[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXvYor62NsnqCwmaORw7odN6nthoi5QMX8jkVCvU_WFM":3},{"article":4,"iocs":55,"watch_terms":74,"solutions":75,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"42f6f326-f1b3-4e29-99f0-06f178512fbe","This is Fine: What NetScaler Zero-Days Tell Us About the New Normal","this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal-f1be3a","Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us About the New Normal appeared first on SecurityWeek.","Unidentified threat actors actively exploited undisclosed zero-day vulnerabilities in Citrix NetScaler ADC and Gateway in September 2026. The rapid detection and response, including emergency patching over a weekend, highlight improvements in global monitoring and vendor coordination, reducing exploitation windows for such attacks.","Citrix NetScaler zero-days actively exploited, prompting rapid patching and advisories.","https:\u002F\u002Fwww.securityweek.com\u002Fthis-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F07\u002FCitrix-zero-day.jpg","2026-10-27T10:02:24+00:00","2026-10-27T11:00:08.835743+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"NetScaler ADC","product",{"name":21,"type":19},"NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":27},"Application Delivery Controller","technology",{"name":29,"type":27},"Web Application Firewall",{"name":31,"type":27},"SSL VPN","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62,64,66,68,70,72],{"type":57,"value":58,"context":59},"cve","CVE-2026-88771","NetScaler zero-day vulnerability",{"type":57,"value":61,"context":59},"CVE-2026-88772",{"type":57,"value":63,"context":59},"CVE-2026-88773",{"type":57,"value":65,"context":59},"CVE-2026-88774",{"type":57,"value":67,"context":59},"CVE-2026-88775",{"type":57,"value":69,"context":59},"CVE-2026-88776",{"type":57,"value":71,"context":59},"CVE-2026-88777",{"type":57,"value":73,"context":59},"CVE-2026-88778",[23,18,21],{"controls":76,"vendors":160},[77,106,135],{"slug":78,"name":79,"problem":80,"products":81},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":107,"name":108,"problem":109,"products":110},"patch-management","Automated patch management","Known holes get closed in days, not months.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":54,"name":136,"problem":137,"products":138},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[139,147,155],{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":156,"product_name":157,"url":158,"description":159},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[161],{"slug":162,"name":23,"logo_path":163,"roles":164},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[165],"affected",{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":178},"citrix-netscaler-zero-days-expose-the-relentless-pace-of-exploitation","Citrix NetScaler Zero-Days Expose the Relentless Pace of Exploitation","Unidentified threat actors exploited undisclosed zero-day vulnerabilities in Citrix NetScaler ADC and Gateway, targeting widely deployed network access infrastructure before patches were even available. Zero-days represent the hardest class of vulnerability to defend against because defenders cannot simply 'patch faster' — the fix does not yet exist. What this incident illustrates is that organizations must build compensating controls, deep monitoring, and rapid-response capabilities so that when a zero-day strikes, the exploitation window is minimized. The encouraging takeaway is that improved global threat intelligence sharing and vendor coordination enabled emergency patching over a single weekend, demonstrating that faster collective response is achievable. This incident reinforces that resilience — not just prevention — must be the goal for critical network-facing appliances.",[171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(b)":179,"NIST SP 800-53 SI-2: Flaw Remediation":180,"CIS Control 17: Incident Response Management":181,"OWASP A06:2021 Vulnerable and Outdated Components":182,"CIS Control 7: Continuous Vulnerability Management":183,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":184,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":185},"NIS2 requires essential and important entities to implement incident handling measures and vulnerability disclosure practices; the coordinated vendor and operator response to these NetScaler zero-days is precisely the kind of capability NIS2 mandates for operators of critical network infrastructure.","SI-2 requires organizations to identify, report, and correct information system flaws — including establishing processes for out-of-cycle emergency patching — which is precisely the capability that limited damage when Citrix released its emergency fix over a weekend.","The rapid weekend response highlighted in this incident reflects strong incident response maturity; CIS Control 17 calls for a documented and rehearsed IR plan that includes vendor coordination procedures, enabling organizations to compress response timelines during active zero-day exploitation.","Although this incident involved a zero-day rather than a known-unpatched flaw, A06 underscores the systemic risk of running complex third-party network components at the perimeter and the need for continuous monitoring of component health and rapid replacement or mitigation when flaws emerge.","Continuous vulnerability management mandates tracking and remediating flaws on a defined schedule; for zero-days this extends to monitoring vendor advisories and deploying emergency patches the moment they become available, directly reducing the exploitation window seen in this incident.","This control requires timely identification of and response to technical vulnerabilities in systems, including network appliances; having a mature vulnerability management process ensures organizations can act on zero-day disclosures faster than attackers can exploit them.","NetScaler Gateway is a critical authentication and access control boundary; hardening and monitoring that boundary — including restricting management-plane access — limits the blast radius when a zero-day in such a component is actively exploited."]