- Published
- Source
- Google Threat Intelligence
- Filed under
- Nation-state, Malware & exploits
- Vulnerabilities
- 1 CVE Exploited
Introduction In late September 2026, Mandiant Consulting and Google Threat Intelligence Group (GTIG) identified active, in-the-wild exploitation of a zero-day vulnerability (CVE-2026-88772) affecting Citrix NetScaler ADC and NetScaler Gateway appliances. We have observed evidence that organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors were…
If you run the affected product
- Find every instance – especially the ones reachable from the internet.
- Apply the vendor's patch or mitigation now: exploited flaws are fixed in days, not at the next patch cycle.
- Then check for signs it was used before you patched: web shells, new accounts, unusual outbound traffic.
More helpCISA's Known Exploited Vulnerabilities catalogue (opens in a new tab)
The vulnerabilities in this story
CVE-2026-88772 in the NVD (opens in a new tab)
- CVSS8.1High
- EPSS1.3%chance of exploitation in 30 days
- CISA KEVExploitedon the list since 27 Sep
Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
External Remote Services
Persistence, Initial AccessWhat a defender checks
- List every VPN, remote desktop and remote-access gateway you expose.
- Require MFA on all of them, and keep them patched.
- Alert on sign-ins from new countries, networks or devices.
Build the skillBlue Team Engineer · Network Security Engineering
Exploit Public-Facing Application
Initial AccessWhat a defender checks
- Find every internet-facing instance of the affected product.
- Patch, or apply the vendor's mitigation now – CISA's KEV list gives a deadline.
- Look for signs it was exploited before you patched: web shells, new accounts, odd outbound traffic.
Build the skillBlue Team Analyst · Vulnerability Management
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Specialist
Breaches like this get investigated, not just reported.
Blue Team Specialist takes the Analyst curriculum and adds the investigator's work: one incident owned end to end, hypothesis-led threat hunting with MITRE ATT&CK and KQL, breach analysis, and a root cause report people can act on.
- Scope, attacker path and dwell time
- Threat hunting with ATT&CK and KQL
- Root cause analysis and reporting
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
