Mandiant and Google Threat Intelligence Group describe in-the-wild exploitation CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway appliances globally. Indicators of compromise and YARA rules are included.
https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances?e=48754805
#threatintel #citrix #netscaler #kev #zeroday #ioc
ssvc
npub1dv…jfshx
2026-09-29 20:25:25 UTC
Author Public Key
npub1dvrxvdpkggqs4eq5m670khgenxgzqqwmlq8a3kkcru85dsg7e2rsqjfshxSeen on
wss://relay.momostr.pinkPublished at
2026-09-29 20:25:25 UTCEvent JSON
{
"id": "00c1cc2d19cf5edd8117c73adda01f24b7892288ff3049601454132e53e66c22",
"pubkey": "6b0666343642010ae414debcfb5d1999902001dbf80fd8dad81f0f46c11eca87",
"created_at": 1790713525,
"kind": 1,
"tags": [
[
"t",
"citrix"
],
[
"t",
"kev"
],
[
"t",
"zeroday"
],
[
"t",
"ioc"
],
[
"proxy",
"https://infosec.exchange/@ssvc/117356201609822869",
"web"
],
[
"t",
"netscaler"
],
[
"t",
"threatintel"
],
[
"proxy",
"https://infosec.exchange/ap/users/117202824925377048/statuses/117356201609822869",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/ap/users/117202824925377048/statuses/117356201609822869",
"pink.momostr"
],
[
"-"
]
],
"content": "Mandiant and Google Threat Intelligence Group describe in-the-wild exploitation CVE-2026-88771 and CVE-2026-88772 against Citrix NetScaler ADC and NetScaler Gateway appliances globally. Indicators of compromise and YARA rules are included.\n\nhttps://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances?e=48754805\n\n#threatintel #citrix #netscaler #kev #zeroday #ioc",
"sig": "467eda748d424105f6e87a1e113761f97591a15dbc0d63ff8e57d489306446c5b6a64528e97a17716a917ca32867ab58c4949380af84a20de1ac6508e2ae0c4a"
}