Unauthenticated SAML bug lets attackers reboot-loop Citrix NetScaler gateways - now in CISA KEV. https://intel.threadlinqs.com/threat/TL-2026-2896 #ThreatIntel #CVE_2026_88779 #Citrix #NetScaler
@threadlinqs.bsky.social
@threadlinqs.bsky.socialUnauthenticated SAML bug lets attackers reboot-loop Citrix NetScaler gateways - now in CISA KEV. https://intel.threadlinqs.com/threat/TL-2026-2896 #ThreatIntel #CVE_2026_88779 #Citrix #NetScaler
@cyfar.ca~Cisa~
CISA reports active exploitation of a Citrix NetScaler memory-buffer vulnerability and urges rapid remediation.
-
IOCs: CVE-2026-88779
-
#CVE-2026-88779 #Citrix #ThreatIntel
@etguenni.bsky.social#Citrix die #Schwachstelle #CVE-2026-88779 im NetScaler ADC und NetScaler Gateway bestätigt. Führt zum Absturz, kann für Denial of Service-Angriffe missbraucht werden. Also patchen.
@hendryadrian.bsky.socialActive exploits hit Citrix NetScaler, Apple, Cisco SD-WAN and FortiMail, while a Microsoft analytics service breach and AI misuse cases raised new security concerns. #Citrix #NetScaler #Apple
@securityonline.bsky.socialCitrix NetScaler CVE-2026-88779 is exploited in the wild against NetScaler SAML authentication setups. Upgrade to 14.1-73.41 now.
#Citrix #NetScaler #CVE202688779 #SAML #ActivelyExploited #DoS #Vulnerability
@ifin-intel.orgThis is the patch that never ends
It goes on and on my friends
Some people
Started applying it
Not knowing what it was
And they will keep applying it
Forever just because
(CVE-2026-88779 advisory and patch included now)
@netsecio.bsky.socialCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE
🌐 cyber[.]netsecops[.]io
@rcinghio.bsky.socialResearchers at Mandiant and Google Threat Intelligence Group (GTIG) say that a critical memory overflow vulnerability in #Citrix NetScaler ADC and Citrix NetScaler Gateway (CVE-2026-88772, CVSS score 9.5) was exploited weeks before it was disclosed.
www.theregister.com/security/202...
@etguenni.bsky.socialBetreut jemand #Citrix #Netscaler ADC-Installationen? Nach dem Patch vom letzten Wochenende gibt es wohl ein #SAML-Problem. Derzeit stürzen gepatchte, aber angegriffene Netscaler Applicances ab. Citrix untersucht es.
@thedailytechfeed.comNetScaler’s 14.1-73.37 patch fixes two zero-days but triggers reboots via crafted SAML traffic crashing nsaaad. #NetScaler #ZeroDay #Citrix #Cybersecurity #PatchFail #Authentication https://thedailytechfeed.com/citrix-netscaler-patch-triggers-reboots-as-engineers-scramble-for-fix/
@royans.bsky.socialBitget $388M Breach via Citrix NetScaler ADC Zero-Day Exploit
https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772
https://flagthis.com/tldr/8192
@ifin-intel.orgIf you are having #Citrix #Netscaler issues after applying all patches and remediations and want to confidentially share intel, let us know: tipsIFIN
PGP key available at
@opsmatters.comThe latest update for #GripMatix includes "NetScaler Console Indicators of Compromise Detection" and "Notes from the Field: Incomplete #Monitoring Data After Upgrading to #Citrix VAD 2603".
#SCOM #SysCtr https://opsmtrs.com/3z4TsF2
@securityonline.bsky.socialCitrix flags a NetScaler SAML authentication issue as patched NetScaler appliances reboot after CVE-2026-88771 attacks. Check your config.
#Citrix #NetScaler #SAML #CVE202688771 #CVE202688772 #ZeroDay #Vulnerability
@ifin-intel.org*Sigh*
The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.
@statusisdown.bsky.socialCitrix is reportedly down for some users. Are you one of them? #Citrix #CitrixCloud #CitrixDown https://statusisdown.com/service/citrix/
@netsecio.bsky.socialCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE
🌐 cyber[.]netsecops[.]io
@netsecio.bsky.socialCritical Alert: Two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) are under active global attack. Flaws allow unauthenticated RCE. CISA KEV listed. Patch and hunt for compromise now! #Citrix #NetScaler #CyberSecurity #CVE
🌐 cyber[.]netsecops[.]io