Vulnerabilities
Citrix NetScaler ADC Vulnerabilities CVE-2026-88771/72 Actively Exploited; Bitget $387M Crypto Theft
Citrix NetScaler ADC and Gateway are under active exploitation due to CVE-2026-88771 and CVE-2026-88772, allowing unauthenticated remote code execution and denial‑of‑service. Bitget cryptocurrency exchange suffered a $387 million theft by North Korean actors. Defenders must patch immediately, monitor for suspicious activity, and review exposed service accounts.
What Happened
Citrix released patches for two NetScaler ADC and Gateway vulnerabilities, CVE-2026-88771 and CVE-2026-88772, that are now being actively exploited worldwide. The first flaw permits unauthenticated attackers to execute arbitrary commands; the second can lead to remote code execution or denial-of-service. In parallel, the Bitget exchange was hit by a North Korean-linked hack that moved $387 million in crypto from hot wallets.
Impact
- Citrix customers running NetScaler ADC or Gateway with versions prior to the latest patch are at risk of remote code execution or service disruption.
- Bitget users and other exchanges may face asset loss if hot wallets are compromised.
- The malicious placeholder domain now hosts phishing lures, expanding the attack surface for unsuspecting developers.
What to Do
- Apply the latest Citrix patches (CVE-2026-88771/72) before the CISA deadline; verify deployment with vulnerability scanners.
- Audit all service accounts and reduce privileges; enforce least‑privilege for NetScaler configurations.
- Monitor NetScaler logs for anomalous command execution or RCE attempts; enable intrusion detection if available.
- For exchanges, isolate hot wallets, enforce multi‑factor authentication, and conduct a forensic review of recent transfers.
- Search code repositories for the placeholder domain; replace or remove any references to prevent accidental inclusion in production.
Additional Observations
Weak service accounts, legacy bugs, and exposed systems continue to provide low‑effort attack paths for adversaries. Defenders should treat these “forgotten” vectors as high‑priority remediation items.
Related vulnerabilities
Citrix NetScaler Zero-Day Exploitation Targets Government and Finance Sectors
Citrix’s NetScaler ADC and Gateway appliances were hit by two critical zero-day vulnerabilities (CVE‑2026‑88771/72) that enabled remote code execution. Security firms Mandiant and GTIG confirmed attacks from early September, affecting government, finance, education, and legal organizations across North America and Europe. Administrators should immediately isolate affected devices, apply Citrix patches, and monitor for exploitation indicators.
Read briefing
Citrix NetScaler RCE Vulnerability (CVE‑2026‑107406) Requires Immediate Patch
Citrix has disclosed a critical memory‑overflow flaw in NetScaler ADC and Gateway appliances that can be leveraged for remote code execution or denial‑of‑service when configured as a SAML IdP or SP. Affected systems must be upgraded to the latest patched releases without delay. No active exploits reported yet, but defenders should verify patch status and monitor traffic.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
OpenSSL and WolfSSL Patch High‑Severity DTLS Vulnerabilities (CVE‑2026‑84782, CVE‑2026‑84783)
OpenSSL and WolfSSL released updates fixing a dozen critical bugs, including CVE‑2026‑84782 that lets unauthenticated attackers leak heap fragments or crash DTLS sessions. The flaw can be triggered during a DTLS handshake and is exploitable over the network without credentials. Defenders should upgrade to the latest releases and verify DTLS configurations.
Read briefing