Citrix and Kiteworks Incidents Highlight Challenges of Zero-Day Response
Summary
Citrix patched two NetScaler zero-days after exploitation was reported, while Kiteworks urged customers to take systems offline before releasing a patch. Their differing responses illustrate the operational trade-offs of acting on early threat intelligence.
Key points
- GreyNoise observed a US-based IP scanning Citrix NetScaler systems and attempting remote code execution on Sept. 24.
- Citrix later patched eight vulnerabilities, including two zero-days, CVE-2026-88771 and CVE-2026-88772, which the article says were widely exploited.
- Kiteworks advised customers on Sept. 25 to take systems offline based on intelligence about a possible imminent attack, then released a patch on Monday.
- Kiteworks said the vulnerability affected about 1% of its customers; its shutdown recommendation drew debate over whether it was prudent or excessive.
- Security professionals also urged some NetScaler administrators to take appliances offline, despite Citrix not issuing that instruction.
- Experts noted that shutdowns can disrupt remote access and business operations, and said vendors should specify which customers are at risk and how long systems should remain offline.
Article Details
- Event Type
- In-the-wild exploitation of two Citrix NetScaler zero-day vulnerabilities, followed by security updates; Kiteworks separately advised customers to take systems offline ahead of a potential attack and later released a patch.
- Impact
- Citrix reported widespread exploitation of CVE-2026-88771 and CVE-2026-88772. Kiteworks said its vulnerability would have affected 1% of its customers and advised a nine-hour shutdown of hosted systems. The article does not report confirmed customer breaches.
CVE
CVE-2026-19489whether the malicious activity targeted two vulnerabilities patched in August (CVE-2026-19490 and CVE-2026-19489). Citrix did not answer specific questions on the issue but pointed Dark Reading to its previousCVE-2026-19490Some questioned whether the malicious activity targeted two vulnerabilities patched in August (CVE-2026-19490 and CVE-2026-19489). Citrix did not answer specific questions on the issue but pointed Dark ReadingCVE-2026-88771By Sunday, Citrix seemingly agreed, posting an update that patched eight vulnerabilities (CVE-2026-88771 through CVE-2026-88778), including two zero-days that had been exploited in the wild. The blog post did notCVE-2026-88772to] the versions containing the fix immediately." However, the two zero-days — CVE-2026-88771 and CVE-2026-88772 — came under widespread exploitation.CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778Citrix seemingly agreed, posting an update that patched eight vulnerabilities (CVE-2026-88771 through CVE-2026-88778), including two zero-days that had been exploited in the wild. The blog post did not recommend taking
People
Andrew ThompsonSenior vice president of adversary operations at GreyNoise; discussed early detection and response decisions.Benjamin HarrisFounder and CEO of watchTowr; urged NetScaler users to take their systems offline.Frank BalonisKiteworks' CISO; explained the company's decision to recommend that customers take systems offline.John StrandOwner of Black Hills Information Security; commented on Kiteworks' shutdown recommendation.Jonathan YaronKiteworks' CEO and chairman; discussed the company's decision to advise customers to shut down systems.Satnam NarangSenior staff research engineer at Tenable; discussed shutdown advice and the operational costs of taking systems offline.
Vendors
CitrixSept. 24, threat detection firm GreyNoise Intelligence observed a single US-based IP address scanning for Citrix NetScaler installations and conducting remote code execution (RCE) attacks. The company issued alerts toGreyNoiseOn Sept. 24, threat detection firm GreyNoise Intelligence observed a single US-based IP address scanning for Citrix NetScaler installations and conducting remote code execution (RCE) attacks. The company issued alertsKiteworksThe same weekend, data protection provider Kiteworks took a different road.Tenableoffline, citing a government warning, according to Satnam Narang, a senior staff research engineer at Tenable, which published an advisory on the issue.