Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)

Mandiant and Google Threat Intelligence Group report that suspected state-sponsored hackers have been actively abusing CVE-2026-88772, one of two newly disclosed Citrix NetScaler ADC and NetScaler Gateway zero-days, since at least early September 2026. The flaw, which only affects appliances with DTLS configuration enabled, lets attackers bypass authentication by sending malformed or fragmented record headers that corrupt heap memory in the packet processing engine, granting root-level access on the underlying FreeBSD system. Dozens of organizations across North America and Europe — spanning government, finance, education, telecom, and legal sectors — have reportedly already been compromised, with intruders deploying web shells and a custom tunneling tool called SLAPSHOT to pivot into internal networks. Mandiant's CTO warns that simply patching NetScaler devices against CVE-2026-88772 and the companion flaw CVE-2026-88771 won't remove attackers who already gained footholds or address exposed credentials, urging full incident-response and remediation steps instead.