Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
2026-09-29T08:51:30Z•c8033cc1764c0b5cb90fa6577289afb4d65fcd533f22a908bb8cc5d281538dd7
CVE-2026-88771CVE-2026-88772AI-securityCitrixKubernetesNetScalercloud-securitycredential-theftexploited-in-the-wildidentity-abusemacOS-malwarephishingsoftware-supply-chainzero-day
What happened
Unit 42 reports possible zero-day exploitation of NetScaler devices involving CVE-2026-88771 and CVE-2026-88772. The broader feed also covers credential theft, cloud and Kubernetes identity abuse, malware campaigns, phishing, AI-assisted attacks, and software supply-chain threats.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- c8033cc1764c0b5cb90fa6577289afb4d65fcd533f22a908bb8cc5d281538dd7
- Enrichment time
- 2026-09-29T08:51:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.