Attackers exploited Citrix NetScaler zero-day for at least three weeks undetected

At­tac­kers re­mai­ned un­de­tec­ted for more than three weeks as they ex­ploi­ted a cri­ti­cal zero-day vul­ne­ra­bi­lity af­fec­ting Ci­trix NetS­ca­ler ap­plian­ces en masse.

The ear­liest known ins­tan­ce of CVE-2026-88772 ex­ploi­ta­tion oc­cu­rred Sept. 3, Man­diant re­sear­chers told Cy­berS­coop Tues­day.

The be­sie­ged se­cu­rity ven­dor and re­sear­chers didn’t con­firm the at­tacks until late last week. By then, Man­diant says, or­ga­ni­za­tions in North Ame­ri­ca and Eu­ro­pe span­ning the go­vern­ment, fi­nan­cial ser­vi­ces, edu­ca­tion, te­le­com, legal and pro­fes­sio­nal ser­vi­ces sec­tors were al­ready li­kely com­pro­mi­sed.

“We are aware of do­zens of im­pac­ted or­ga­ni­za­tions,” Char­les Car­ma­kal, chief tech­no­logy of­fi­cer at Man­diant Con­sul­ting, wrote in a Lin­ke­dIn post. He at­tri­bu­ted the at­tacks to “ad­van­ced and sus­pec­ted state-spon­so­red th­reat ac­tors.”

The three-week gap — at mi­ni­mum — bet­ween initial ex­ploi­ta­tion and con­fir­med in-the-wild at­tacks gave at­tac­kers a sig­ni­fi­cant ad­van­ta­ge…