Today’s Field Note

Citrix NetScaler is on fire again. CVE-2026-88772 (CVSS 9.5), a DTLS memory overflow that hits default configs, is under active exploitation, and Mandiant and GTIG have watched attackers ride it to root, drop WHIPSHOT and SLAPSHOT plus custom web shells, harvest credentials, and pivot inland across government, finance, tech, education, and legal targets in North America and Europe. Technical exploit details are now public, which means the window between “sophisticated actor” and “everyone” is closing fast. Separately, Apple is patching CVE-2026-86950, an out-of-bounds write already weaponized in targeted attacks (read: mercenary spyware territory), so treat your executive and high-risk devices accordingly. These are not theoretical. They are being used against people who look like your users right now.

Today’s Action

  • Patch NetScaler ADC and Gateway to the fixed builds for CVE-2026-88772 immediately, then assume compromise on any appliance exposed before patching.
  • Hunt NetScaler for web shells, unexpected root processes, and tunneling activity; rotate all credentials and secrets those appliances could touch, and kill active sessions.
  • Push the Apple update covering CVE-2026-86950 to all iOS and macOS fleet devices today, prioritizing executives, journalists, and other high-risk profiles.
  • Review NetScaler ingress logs for anomalous DTLS traffic and outbound connections dating back several weeks, not just post-disclosure.
  • Confirm your NetScaler boxes are not sitting in default config with DTLS reachable from the internet, and restrict management interfaces.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch the skeleton key before someone else finishes copying it.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.