The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.
The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek.
Tracked as CVE-2026-107441, the out-of-bounds write flaw could allow attackers to execute OS commands via crafted HTTP requests.
The post Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day appeared first on SecurityWeek.
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
The post Drupal Commerce Core Vulnerability Exploited Against Online Stores appeared first on SecurityWeek.
Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.
The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared first on SecurityWeek.
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
The post Attackers Exploit Third Arista VCO Zero-Day in Four Months appeared first on SecurityWeek.
Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.
The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.
Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August.
Mandiant researchers said a likely Chinese government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect — CVE-2026-102764 — then showcased multiple tactics to escalate privileges, hop around the compromised network and evade detection.
The same threat group has repeatedly exploited a series of defects in Ivanti products since 2023, a Citrix NetScaler zero-day widely known as CitrixBleed, and last year’s Brickstorm campaign that had an average dwell time of 400 days — all resulting in sweeping attack sprees.
“We are aware of only a small number of impacted organizations at this time, but given the stealth of the activity, and the use of a zero-day, it is possible that additional organizations were also compromised prior to the disclosure,” Kelli Vanderlee, senior analyst at Google Threat Intelligence Group, said in an email.
Mandiant warned organizations to “prepare for potential widespread exploitation,” adding that Armory Castle and other threat groups previously conducted broad, opportunistic exploitation following public vulnerability disclosures.
Mandiant and GTIG released their analysis of Armory Castle and its latest campaign as BeyondTrust publicly disclosed the vulnerability in its Remote Support product Thursday. The company’s security said it released a patch for the exploited defect for self-hosted customers Oct. 8 and automatically applied the update to cloud-based versions of the product that same day.
BeyondTrust, which conducted its own investigation and coordinated with Mandiant on an investigation involving a self-hosted customer that was compromised, noted Armory Castle’s prowess.
“This threat actor rotates its infrastructure and tooling for every victim, so attribution here rests on behavior. The indicators from one intrusion rarely survive to the next,” the company’s security team wrote in a blog post. “The threat actor has historically demonstrated a high degree of operational security awareness, professional practices, and tradecraft.”
A BeyondTrust spokesperson declined to answer questions about how many customers are already compromised or why it didn’t publicly disclose the actively exploited zero-day sooner, and instead referred back to its security advisory.
The company said the first known instance of zero-day exploitation occurred Aug. 29, which it detected and contained Sept. 28.
BeyondTrust also said it detected the malicious activity after zero-days were confirmed to be exploited in another security vendor’s product Sept. 27. That timing matches a round of zero-days Citrix NetScaler disclosed, following nearly two days of rampant worry and unconfirmed rumors.
BeyondTrust did not say if there is any link or overlap between the attacks targeting Citrix NetScaler, which went undetected for more than three weeks, and its remote access product.
GTIG researchers said there isn’t enough evidence to assess an overall targeting trend, but encouraged all potentially vulnerable organizations to apply the patch and hunt for pre-disclosure activity.
The threat group’s previous targets include business-process outsourcers, government, legal services, technology companies and software-as-a-service providers.
“Armory Castle remains one of the most prominent China-nexus threat actors due to its persistent targeting of various edge device technologies, use of zero-day vulnerabilities for widespread exploitation across multiple industries and regions, and its continuously expanding and evolving arsenal of tools,” said Dan Perez, technical lead at GTIG.
“This is a well-established pattern for Armory Castle,” Vanderlee said. “Targeting edge devices, which typically do not support endpoint detection and response (EDR), allows the threat actor to minimize opportunities for detection and maintain stealthy, persistent access to targeted networks.”
The post Prolific Chinese espionage group exploits BeyondTrust zero-day appeared first on CyberScoop.
The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.
The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek.
Microsoft’s streak of record-breaking vulnerability disclosures continued with a mega Patch Tuesday, containing 1,413 defects affecting the company’s various enterprise products and services.
The monthly batch of patches surpassed the company’s previous annual record of 1,261 common vulnerabilities and exposures (CVEs) set in 2020.
“Hundreds of CVEs in a single release used to be the exception — now it’s the baseline,” Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative, wrote in an email. AI is partly to blame, he added, but it “isn’t creating these bugs out of thin air; it’s just shortening the time between a vulnerability existing and someone noticing it.”
Yet, for defenders understandably overwhelmed by the surge of defects found in Microsoft products, actively exploited zero-day vulnerabilities aren’t growing in kind.
“If there’s solace to be had, it’s in the fact that only one of these bugs is under active attack,” Childs wrote in a blog post. “If you go back to the hot 0-day summer of 2023, there were 17 Microsoft 0-days between January and October as opposed to 15 this year during the same period.”
Microsoft disclosed one actively exploited zero-day affecting Windows Shell — CVE-2026-96951 — that allows unauthorized attackers to bypass a security feature. The high-severity defect is the third Windows Shell vulnerability exploited this year, according to Satnam Narang, senior staff research engineer at Tenable.
“There have been 26 Windows Shell vulnerabilities patched in 2026 through October, a staggering figure compared to previous years, with only 3 Windows Shell CVEs in 2025 and just one in 2024 and 2022,” he added.
The vast majority of defects Microsoft disclosed in this month’s security update affect Windows, its ubiquitous operating system , spanning 1,102 vulnerabilities combined. The update also included 134 vulnerabilities in Office, 61 in various developer tools and 36 in SharePoint Server.
Microsoft tried to address the toll this monthly flood of vulnerabilities has on its customers by introducing “risk cohorts.” These groups of vulnerabilities don’t necessarily share a root cause or severity rating, but generally require a similar customer assessment that could guide prioritization efforts, the company said.
“The volume isn’t the real story anymore,” Childs added. “What matters is that discovery is scaling faster than exploitation, so teams that triage by sheer CVE count instead of exploitability are burning cycles on the wrong bugs. Patch what’s proven, prioritized, and public, and treat everything else as this month’s new normal.”
The full list of vulnerabilities addressed this month is available in Microsoft’s Security Response Center.
The post Microsoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities appeared first on CyberScoop.
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges.
The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN appeared first on SecurityWeek.
Ivanti customers are in familiar territory, responding to yet another actively exploited zero-day affecting one of the vendor’s most commonly targeted security products.
Volexity researchers, which discovered in-the-wild exploitation earlier this month, said attackers actually exploited three zero-days in a chain that allowed them to bypass authentication, execute code remotely and escalate privileges.
Ivanti disclosed and issued a patch for the authentication bypass and remote-code execution components of the exploit chain as a single vulnerability in Ivanti Connect Secure. The company said it initially discovered a portion of the high-severity vulnerability — CVE-2026-104935 — during internal security checks in June.
A threat actor, which Volexity tracks as UTA0576, exploited the defects before Ivanti addressed them and issued a patch.
“Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle,” an Ivanti spokesperson wrote in response to questions.
“Successful exploitation requires chaining multiple vulnerabilities and Ivanti has fully addressed the unauthenticated remote code execution component of that chain, eliminating the primary exploitation path,” the spokesperson added. “We are also developing additional updates to address the remaining vulnerability and further strengthen product security.”
The full scope of compromise remains under investigation. The company, in a security advisory, said a “limited number of customers” were already compromised prior to disclosure.
The Cybersecurity and Infrastructure Security Agency added the defect to its known exploited vulnerabilities catalog Tuesday.
Sean Koessel, vice president of professional services at Volexity, said the earliest confirmed instance of exploitation occurred Oct. 1. Yet, “it wouldn’t surprise us if there was activity toward the end of September,” he added.
Volexity researchers observed a series of post-exploitation activities during an investigation involving a customer’s compromised Ivanti Connect Secure VPN appliance earlier this month. “UTA0576 repeatedly exploited these vulnerabilities to compromise the ICS VPN appliance and run commands on it,” the company wrote in a blog post.
The threat actor extracted credentials stored on the device, dumped and stole Active Directory metadata, and deployed multiple custom and malicious tools capable of facilitating follow-on attacks, credential testing and hunting for administrator passwords, recovery keys and other passwords.
“Based on Volexity’s observations, UTA0576 primarily focused on credential theft, data exfiltration, log tampering, and network reconnaissance,” the company added.
Ivanti encouraged potentially vulnerable customers to act immediately by upgrading to the latest version of software, running the company’s Integrity Checker Tool regularly, and reviewing indicators of compromise published by Volexity.
CISA also urged Ivanti customers to patch the vulnerability quickly, as it dissuaded customers from relying on the company’s Integrity Checker Tool.
“Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation,” the agency said in an alert Tuesday. “Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.”
Ivanti products, including Ivanti Connect Secure, are a frequent target for attackers of various motivations in the network edge space.
CISA has flagged 36 Ivanti defects on its known exploited vulnerabilities catalog since late 2021. At least 6 defects across Ivanti products have been exploited since late January.
“Edge devices are a valuable initial foothold and often enable attackers to pivot further into targeted networks,” Koessel said. “It would be fair to expect widespread exploitation, this is a common theme with most vulnerabilities in edge devices.”
Other researchers also expect exploitation to pick up rapidly.
“Given the history of attacker attention and focus Ivanti Connect Secure has previously drawn — and the trivial nature of the authentication bypass — widespread, indiscriminate exploitation is inevitable as attackers begin reviewing patches and public information,” said Yordan Ganchev, principal threat intelligence specialist at watchTowr.
“The race condition required for code execution offers little resistance, as an unauthenticated attacker can repeatedly attempt exploitation until it succeeds,” he added.
The post Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day appeared first on CyberScoop.
Citrix customers just got through back-to-back weekends filled with varying levels of uncertainty and worry, as yet another actively exploited zero-day vulnerability was discovered in Citrix NetScaler products.
Researchers and security experts said the vulnerability — CVE-2026-88779 — is less concerning because exploitation triggers denial of service and only impacts instances that have SAML (security assertion markup language) enabled.
“This means it doesn’t work out of the box against every NetScaler deployment,” Jake Knott, head of threat intelligence at watchTowr, told CyberScoop. “While this is very inconvenient, it doesn’t have organizations scrambling to trigger incident response.”
Citrix was much quicker and consistent in alerting customers to the emerging threat Friday, and followed up the next day with a more detailed blog post and security advisory that contained a patch for the high-severity defect.
“After we were alerted to this issue we immediately developed and published a mitigation while concurrently developing, testing and deploying a fix,” a company spokesperson said in a statement. “The fix for this issue is available, and we urge all customers to quickly apply it to their NetScaler instance.”
The Cybersecurity and Infrastructure Security Agency added the defect to its known exploited vulnerabilities catalog Sunday.
The vendor’s response also provided some relief for customers and researchers who spent much of the previous weekend rushing to assess widespread rumors of other defects in the assailed network edge gateways. In that case, Citrix took most of the weekend to confirm attackers were actively exploiting a pair of NetScaler zero-days, some of which researchers said remained undetected for at least three weeks.
“Citrix did a better job with their response to this vulnerability,” and took steps that enabled customers to make their own risk-based decisions with more currently available information, said Joe Toomey, vice president of underwriting security at insurance provider Coalition.
“Although it’s difficult to celebrate given this is the third publicly-exploited NetScaler zero-day vulnerability in a two-week window, it is a step in the right direction,” he added.
Citrix declined to say how many customers are impacted by the latest zero-day or when the first instance of exploitation occurred. Yet, Knott at watchTowr said exploitation likely began Friday.
The newer defect doesn’t share any technical links with the pair of zero-days Citrix disclosed less than a week prior, but it can accelerate one of those vulnerabilities — CVE-2026-88771 — by intentionally crashing machines to speed up exploitation, Knott said.
While risk is currently perceived low for CVE-2026-88779, it is “incredibly simple to trigger, with a single specially crafted request being all that is needed to knock an appliance offline,” Knott added. “Exploitation is already occurring in the wild, and disrupting an authentication gateway can prevent legitimate users from accessing the services behind it.”
Toomey also described the denial-of-service vulnerability as less serious than the previous week’s actively exploited zero-days. Yet, he noted, exploitation attempts of CVE-2026-88779 “clearly contain shellcode that implies that the threat actor believes they can use this vulnerability, or chain it with another vulnerability, in order to achieve remote-code execution.”
The post Citrix discloses third actively exploited NetScaler zero-day in less than a week appeared first on CyberScoop.
Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched.
The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek.
CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system.
The post Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action appeared first on SecurityWeek.
Attackers remained undetected for more than three weeks as they exploited a critical zero-day vulnerability affecting Citrix NetScaler appliances en masse.
The earliest known instance of CVE-2026-88772 exploitation occurred Sept. 3, Mandiant researchers told CyberScoop Tuesday.
The besieged security vendor and researchers didn’t confirm the attacks until late last week. By then, Mandiant says, organizations in North America and Europe spanning the government, financial services, education, telecom, legal and professional services sectors were already likely compromised.
“We are aware of dozens of impacted organizations,” Charles Carmakal, chief technology officer at Mandiant Consulting, wrote in a LinkedIn post. He attributed the attacks to “advanced and suspected state-sponsored threat actors.”
The three-week gap — at minimum — between initial exploitation and confirmed in-the-wild attacks gave attackers a significant advantage.
Mandiant warned that the gap could be even wider. “We are still responding to active intrusions, and new evidence may change our understanding of the campaign timeline,” researchers who published a threat intelligence report on the attacks Tuesday told CyberScoop in an email.
The incident response firm’s analysis on the latest zero-day attack spree targeting Citrix customers underscores the multi-layered mess network defenders have been responding to since Saturday.
The zero-day exploits in Mandiant’s report only cover half of the problem. Attackers have also exploited a second Citrix NetScaler zero-day — CVE-2026-88771 — since at least Sept. 24, according to GreyNoise, but researchers said that campaign likely started earlier as well.
It’s unclear to what extent the pair of zero-days are linked. But, nearly two days after the first unconfirmed rumors of the attacks surfaced, Citrix disclosed both of the actively exploited defects in a security advisory Sunday, releasing patches for them and six additional vulnerabilities.
Mandiant researchers uncovered multiple novel tools and tactics attackers used to exploit CVE-2026-88772, gain privileged access to compromised environments, hop around the network and steal sensitive data. A threat actor in one observed intrusion routed traffic through novel tunneler malware to “manually conduct internal reconnaissance and credential theft,” researchers wrote.
Researchers at watchTowr also published technical analysis of CVE-2026-88782 Tuesday.
The attacks from multiple fronts, involving two zero-days, reflect an alarming and sustained pattern of malicious activity targeting so-called edge devices, such as virtual private network gateways and firewalls.
Vulnerabilities in these devices accounted for 48% of the enterprise-related zero-days last year, according to Google Threat Intelligence Group.
“Our previous research corroborates that both cyber espionage and financially motivated threat actors prioritize exploiting vulnerabilities in edge devices and security appliances,” Mandiant researchers wrote in response to questions on their report.
“Because most edge devices do not support endpoint detection and response (EDR) monitoring, targeting them, particularly through exploiting zero-day vulnerabilities, provides threat actors with an infection vector that is difficult to detect and prevent, and the opportunity to scale a campaign as long as the exploit remains undiscovered,” the researchers added.
Carmakal, in his LinkedIn post, warned that Mandiant expects “broad and opportunistic exploitation” of both of the Citrix NetScaler zero-days by a variety of threat actors in the near term.
The post Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected appeared first on CyberScoop.
On September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution (RCE) vulnerabilities: CVE-2026-88771 and CVE-2026-88772. Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9.5, and both have been confirmed as being actively exploited in the wild as zero-days prior to the vendor disclosure.
CVE-2026-88771 affects vulnerable NetScaler deployments in their default configuration, with no additional product features required. The vendor has also indicated that the attack complexity for exploiting CVE-2026-88771 is low, meaning reliable RCE is likely against all vulnerable NetScaler appliances regardless of their configuration. This is especially concerning due to the prevalence of NetScaler appliances.
CVE-2026-88772 is a memory corruption vulnerability and requires the DTLS feature to be enabled on the appliance. The vendor has indicated that the attack complexity is high, meaning achieving reliable exploitation may be more difficult for an attacker than that of CVE-2026-88771.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reports active exploitation is occurring globally, and added both CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026. Multiple CERTs worldwide have begun issuing alerts due to the critical nature of this situation.
On October 4, 2026, Citrix published an advisory for a new NetScaler vulnerability, CVE-2026-88779. This new vulnerability was disclosed as being exploited in-the-wild as a zero-day prior to disclosure, and was added to CISA KEV the same day. CVE-2026-88779 affects NetScaler appliances that have a SAML service provider (SP) or identity provider (IdP) configured. Attackers can send repeated attempts, where each attempt will crash the SAML service, and upon the sixth crash the appliance will reboot.
The following table summarizes all nine vulnerabilities:
CVE | CVSSv4 | Vulnerability | Exploitation confirmed |
|---|---|---|---|
Improper input validation leading to RCE in a default configuration (CWE-20) | Yes (CISA) | ||
Memory overflow leading to RCE in a DTLS configuration (CWE-119) | Yes (CISA) | ||
HTTP request smuggling (CWE-444) | No | ||
Policy bypass involving URL expressions (CWE-16) | No | ||
Memory overflow in Gateway or AAA configuration (CWE-119) | No | ||
Memory overflow in load balancer of type Oracle configuration (CWE-119) | No | ||
Memory overflow in a LB/CS or CGNAT-LSN/NAT64 configuration (CWE-119) | No | ||
Predictable TCP initial sequence numbers (CWE-342) | No | ||
Memory overflow in SAML processing (CWE-119) | Yes (CISA) |
The following vendor-supplied updates are available to remediate the eight vulnerabilities disclosed on September 27. Rapid7 strongly recommends updating affected NetScaler appliances on an emergency basis, outside of normal patching cycles, and investigating vulnerable appliances for signs of compromise.
Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later releases.
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1.
Citrix NetScaler ADC 14.1-FIPS, 14.1-73.37 FIPS and later releases of 14.1-FIPS.
Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP.
For the latest mitigation guidance, please refer to the vendor advisory.
To remediate CVE-2026-88779 which was disclosed on October 4, the following vendor-supplied update is available, and supersedes the above vendor supplied updates.
Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1-73.41 and later releases.
Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1-64.28 and later releases of 13.1.
Citrix NetScaler ADC 14.1-FIPS, 14.1-73.41 FIPS and later releases of 14.1-FIPS.
Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.282 and later releases of 13.1-FIPS and 13.1-NDcPP.
For the latest mitigation guidance for CVE-2026-88779, please refer to the vendor advisory.
Rapid7 observed the earliest exploitation attempts of CVE-2026-88771 at 2026-09-20T14:28:43 UTC. Only two attempts were seen on September 20, which does not indicate widespread exploitation at that time.
The command injection observed on September 20 is captured below:
LoginTimestamp: 2026-09-20T14:28:43.000Z
Account: wfr
Result: FAILED_BAD_LOGIN
Source_ip: 149.104.78.208
Source_data: "Authentication is rejected for WFR pitboss PPE nsppe missed too many heartbeats NSPPE;tar${IFS}czf$IFS/var/netscaler/gui/vpn/c$IFS-C$IFS/flash${IFS}nsconfig; (client ip : 149.104.78.208 , vserver ip: <redacted> ), extended error, if any : "This payload executes tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig, which creates a gzipped archive named c in /var/netscaler/gui/vpn/ containing the full contents of /flash/nsconfig.
This location is significant because the Gateway serves /var/netscaler/gui/vpn/ publicly at https://<gateway>/vpn/. Once the command runs, an unauthenticated request to GET https://<gateway>/vpn/c will return the archive to any requester, with no login required.
The /flash/nsconfig directory contains material that would give an attacker significant follow-on access, including:
ns.conf, the full device configuration, including encrypted passwords for the nsroot account and other admin accounts, as well as bind passwords for LDAP, RADIUS, and TACACS
ssl/, containing SSL certificates and private keys
SSH host keys, license files, and HA sync settings
As of this writing, Rapid7 has identified two organizations compromised through exploitation of CVE-2026-88771. The first compromise involved the command injection detailed above and the other involved a webshell placed at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver (SHA256: ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1), observed on September 24.
Exposure Command, InsightVM, and Nexpose customers can assess exposure to all the CVEs listed in the blog with authenticated vulnerability checks available in the September 28 content release. A vulnerability check for CVE-2026-88779 is available in the October 6 content release.
Customers leveraging Rapid7’s Intelligence Hub can track the latest developments surrounding CVE-2026-88771 and CVE-2026-88772, including indicators of compromise (IOCs) and Suricata detection rules.
The following detection rules are available for InsightIDR and Managed Detection Response (MDR) customers:
Suspicious Web Request - Citrix NetScaler ADC and Gateway Appliance Exploitation (CVE-2026-88771)
September 28, 2026: Initial publication.
September 29, 2026: Suricata detection rules for CVE-2026-88771 are now available in Intelligence Hub.
September 30, 2026: Added Rapid7 MDR Observed Exploitation section to include details of the cases flagged by the SOC team.
September 30, 2026: Added Rapid7 MDR customers section.
Citrix took most of the weekend to confirm that attackers were actively exploiting the newest round of NetScaler zero-days, leaving network defenders and threat hunters to react without official confirmation.
Yet, behind the scenes, multiple CERTs, advisory firms, insurance providers, researchers and chatty security professionals warned their respective peers and communities of a live and serious threat.
Nearly two days after the first unconfirmed rumors, Citrix published a security advisory Sunday disclosing the exploited zero-days, CVE-2026-88771 and CVE-2026-88772, releasing patches for them and six additional defects.
By then, criticism was at a fever pitch, and for some NetScaler customers the warning came too late.
“The information vacuum was most striking. Customers were receiving warnings through unofficial channels while Citrix remained publicly silent,” Ben Harris, founder and CEO at watchTowr, told CyberScoop.
“Customers were left without communication, guidance, or even acknowledgement that the vulnerability that was rumored to exist was real. Citrix could have warned customers that active exploitation was occurring and provided immediate defensive guidance without disclosing technical details that would help attackers,” he added.
“When active exploitation is underway, hours matter,” Harris said.
Citrix did not directly answer questions about the lengthy communication delay.
“We recently identified critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway that led us to immediately develop and release a new version of the software that addresses the issues,” the company said in a prepared statement.
The critical defects are both rated 9.5 on the CVSS scale and allow attackers to achieve remote code execution.
Researchers are particularly concerned about CVE-2026-88771, a command-injection vulnerability that affects all NetScaler appliances in a default configuration. That gives attackers a broad pool of targets and a better chance at successful exploitation. A proof-of-concept exploit for the vulnerability is also publicly available.
Palo Alto Networks said it identified more than 50,000 publicly exposed instances of Citrix NetScaler devices potentially vulnerable to both of the zero-days as of Sunday.
The earliest known exploitation attempt occurred Sept. 24 when GreyNoise said it observed an unsuccessful exploitation attempt against a Citrix NetScaler Gateway under its control for malicious activity scanning purposes. But researchers warn that exploitation likely started before then.
Citrix did not say how many customers have been compromised thus far and researchers are still assessing the fallout.
Citrix said it is making generic indicators of compromise available to customers in their user consoles, and the company referred to previously issued guidance for customers who suspect compromise.
Attribution for the attacks is also still under investigation, yet NetScaler products are a common, recurring target for financially-motivated cybercriminals and state-sponsored espionage groups.
The Cybersecurity and Infrastructure Security Agency issued an alert Sunday after Citrix publicly confirmed the attacks on its customers, and added CVE-2026-88771 and CVE-2026-88772 to its known exploited vulnerabilities catalog. The vendor has appeared on the agency’s list of vulnerabilities known to be exploited five times this year, and a total of 26 times since late 2021.
Security leaders across the industry — including Charles Carmakal, chief technology officer at Mandiant Consulting, and Wendi Whitmore, chief security intelligence officer at Palo Alto Networks — also sprung into action Sunday, with direct warnings on LinkedIn about the urgent threat.
The information vacuum that persisted through most of the weekend put cybersecurity professionals in sometimes unique positions. Joe Toomey, vice president of underwriting security at insurance provider Coalition, said the company notified potentially vulnerable customers with limited official data and no confirmation from CISA or Citrix.
In a LinkedIn post Sunday, he called Citrix “unconscionably irresponsible” for remaining silent for more than 36 hours after word began circulating about in-the-wild exploitation.
“I fully understand a vendor embargoing specific details about a vulnerability when a patch has not yet been published, but once the vuln is exploited in the wild, some of those rules no longer apply,” Toomey wrote.
Citrix and its customers are in familiar territory. The vendor’s products have been widely targeted in previous attack sprees, often involving zero-day exploits and some infamously referred to as CitrixBleed and CitrixBleed 2.
“Citrix has a history of delaying the publication of vulnerabilities, even when they’re being exploited in the wild and affecting customers. Citrix eventually released patches and an advisory, but an adequate response also requires timely, clear communication,” Harris said.
“Customers shouldn’t have to rely on unofficial warnings, security researchers, and third parties to learn that critical infrastructure may already be compromised,” he added. “This latest incident raises serious questions about whether Citrix has learned from previous crises and meaningfully improved how it protects and informs customers.”
The post Citrix patches actively exploited NetScaler zero-days after a weekend of unofficial warnings appeared first on CyberScoop.
Volexity researchers spotted another state-aligned Chinese threat group exploiting a triple-link chain of zero-day vulnerabilities across multiple campaigns, the company said in a blog post Monday.
The threat group it tracks as UTA0565 exploited the vulnerabilities in Chrome and Microsoft between Sept. 3 and 4 before the defects were disclosed or patched, researchers said.
The timing of the malicious activity mirrors other spikes threat hunters observed and attributed to multiple Chinese espionage threat groups. Yet, Volexity noted UTA0565’s campaigns differed from those attacks by using multiple fake websites to deceive victims.
Volexity shared phishing emails UTA0565 sent to Asian government entities urging them to publicly support imprisoned Hong Kong activist Chow Hang-tung. The group spoofed domains impersonating the Center for American Progress and China Digital Times in other phishing emails.
While UTA0565 showcased a variance in tactics, it used the same components researchers observed in previous instances of the exploit kit across multiple Chinese threat groups.
“This seemingly widespread adoption across multiple threat actors suggests a coordinated effort within the Chinese computer network exploitation community, where the core kit was likely shared, customized, and weaponized by multiple groups,” Volexity wrote in the blog post. “The activity reported so far reflects only two organizations’ observations; the full scope and impact are likely far broader.”
The vulnerabilities include: CVE-2026-85046 and CVE-2026-87491, remote-code execution defects in the JavaScript engine for Chromium-based browsers; and CVE-2026-85880, a privilege-escalation zero-day that Microsoft disclosed Sept. 8 in Windows Advanced Local Procedure Call.
Proofpoint, which previously observed multiple state-aligned threat groups chaining the vulnerabilities together in attacks since last August, said a limited group of organizations were exposed to all three vulnerabilities in a short window.
Proofpoint previously attributed attacks involving the zero-days to APT31, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket. At the time it warned that attackers of other origins and motivations could strike soon as well.
Volexity said UTA0565 used a payload from a previously undocumented malware family it tracks as “CLEANGULP.” Researchers also found several domains likely used by UTA0565 in similar campaigns targeting media organizations, halal restaurant search websites and corporate training organizations.
“UTA0565’s use of the zero-day vulnerabilities shows technical and operational improvements over other campaigns observed by Volexity, both in the mechanics of the exploitation and the presentation to end users,” researchers wrote. “Using real content from legitimate websites as decoy material continues to be an effective way to reduce user suspicion.”
The post Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects appeared first on CyberScoop.
Cisco disclosed its second actively exploited zero-day vulnerability in as many days, presenting its customers with back-to-back threats to address in unrelated products.
The latest zero-day — CVE-2026-76460 — has a maximum-severity rating and was exploited before Cisco disclosed and patched the vulnerability Wednesday. The defect in an API of Cisco Identity Services Engine (ISE) allows a remote attacker to bypass authentication and gain full control of the affected device.
“ISE devices enforce network access policy, so root access on the appliance lets an attacker modify that policy, extract stored credentials, delete logs, and move laterally into every network segment ISE controls,” Landon Rice, senior exploit developer at VulnCheck, told CyberScoop.
Cisco did not say how many organizations have been compromised thus far, but reported it found the vulnerability during a technical support case.
“Cisco is aware of active exploitation of this vulnerability. We strongly recommend customers upgrade to available fixed software and follow guidance in the advisory,” a Cisco spokesperson said in a statement.
The Cybersecurity and Infrastructure Security Agency added the zero-day to its known exploited vulnerabilities catalog shortly after Cisco’s disclosure.
Researchers haven’t attributed attacks involving CVE-2026-76460 to any known group or threat actor, but Rice noted Cisco ISE vulnerabilities are a recurring target.
Multiple vulnerabilities affecting the Cisco product have been exploited since June 2025, including CVE-2025-20337 and CVE-2025-20281. The latest zero-day vulnerability and the pair of defects disclosed in the summer of 2025 were all rated critical with the highest rating of 10.
Cisco didn’t say when the first instance of CVE-2026-76460 exploitation occurred, but the disclosure came just two days after the vendor disclosed CVE-2026-76461, an actively exploited zero-day vulnerability in Cisco Secure Email Gateway.
While the two zero-days disclosed this week have consecutive CVE identifiers, there’s no indication they are connected or share any technical relationship, Rice said. “These are different products and different vulnerability classes with no relation,” he added.
A Cisco spokesperson concurred with that assessment. “CVEs are assigned on a first-come, first-served basis, so consecutive numbering reflects assignment order rather than any relationship between the issues. CVE-2026-76460 and CVE-2026-76461 affect different codebases,” the spokesperson added.
Cisco published indicators of compromise to help customers hunt for attempted exploitation in their environments, and said there are no workarounds for the vulnerability.
The post Cisco alerts customers to second actively exploited zero-day in as many days appeared first on CyberScoop.
