New Attack Vector Against Citrix NetScaler After Initial Patches

Researchers and administrators are reporting exploit activity against Citrix NetScaler, including on systems updated for CVE-2026-88771 and CVE-2026-88772. According to the information shared, the new method uses SAML requests to achieve malicious code execution and bears similarities to attacks observed a few days earlier. Citrix maintains that the issue is independent of the vulnerabilities documented in advisory CTX697096, suggesting that it is not simply an incomplete patch. Some operators have published indicators of compromise and reported appliance reboots during potentially hostile scans. Organizations should review the vendor's latest guidance, look for the available indicators, and not consider the application of the previous patches alone as definitive proof of security.

Source: /r/cybersecurity