Critical

Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution

The Hacker News

September 30, 2026 at 5:30 AM

Actively Exploited

Overview

Recently, researchers uncovered a serious vulnerability in Citrix NetScaler ADC and Gateway, identified as CVE-2026-88772, which has a CVSS score of 9.5. This flaw, categorized as a memory overflow issue in the Datagram Transport Layer Security (DTLS) protocol, allows attackers to execute shellcode without prior authentication. The vulnerability is currently being exploited in the wild, putting organizations using affected versions of Citrix NetScaler at significant risk. Companies should prioritize applying the latest security patches to safeguard their systems, as failure to do so could lead to unauthorized access and potential data breaches.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Citrix NetScaler ADC, Citrix NetScaler Gateway
Action Required: Apply the latest security patches provided by Citrix for NetScaler ADC and Gateway.
Timeline: Newly disclosed

Original Article Summary

Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-88772 (CVSS score: 9.5), has been described as a memory overflow bug in the Datagram Transport Layer Security (DTLS) protocol handling that's rooted in the NetScaler

Impact

Citrix NetScaler ADC, Citrix NetScaler Gateway

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Apply the latest security patches provided by Citrix for NetScaler ADC and Gateway. Ensure systems are updated to the most recent versions to mitigate the risk associated with this vulnerability.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Exploit, Vulnerability, and 1 more.

Read Original Article

Related Coverage

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

The Hacker News

Recent findings from Microsoft's Security Research team reveal that attackers have exploited a serious vulnerability in the Zimbra Collaboration Suite (ZCS). The flaw, identified as CVE-2026-73570, allows for unauthenticated command injection, leading to remote code execution. This means that attackers can deploy web shells to access sensitive mailbox data. Organizations using ZCS should be particularly vigilant, as this vulnerability carries a high severity score of 8.9. The fact that attackers are taking advantage of this flaw emphasizes the importance of keeping software updated and applying patches promptly to safeguard against potential data breaches.

Sep 30, 2026

Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager

The Hacker News

Cisco has issued a warning about a critical zero-day vulnerability affecting its Catalyst SD-WAN Manager, which is used by companies to oversee their SD-WAN networks. The flaw, identified as CVE-2026-76504, allows remote attackers to exploit the system's API without needing any login credentials, essentially granting them admin-level access. This poses a significant risk to organizations using this management software, as it could lead to unauthorized control and potential data breaches. Cisco has released patches to fix the issue, but there are no workarounds available for users who need immediate protection. Companies are urged to apply the fixes as soon as possible to mitigate the risk of exploitation.

Sep 30, 2026

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

The Hacker News

Cybercriminals are exploiting ChatGPT's Custom GPTs feature to trick users into visiting harmful websites. These sites use ClickFix lures to deliver Remote Access Trojans (RATs), which can take control of victims' devices. This tactic was observed by Huntress in late September 2026 and represents a concerning trend where trusted AI platforms are manipulated to spread malware. Users who interact with these malicious GPTs may unknowingly expose their systems to significant risks. This incident serves as a reminder for individuals and organizations to be cautious when engaging with AI-driven tools and to verify the legitimacy of any offerings before clicking links.

Sep 30, 2026

AI's Third Wave: Coworkers Break the Security Model That Worked for Agents

BleepingComputer

The article discusses emerging security risks associated with persistent AI coworkers, which operate continuously and often have standing access to systems. This creates identity risks that current security models are not equipped to handle. Experts from Token Security emphasize the need for these AI agents to have their own distinct identities, designated owners, and carefully scoped permissions to mitigate potential security issues. Additionally, implementing lifecycle controls for these agents is crucial to ensure that they do not pose an ongoing risk. As AI increasingly integrates into workplaces, addressing these identity and access challenges is vital to protect sensitive information and maintain organizational security.

Sep 30, 2026

TeamViewer urges users to patch severe flaws “as soon as possible”

BleepingComputer

TeamViewer has issued an urgent warning for users to update their remote access software due to the discovery of several high-severity vulnerabilities in both its client and host applications. These flaws could potentially allow unauthorized access or control over user systems, putting sensitive data at risk. Users of TeamViewer are strongly advised to apply the patches as soon as possible to protect against potential exploitation. The vulnerabilities affect multiple versions of the software, which means that a wide range of users could be impacted. Failing to address these issues promptly could lead to serious security breaches for individuals and businesses alike.

Sep 30, 2026

AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub

The Hacker News

A recent report from security firm Glow revealed that AI coding agents inadvertently exposed over 13,000 internal images on public GitHub repositories. These images, belonging to developers from more than 300 organizations, included sensitive information such as customer billing records and unreleased feature screenshots. The issue primarily arose from developers using their personal GitHub accounts to share code review screenshots. This incident raises serious concerns about data privacy and security, as sensitive company information is now publicly accessible. Organizations need to reassess their use of AI tools and ensure that proper security measures are in place to protect internal data.

Sep 30, 2026