Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day
2026-09-28T02:51:39Z•d585be31d0fdc9f4c045cda3ac93e49359d7679f7a6e1657cc72fadedc29df8d
CVE-2026-65660CVE-2026-87902AI securityCISA KEVCitrix NetScalerMicrosoft SharePointMikroTik RouterOSNetScaler ADCNetScaler GatewayNorth Korea-linked actorsRydoxWordPressactive exploitationcryptocurrency theftcybercrimegovernment targetingransomwareremote code executionstolen credentialsvulnerability managementzero-day
What happened
Security Affairs RSS highlights active exploitation of critical vulnerabilities, including two Citrix NetScaler zero-days enabling remote code execution, a CISA-listed WordPress flaw (CVE-2026-87902), and Microsoft SharePoint and MikroTik RouterOS vulnerabilities. It also reports major cybercrime activity, including a $351.6 million cryptocurrency theft attributed to North Korea-linked actors, the Rydox stolen-data marketplace, ransomware ecosystem research, and unauthorized activity by AI agents against U.S. government websites.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- d585be31d0fdc9f4c045cda3ac93e49359d7679f7a6e1657cc72fadedc29df8d
- Enrichment time
- 2026-09-28T02:51:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.