Citrix NetScaler

Top Cybersecurity Stories: SharePoint Exploits Warned by US Authorities, Citrix and WordPress Flaws Lead Weekly Rankings

Security NEXT has published its weekly ranking of the most viewed articles from September 27 to October 3, 2026, highlighting critical vulnerability disclosures and confirmed exploitation cases. US authorities issued warnings about active exploitation of five vulnerabilities affecting SharePoint and WordPress. Citrix NetScaler received multiple vulnerability advisories with two flaws already confirmed as exploited in the wild. Apple released iOS 26.7.1 to address vulnerabilities potentially used in targeted attacks against specific individuals. Other notable incidents include a personal data breach at Times Car car-sharing service and a ransomware attack impacting Keio Electric Railway operations.

CISA Adds Two Critical Citrix NetScaler Flaws to Known Exploited Vulnerabilities Catalog

The CISA has added two critical vulnerabilities affecting Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities catalog following reports of active global exploitation. Both CVE-2026-88771 and CVE-2026-88772 carry a CVSS score of 9.5 and were patched by Citrix on September 27, the same day they were added to the catalog. The first flaw stems from improper input validation and allows unauthenticated arbitrary command execution on default installations. The second issue involves a buffer overflow that can lead to remote code execution or denial of service when DTLS is enabled on VPN virtual servers. Affected versions include 14.1-73.32, 13.1-63.21 and earlier, with fixes available in 14.1-73.37, 13.1-64.23 and later releases including FIPS variants. The issues were identified by watchTowr on September 26, and Citrix confirmed ongoing attacks against unpatched systems. Organizations are advised to apply patches immediately while preserving evidence and following full incident response procedures.

Fundamental Flaw in File Monitoring APIs Exposes Keystrokes and App Activity Across Windows, Linux, Android, and macOS

Researchers from Graz University of Technology demonstrated how built-in file change notification mechanisms can leak sensitive user activity without requiring elevated privileges. The affected subsystems include inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and FSEvents on macOS. On Linux the technique enables reconstruction of typed text with 93-100% accuracy by monitoring /dev/input/event4 timestamps. Android apps can break sandbox isolation to observe messaging events, while Windows monitoring of browser cache files reveals visited websites at 97.8% accuracy. Only partial mitigations have been deployed in Linux and Windows, with no fixes available for Android or macOS. Additional attacks remain possible, including detection of password prompts to facilitate phishing overlays.

CISA Adds CVE-2026-8452 to KEV Catalog and Orders Federal Agencies to Patch Citrix NetScaler by August 29 2026

CISA has placed CVE-2026-8452 in its Known Exploited Vulnerabilities catalog, compelling US federal agencies to apply patches to Citrix NetScaler before the unusually tight deadline of August 29 2026. The flaw, initially reported as a memory overflow leading to denial of service, has been confirmed through public technical analysis to enable unauthenticated remote code execution with root privileges on unpatched devices. The vulnerability impacts NetScaler ADC and NetScaler Gateway appliances configured as VPN Gateway or AAA virtual servers, with heightened risk in SAML-based deployments acting as either Service Provider or Identity Provider. Attackers have already conducted spray-and-pray campaigns that deploy webshells and perform basic reconnaissance after initial compromise. Tens of thousands of NetScaler instances remain internet-exposed, increasing the likelihood of automated mass exploitation. Citrix has released fixed builds including 14.1-72.61, 13.1-63.18, and 13.1-37.272 or higher for FIPS and NDcPP environments. Organizations are advised to inventory exposed devices, verify versions, hunt for indicators of compromise, and apply additional hardening measures beyond patching.

CISA Orders Federal Agencies to Patch Critical Citrix NetScaler RCE Flaw by August 29 2026

CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog and set an unusually tight deadline for U.S. federal agencies to remediate the issue in Citrix NetScaler products. The vulnerability, initially described as a denial-of-service condition, is now actively exploited to achieve unauthenticated remote code execution with root privileges on unpatched appliances. Affected configurations include NetScaler ADC and NetScaler Gateway when deployed as VPN Gateway or AAA virtual servers, especially in environments using SAML for single sign-on. Attackers have been observed deploying webshells and performing reconnaissance after initial compromise in a spray-and-pray pattern. Tens of thousands of NetScaler devices remain exposed to the internet, increasing the risk of widespread automated attacks. Citrix has released fixed builds including 14.1-72.61 and 13.1-63.18, along with specific versions for FIPS and NDcPP environments.

CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog Including Citrix NetScaler, Linux Kernel and Microsoft SQL Server Flaws

On August 26, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling confirmed active exploitation and requiring immediate remediation priority. The batch includes a recent memory corruption issue in Citrix NetScaler ADC and NetScaler Gateway tracked as CVE-2026-8452, along with five older flaws affecting Microsoft SQL Server, the Linux kernel, Ajax.NET Professional, Red Hat libuser, and Red Hat ABRT. Citrix released patches for the NetScaler vulnerability on June 30, 2026, while CISA set an August 29, 2026 deadline for federal agencies. Real-world attacks have already deployed web shells and performed reconnaissance after successful exploitation of the Citrix appliance. The remaining CVEs enable remote code execution, local privilege escalation, and denial-of-service conditions across widely deployed enterprise technologies.

DeepSeek-Powered Telegram Bot Attempts Autonomous Attacks on 460 Targets but Achieves Zero Successes

Researchers from Unit 42 at Palo Alto Networks recovered the full activity log of an autonomous AI agent built with the Hermes Agent framework and the DeepSeek model. The agent scanned the internet for targets, downloaded public exploits, evaluated vulnerabilities such as CVE-2026-33017 in Langflow and a pair of flaws in n8n, and attempted exploitation without any human intervention. Despite processing hundreds of hosts, the autonomous loop failed to compromise a single system because required configurations were absent on the victim servers. Parallel manual operations conducted by the same actor using traditional tools succeeded against three Citrix NetScaler instances and eleven Marimo deployments. The operator, assessed to be based in Zhuhai, China, relied on Telegram as the command channel and lost operational security when the agent exposed its home directory containing logs and API keys. The case demonstrates both the current limitations of LLM-driven attack agents and the low barrier to entry created by open-source agent frameworks paired with permissive models.