Company

Cloud Software Group

Private equity-owned enterprise software firm formed by merging Citrix and TIBCO; it now operates Citrix's networking and virtualization products.

Current stories

securityConfirmed11 publishers

Third NetScaler zero-day hits SAML appliances already patched against the first two

Citrix confirmed CVE-2026-88779, a third exploited NetScaler zero-day, after appliances patched against the previous two began rebooting under attack. The vendor rates it denial of service, though logged payloads and a researcher's honeypot point toward code execution.

Publishers:bleepingcomputer.com cisa.gov cyberscoop.com infosecurity-magazine.com nakedsecurity.sophos.com orca.security scworld.com securityaffairs.com securityweek.com thehackernews.com therecord.media

Perspective Coverage

11 publishers

Builder: Builder 19%
Operator: Operator 68%
Investor: Investor 13%

Reality

Evidence78
Adoption: Not scored
Hype gap+20
Incentives50
Confidence70

securityConfirmed2 publishers

Citrix's NetScaler shipped a preauth DTLS overflow reachable in its default state

Citrix fixed CVE-2026-88772, a pre-auth DTLS memory overflow in NetScaler exploited as a zero-day and one of two exploited flaws in Sunday's advisory. The vulnerable handshake runs before authentication, so an internet-facing appliance answers a crafted packet with no login.

Publishers:labs.watchtowr.com thehackernews.com

Reality

Evidence62
Adoption: Not scored
Hype gap+8
Incentives: Not scored
Confidence58

buildConfirmed3 publishers

Default NetScaler Gateway configurations meet the conditions for both exploited pre-auth RCE bugs

Citrix confirmed attackers are exploiting two CVSS 9.5 pre-auth RCE flaws in NetScaler ADC and Gateway, one of them present in default configurations. Self-managed appliances need the fixed build, installed after evidence is saved, since an upgrade can erase signs of intrusion.

Publishers:dev.to thestack.technology watchtowr.com

Perspective Coverage

3 publishers

Builder: Builder 22%
Operator: Operator 65%
Investor: Investor 13%

Reality

Evidence76
Adoption68
Hype gap+5
Incentives35
Confidence74

securityOne report1 publisher

Build number and SAML settings decide exposure to exploited NetScaler flaw CVE-2026-19490

Exposure to CVE-2026-19490, a CVSS 9.8 NetScaler bypass CISA lists as exploited, depends on each appliance's exact build and SAML setup. Older builds qualify with any Gateway or AAA virtual server, while later builds short of the fix also need a SAML action configured.

Publishers:horizon3.ai

Reality

Evidence55
Adoption: Not scored
Hype gap+5
Incentives70
Confidence55

securityConfirmed3 publishers

Attackers are exploiting two unpatched NetScaler RCE flaws, watchTowr says

watchTowr says attackers exploited two remote code execution flaws in Citrix NetScaler ADC and Gateway before any fix existed. The August patch for CVE-2026-19490 fixes a different bug, so every operator now has to decide whether to keep the box online and whether to assume it is breached.

Publishers:bleepingcomputer.com tenable.com thehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 15%
Operator: Operator 73%
Investor: Investor 12%

Reality

Evidence55
Adoption: Not scored
Hype gap+10
Incentives35
Confidence60

securityConfirmed5 publishers

NetScaler auth bypass at 9.3: the box is the perimeter, so patch it this week

CVE-2026-19490 lets an unauthenticated attacker past NetScaler gateway and AAA virtual servers. Rapid7 has seen no exploitation yet and expects it shortly.

Publishers:bleepingcomputer.com blog.rapid7.com helpnetsecurity.com securityweek.com thehackernews.com

Perspective Coverage

5 publishers

Builder: Builder 14%
Operator: Operator 73%
Investor: Investor 13%

Reality

Evidence78
Adoption62
Hype gap+10
Incentives38
Confidence75