Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation

2026-10-05T20:51:31Z•672fda5f578e2021b580eb212276e2a922be88e8a9a25cec6773c0dea46324d9

CVE-2026-88771CVE-2026-88772CVE-2026-88779Citrix NetScalerKiteworksactive exploitationcovert tunnelingedge device securitymalwarethreat intelligencevulnerabilityzero-day

Open source link →

What happened

Sophos reports active exploitation of multiple Citrix NetScaler vulnerabilities, including CVE-2026-88779 and CVE-2026-88771/CVE-2026-88772. The feed also highlights covert tunneling malware activity involving TerminalFix and Lorem Ipsum Loader, and a possible attack against Kiteworks prompting a server-shutdown recommendation. The actively exploited NetScaler issues represent the most immediate risk.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sophos_news
Record identifier: 672fda5f578e2021b580eb212276e2a922be88e8a9a25cec6773c0dea46324d9
Enrichment time: 2026-10-05T20:51:31Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records