Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected

Mandiant and other researchers disclosed active, large-scale exploitation of two Citrix NetScaler zero-days (CVE-2026-88772 and CVE-2026-88771) that began in early September; attackers remained undetected for weeks, used novel tunneler malware to gain privileged access and perform internal reconnaissance and credential theft, and likely impacted dozens of organizations across government, finance, education, telecom, legal and professional services in North America and Europe, prompting Citrix to publish patches.