Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
28 / 28 results
criticalbug_reportVulnerabilityCitrix NetScaler RCE vulnerability requires immediate patching
Citrix NetScaler (specific versions not disclosed in available data). Scope and affected product lines (ADC, Gateway, etc.) not specified in source material.
criticalbug_reportVulnerabilityCitrix NetScaler RCE flaw (CVE-2026-107406) requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Provider (IdP) or Service Provider (SP). Vulnerable versions: NetScaler ADC/Gateway 14.1 prior to 14.1-73.46, 13.1 prior to 13.1-64.29; NetScaler ADC 14.1-FIPS prior to…
criticalbug_reportVulnerabilityCitrix Netscaler ADC/Gateway HTTP smuggling flaws require immediate patch
Citrix Netscaler ADC, Netscaler Gateway, and Netscaler FIPS appliances. Specific affected versions not provided in advisory; consult Citrix security bulletin for version details.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway DoS flaw requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway (specific versions not disclosed in available data). Remote attackers can trigger denial of service conditions.
highbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88779 exploited in SAML attacks
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.41, 13.1-64.28, 14.1-FIPS 14.1-73.41, and 13.1-FIPS/13.1-NDcPP 13.1-37.282. Only deployments configured as SAML service provider (SP) or SAML identity provider (IdP) are vulnerable.
criticalbug_reportVulnerabilityCitrix NetScaler SAML zero-day CVE-2026-88779 exploited for DoS, RCE suspected
Citrix NetScaler ADC and NetScaler Gateway appliances with SAML authentication enabled (Gateway or AAA functionality). Vulnerable versions include all releases prior to 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 (NDcPP/FIPS).
criticalbug_reportVulnerabilityCitrix NetScaler zero-day exploited in Finland before patches released
Citrix NetScaler ADC and Gateway versions 13.1 and 14.1 (including FIPS and NDcPP variants) released before September 27, 2026 patches. Internet-facing instances at highest risk.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack in Finland
Citrix NetScaler ADC and NetScaler Gateway (all unpatched versions). Eight CVEs (CVE-2026-88771 through CVE-2026-88778) with CVSS 4.0 scores 7.0–9.5 (High to Critical).
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772 exploited for root access, web shells
Citrix NetScaler ADC and NetScaler Gateway appliances. CVE-2026-88772 (CVSS 9.5) is a memory overflow in DTLS protocol handling in the NetScaler Packet Processing Engine (NSPPE). CVE-2026-88771 also mentioned as exploited.
criticalbug_reportVulnerabilityCitrix NetScaler CVE-2026-88772: Pre-auth RCE via DTLS overflow exploited
Citrix NetScaler ADC and NetScaler Gateway (vulnerable versions not specified in advisory). Affects the NetScaler Packet Processing Engine (NSPPE) DTLS protocol handler. Pre-authentication attack surface.
criticalbug_reportVulnerabilityCitrix NetScaler zero-day CVE-2026-88772 exploited for web shells, root access
Citrix NetScaler ADC and Gateway appliances with DTLS enabled. CVE-2026-88772 is a memory overflow vulnerability leading to remote code execution. CVE-2026-88771 (unauthenticated RCE) also disclosed alongside it.
criticalbug_reportVulnerabilityCitrix NetScaler zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway devices. Specific vulnerable versions not disclosed in advisory. Cortex Xpanse telemetry identifies 50,277 exposed instances potentially vulnerable as of Sept. 27, 2026.
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws under active global exploitation
Citrix NetScaler ADC and Gateway appliances. CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution) and CVE-2026-88772 (remote code execution or denial-of-service).
highbug_reportVulnerabilityCitrix NetScaler ADC/Gateway under active attack via two RCE flaws
Citrix NetScaler ADC and Gateway on-premises: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279. Cloud-managed instances not affected.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days under active exploitation
Citrix NetScaler ADC and NetScaler Gateway. Specific affected versions not provided in source material. CVE identifiers not yet assigned.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway flaws exploited globally, CISA orders patching
Citrix NetScaler ADC and NetScaler Gateway all versions. CVE-2026-88771 affects all deployments; CVE-2026-88772 requires DTLS enabled (default on VPN virtual servers).
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE flaws
Citrix NetScaler ADC and NetScaler Gateway all versions prior to 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37, and 13.1-FIPS/13.1-NDcPP 13.1.37.279. CVE-2026-88771 affects all default configurations; CVE-2026-88772 requires DTLS enabled (default on V…
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway: 2 critical RCE flaws under active exploit
Citrix NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-64.23, 14.1 before 14.1-73.37, and FIPS editions. CVE-2026-88771 affects all deployments (no preconditions).
criticalbug_reportVulnerabilityCitrix NetScaler RCE zero-days CVE-2026-88771/88772 exploited in wild
Citrix NetScaler ADC and NetScaler Gateway: versions 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS editions before 14.1-73.37 FIPS and 13.1-37.279, and Secure Private Access Hybrid deployments.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway RCE zero-days exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37, 13.1-64.23, and corresponding FIPS/NDcPP releases. CVE-2026-88771 affects all deployments including default configurations.
criticalbug_reportVulnerabilityCISA flags 3 exploited flaws in Cisco FMC, Citrix NetScaler, Fortinet
CVE-2026-20079: Cisco Secure Firewall Management Center (FMC) Software (CVSS 10.0). CVE-2026-19490: Citrix NetScaler ADC and NetScaler Gateway configured as AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) (CVSS 9.3).
criticalbug_reportVulnerabilityCitrix NetScaler auth bypass CVE-2026-19490 exploited in the wild
Citrix NetScaler ADC and NetScaler Gateway appliances configured as AAA virtual servers or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Specific vulnerable versions not disclosed in advisory.
criticalbug_reportVulnerabilityCISA orders federal agencies to patch exploited Citrix NetScaler RCE by Aug 29
Citrix NetScaler ADC and NetScaler Gateway appliances with Gateway VPN or AAA virtual server configurations. CVE-2026-8452 (high severity). Over 22,000 NetScaler ADC and 1,800 Gateway instances exposed online globally.
criticalbug_reportVulnerabilityCitrix NetScaler ADC/Gateway auth bypass requires immediate patching
Citrix NetScaler ADC and NetScaler Gateway products. Specific affected versions not disclosed in available information. Authentication bypass vulnerability allows unauthorized access.
criticalbug_reportVulnerabilityCritical auth bypass in NetScaler Gateway/AAA servers (CVE-2026-19490)
Citrix NetScaler ADC and NetScaler Gateway customer-managed instances: versions 14.1 before 14.1-73.32, 13.1 before 13.1-63.21, FIPS builds before 14.1-73.32 FIPS and 13.1-37.277.
highbug_reportVulnerabilityCitrix urges immediate patching of NetScaler auth bypass and DoS flaws
Citrix NetScaler ADC and NetScaler Gateway appliances (all supported versions prior to 14.1-73.32 and 13.1-63.21). CVE-2026-19490 affects appliances configured as AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with SAML authentic…
criticalbug_reportVulnerabilityCritical auth bypass and DoS flaws in Citrix NetScaler ADC/Gateway
Citrix NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.32, 13.1 before 13.1-63.21, NetScaler ADC FIPS before 14.1-73.32 FIPS, and FIPS/NDcPP before 13.1-37.277. CVE-2026-19489 affects devices with SIP ALG enabled on LSN groups.
highperson_alertThreat ActorAnubis Ransomware Exploits Citrix Bleed 2 (CVE-2025-5777) for Access
Anubis is a threat actor group operating the Anubis ransomware. The group demonstrates sophisticated tradecraft by exploiting recent vulnerabilities in enterprise infrastructure to gain initial access.