NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

2026-09-29T20:51:39Z•679e2ba6c9e4eb847db30afbc75ec73d9e1627c01dbcb406508b90e5e2d2425a
CVE-2026-88771AI securityCitrix NetScaler ADCCitrix NetScaler GatewayClickFixdeepfakeinternet-facing systemsmass exploitationproof-of-conceptremote access trojanremote code executionsocial engineeringsupply-chain attackzero-day

What happened

Help Net Security reports that exploitation of internet-exposed, unpatched Citrix NetScaler ADC and Gateway systems has escalated from targeted zero-day activity to widespread automated attacks following publication of a root-cause analysis and proof-of-concept exploit for CVE-2026-88771. The vulnerability is described as remotely exploitable under default configuration. The feed also covers AI security governance, deepfake and impersonation risks, malicious Custom GPT-driven ClickFix malware delivery, and simulated AI-enabled supply-chain attacks.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
helpnetsecurity
Record identifier
679e2ba6c9e4eb847db30afbc75ec73d9e1627c01dbcb406508b90e5e2d2425a
Enrichment time
2026-09-29T20:51:39Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

Record · NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771) · Baitaphish