Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)
2026-10-01T20:51:31Z•a51d50d0f50ea6955fee9aa9d0034c96e9db229a40e12daf7210a01ff291bf2a
CVE-2026-88771CVE-2026-88772AI-assisted-attacksAI-enabled-malwareAMOS-stealerAWS-IAMCitrixKubernetesLatin-AmericaMicrosoft-TeamsNetScalerRBACSEO-poisoningSPIFFESPIREcloud-securitycredential-exposureexploited-in-the-wildidentity-abuseinformation-stealermacOS-malwaremalware-deliveryprompt-injectionvoice-phishingzero-day
What happened
Unit 42 threat intelligence feed covering active exploitation of NetScaler zero-days CVE-2026-88771 and CVE-2026-88772, cloud and Kubernetes identity abuse, exposed AWS credentials, AI-assisted attacks, macOS information stealers, phishing campaigns, and AI-enabled malware. The most urgent item reports that both NetScaler vulnerabilities are being exploited in the wild.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- a51d50d0f50ea6955fee9aa9d0034c96e9db229a40e12daf7210a01ff291bf2a
- Enrichment time
- 2026-10-01T20:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.