Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

thehackernews.com Sep 27, 2026

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

Curated by Shubham · TechCapsules · Sep 27, 2026

AI-summarised brief · reviewed before publication

Security firm watchTowr reported on September 26 that two previously unknown Citrix NetScaler ADC and NetScaler Gateway zero‑day flaws are being actively exploited to execute remote code. Citrix has not confirmed the vulnerabilities, issued a bulletin, or released patches, leaving administrators to decide whether to isolate or shut down the appliances. The flaws differ from the August‑19 authentication‑bypass CVE‑2026‑19490, which Citrix already fixed and CISA listed as a known exploited vulnerability. Details of the new bugs remain scarce; watchTowr said they were discovered during forensic investigations and that Citrix expects patches early in the week of September 28. Some organizations have already taken NetScaler devices offline based on supplier warnings, while others await official guidance. Enterprises with critical workloads consider risk unacceptable.

💡 Why It Matters

· The active exploitation of unpatched NetScaler gateways threatens the primary entry point for many corporate networks, forcing immediate operational decisions.

Capsules Cybersecurity

Read full article on thehackernews.com

CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

The U.S. Cybersecurity and Infrastructure Security Agency added two critical Citrix NetScaler ADC and Gateway vulnerabilities, CVE‑2026‑88771 and CVE‑2026‑88772, to its Known Exploited Vulnerabilities catalog after confirming active exploitation worldwide. CVE‑2026‑88771 affects all NetScaler ADC and Gateway deployments, while CVE‑2026‑88772 requires the DTLS configuration, which is enabled by default on VPN virtual servers. Citrix has released patches for versions below the affected releases and provided indicators of compromise. Federal agencies must apply fixes by September 30, 2026.

💡 The vulnerabilities expose a broad range of enterprise networks to remote code execution, forcing organizations to prioritize patching amid complex deployment environments. The alert underscores the urgency of addressing zero‑day exploits that can be leveraged by attackers to gain persistent, high‑level access.

thehackernews.com · Sep 28

JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

Microsoft identified an 18‑hour Azure breach in early June 2026, where the JADEPUFFER threat actor leveraged two compromised service principals to enumerate and delete resources. The attackers targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, App Services, and Virtual Machines, executing over 300 read operations and more than 150 destructive actions in a 35‑minute burst. Most storage accounts were deleted, though resource locks and deletion protection halted a few attempts. The compromise stemmed from a public GitHub leak of a service principal’s client secret.

💡 The incident demonstrates how exposed service principals can grant attackers sweeping administrative control, underscoring the critical need for secure credential handling and layered protection mechanisms in cloud environments.

openpr.com · Sep 28

TELECO Launches Managed IT and Cybersecurity Services for South Carolina Organizations

TELECO, Inc., a veteran business‑technology provider, announced on September 27, 2026 the rollout of a managed IT and cybersecurity service suite for organizations throughout South Carolina. The offering bundles help‑desk support, network and email threat detection, data backup and recovery, Microsoft 365 cloud tools, security‑awareness training, and virtual chief‑information‑officer guidance under a single contract. TELECO argues that integrating everyday IT assistance with proactive security reduces the dual burden of managing disparate vendors and mitigates the risk of outdated devices or mis‑configured accounts that can trigger both support tickets and breaches. By delivering findings in plain business language, the company aims to give South Carolina leaders clearer visibility into technology health, improve operational continuity, and protect critical data without diverting internal staff from core tasks.

💡 Consolidating support and security eliminates fragmented vendor management, giving midsize firms a single point of accountability that directly ties technology reliability to risk reduction.

straitstimes.com · Sep 27

Singapore shifts cyber strategy after UNC3886 attacks, deploys AI security tools

Singapore’s Cyber Security Agency (CSA) appointed Gwenda Fong as chief executive on July 1 and, in response to the July 2025 UNC3886 intrusion that threatened national‑critical infrastructure, launched a revamped cyber‑defence strategy. The agency, together with GovTech, has built and deployed in‑house artificial‑intelligence tools that automatically conduct penetration testing and monitor internal traffic across roughly 2,000 government systems. Fong emphasized a shift from pure perimeter defence to an “assume breach” posture, stressing continuous threat‑hunting and detection of anomalous behaviour to counter state‑backed advanced persistent threats. The AI suite aims to identify malicious movement within networks before attackers can access sensitive data, bolstering Singapore’s resilience against future incursions.

💡 By treating breaches as inevitable and automating internal threat detection, Singapore is pioneering a proactive model that could redefine how nations safeguard critical digital assets.

thehackernews.com · Sep 26

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser…

The Psychedelic Stealer, part of the Lunex malware‑as‑a‑service platform, infiltrates Ukrainian‑speaking users through compromised websites that employ ClickFix-style Cloudflare verification. The four‑stage attack begins with a fake CAPTCHA, delivers a loader that bypasses UAC via CMSTPLUA, exploits the vulnerable AMD Radeon driver CVE‑2023‑20598 for privilege escalation, and finally installs a C2 agent. The agent steals credentials from seven Chromium browsers, exfiltrates cryptocurrency wallets, and maintains persistence through a PowerShell‑based Native Messaging Host. The operation demonstrates a rare use of BYOVD for final payload delivery and shows rapid geographic expansion of Lunex panels.

💡 By weaponizing a legitimate driver flaw, attackers can silently disable security tools before deploying a stealthy stealer, revealing a new vector that bypasses traditional endpoint defenses. This technique underscores the evolving sophistication of MaaS platforms and the urgent need for updated driver hardening and monitoring.

thehackernews.com · Sep 26

Zero Trust for AI Agents Starts With Fixing Zero Visibility

Security experts are warning that rapid deployment of AI agents has outpaced visibility, leaving many workflows unchecked. A recent intrusion at Hugging Face during an OpenAI‑agent evaluation highlighted the risk of unchecked access to sensitive data. Veeam research shows 70 % of firms have AI processes touching confidential information without full oversight, and 67 % cannot track autonomous workflows created by employees. The article argues that Zero Trust for AI must begin with inventory and identification before any enforcement or authorization layers are applied. Skipping this step creates a “proxy” that cannot enforce policies on unknown agents. It outlines three visibility challenges—shadow AI, undefined ownership, and unclear scope—and offers mitigation steps for defenders. organizations can adopt these steps to cut risk significantly.

💡 Without an inventory of AI agents, security controls operate blind, turning Zero Trust into a false promise.