Citrix NetScaler Zero-Day Exploits Remained Hidden for Weeks
Attackers exploited a critical zero-day vulnerability in Citrix NetScaler appliances for at least three weeks before security researchers confirmed the intrusions, according to Mandiant. The earliest known exploitation of CVE-2026-88772 occurred on September 3, but the vendor and security community did not confirm the attacks until late the following week. This delay gave threat actors a significant window to operate undetected across targeted networks.
By the time the compromise was identified, Mandiant reported that organizations spanning government, financial services, education, telecom, legal, and professional services sectors in North America and Europe were likely already affected. Charles Carmakal, chief technology officer at Mandiant Consulting, stated in a LinkedIn post that dozens of organizations had been impacted and attributed the campaign to "advanced and suspected state-sponsored threat actors."
Extended Dwell Time Amplified Attack Impact
The three-week gap between initial exploitation and public confirmation — at a minimum — allowed attackers to establish footholds, move laterally, and exfiltrate data with reduced risk of detection. Mandiant researchers cautioned that the actual duration could be longer, noting they were still responding to active intrusions and that new evidence might alter the timeline of the campaign.
Further analysis revealed that attackers did not rely on a single flaw. GreyNoise data indicated that a second zero-day, CVE-2026-88771, had been exploited since at least September 24, with indications the campaign may have begun even earlier. While the relationship between the two vulnerabilities remains unclear, Citrix addressed both flaws in a security advisory released on Sunday, alongside patches for six additional vulnerabilities.
Attackers Used Novel Tools to Evade Detection and Steal Data
Mandiant’s threat intelligence report detailed the tools and tactics used by the intruders to exploit CVE-2026-88772, achieve privileged access, navigate internal networks, and steal sensitive information. In one observed intrusion, threat actors deployed a novel tunneler malware to manually conduct reconnaissance and harvest credentials, bypassing traditional detection mechanisms.
Separately, researchers at watchTowr published a technical analysis of CVE-2026-88782 on Tuesday, though this appears to be a reference or potential confusion in naming — the primary focus remains on the two confirmed Citrix NetScaler zero-days being actively exploited in the wild.
Edge Devices Continue to Be Prime Targets for Espionage and Crime
The attacks underscore a growing trend in which threat actors target edge devices such as VPN gateways, firewalls, and application delivery controllers — systems that often lack endpoint detection and response (EDR) coverage. According to Google Threat Intelligence Group, vulnerabilities in these devices accounted for 48% of enterprise-related zero-days exploited in the previous year.
Mandiant researchers noted that both cyber espionage and financially motivated groups prioritize these appliances due to their strategic position in network architecture and limited monitoring capabilities. Exploiting zero-days in such infrastructure allows attackers to maintain persistence and scale operations while remaining difficult to detect.
"Because most edge devices do not support endpoint detection and response (EDR) monitoring, targeting them, particularly through exploiting zero-day vulnerabilities, provides threat actors with an infection vector that is difficult to detect and prevent, and the opportunity to scale a campaign as long as the exploit remains undiscovered,"
Carmakal warned in his LinkedIn post that Mandiant anticipates "broad and opportunistic exploitation" of both Citrix NetScaler zero-days by a diverse range of threat actors in the near term, urging organizations to apply patches immediately and investigate for signs of compromise.
Source: CyberScoop