Citrix CTX697096 names two exploited NetScaler zero-days at CVSS 9.5. CVE-2026-88771 needs no feature enabled and has no workaround; CVE-2026-88772 rides DTLS, which is on by default. Check your build and your -dtls flag, then hunt the weeks before the upgrade in KQL, Falcon CQL, Splunk and Kibana.

Citrix NetScaler Gateway after a quiet nsppe crash. Hunt PHP under /var/vpn/theme. You have seen this ticket. VPN died, VPN came back, someone closed it as a blip. Citrix sold CVE-2026-8452 as a crash. CISA put it on KEV Monday. The federal clock is Saturday, 29 August. Builds with a fix: 13.1-63.21 or later, 14.1-73.32 or later. 12.1 and 13.0 have no fix. Patch is not the hunt. A patched box that already had a quiet respawn still needs the directory check. The hunt is not th

Citrix is a global leader in providing digital workspace solutions, and as such, it is a popular target for cyber attackers. One such attack is the recently discovered vulnerability known as CVE-2022-27518. In this blog, we will discuss the details of this vulnerability, how it affects Citrix and the technical workings of this exploit. First, let's define what a CVE is. Common Vulnerabilities and Exposures (CVE) is a standardized way of identifying and categorizing vulnerabil

CVE-2022-27516 is a severe vulnerability recently discovered in Citrix, a widely-used software program. This vulnerability has the potential to wreak havoc on Citrix users, and it is important for individuals and organizations that use the program to take steps to protect themselves against it. The vulnerability in question lies within Citrix's handling of certain types of data inputs. Specifically, the program fails to properly validate and sanitize user-supplied input, allo