[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faQsnWnTF3ySyjdwSZ5cSBV0V4kTNRL1eEUTDvUyVays":3},{"article":4,"iocs":55,"watch_terms":69,"solutions":70,"lesson":170},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4463a00f-8eeb-46a6-b408-eac0a22e4f9e","Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks","government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks-95684a","Several security firms have confirmed seeing exploitation of the NetScaler vulnerabilities CVE-2026-88771 and CVE-2026-88772. The post Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks appeared first on SecurityWeek.","Multiple security firms, including Mandiant and GreyNoise, have confirmed active exploitation of NetScaler ADC and Gateway vulnerabilities CVE-2026-88771 and CVE-2026-88772. Attackers are using these flaws to gain root access, deploy web shells like WHIPSHOT and SLAPSHOT, and move laterally within victim networks. Exploitation has been ongoing since early September, impacting organizations across government, finance, and other sectors, with suspected involvement of state-sponsored actors.","NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 exploited for weeks by attackers.","https:\u002F\u002Fwww.securityweek.com\u002Fgovernment-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002FCitrix-vulnerability.jpeg","2026-09-30T12:48:20+00:00","2026-09-30T14:00:32.838105+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":24},"Mandiant",{"name":28,"type":24},"Google",{"name":30,"type":31},"state-sponsored threat actors","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62,66],{"type":57,"value":58,"context":59},"cve","CVE-2026-88771","NetScaler vulnerability exploited in attacks.",{"type":57,"value":61,"context":59},"CVE-2026-88772",{"type":63,"value":64,"context":65},"malware","WHIPSHOT","PHP web shell used by attackers.",{"type":63,"value":67,"context":68},"SLAPSHOT","Python-based tunneling tool used by attackers.",[23,28,26],{"controls":71,"vendors":159},[72,101,130],{"slug":73,"name":74,"problem":75,"products":76},"patch-management","Automated patch management","Known holes get closed in days, not months.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":102,"name":103,"problem":104,"products":105},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":131,"name":132,"problem":133,"products":134},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[135,143,151],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[160,165],{"slug":161,"name":23,"logo_path":162,"roles":163},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[164],"affected",{"slug":166,"name":28,"logo_path":167,"roles":168},"google","\u002Fvendor-logos\u002Fgoogle.png",[169],"reported_by",{"slug":171,"title":172,"body":173,"framework_refs":174,"framework_notes":187},"netscaler-zero-day-exploited-for-weeks-before-detection","NetScaler Zero-Day Exploited for Weeks Before Detection","Threat actors, likely state-sponsored, exploited two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway to gain root-level access and deploy persistent web shells across government and financial organizations. Because these were zero-days, no patch existed at the time of initial exploitation, making rapid detection and compensating controls the only viable defense. The weeks-long exploitation window highlights critical gaps in monitoring internet-facing infrastructure and lateral movement detection. Organizations relying on perimeter appliances as trusted network entry points without deeper inspection create high-value, high-risk attack surfaces that are increasingly targeted by advanced adversaries.",[175,176,177,178,179,180,181,182,183,184,185,186],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management","NIST SI-2 – Flaw Remediation","NIST SC-7 – Boundary Protection","NIST IR-4 – Incident Handling","NIST RA-5 – Vulnerability Monitoring and Scanning","MITRE ATT&CK T1190 – Exploit Public-Facing Application","MITRE ATT&CK T1505.003 – Web Shell","ITIL – Problem Management (zero-day risk tracking)","GDPR Article 32 – Security of Processing (for EU-regulated entities)",{}]