Citrix NetScaler Zero-Days Used to Compromise Organizations for Weeks Before Detection

Summary

Mandiant says attackers exploited a Citrix NetScaler zero-day for at least three weeks, likely compromising dozens of organizations. Citrix disclosed and patched two actively exploited flaws; researchers expect further exploitation.

Key points

Mandiant identified Sept. 3 as the earliest known exploitation of CVE-2026-88772; attacks were confirmed more than three weeks later.
Mandiant said dozens of organizations in North America and Europe were likely compromised across government, finance, education, telecom, legal, and professional services.
A second NetScaler flaw, CVE-2026-88771, was also actively exploited; GreyNoise reported activity since at least Sept. 24.
Mandiant attributed the activity to advanced, suspected state-sponsored threat actors; the relationship between the two campaigns is unclear.
Researchers found tools and tactics for tunneling, internal reconnaissance, credential theft, privileged access, and movement across networks.
Citrix disclosed both actively exploited flaws and released patches, along with fixes for six additional vulnerabilities.
Mandiant expects broad, opportunistic exploitation of both flaws and said its understanding of the campaign timeline may change as investigations continue.

Article Details

Victim Organization: Unknown
Incident Type: Exploitation of two actively exploited Citrix NetScaler zero-day vulnerabilities, with organizations reportedly likely compromised
Data Types Exposed: Sensitive data (specific types not disclosed)
Affected Records: Unknown
Affected Data Size: Unknown
Operational Impact: Dozens of organizations across multiple sectors in North America and Europe were reported as likely compromised. Attackers gained privileged access, moved within compromised environments, and conducted reconnaissance and credential theft; specific operational disruptions were not reported.
Ransom Or Extortion: None reported
Claim Status: alleged