component: Web Shell",{}]