Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
New THOR Detection Coverage for Citrix NetScaler CVE-2026-88771 and CVE-2026-88772
Excerpt
On September 27, 2026, Citrix published security bulletin CTX697096 covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway. This post focuses on CVE-2026-88771, an unauthenticated command execution vulnerability affecting default deployments, and CVE-2026-88772, a DTLS memory overflow vulnerability that can lead to remote code execution or denial of service. Citrix states that exploitation of both vulnerabilities has been observed on unmitigated systems.…
Read the original report →Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-88772 | High | Score 82/100 | First seen |
| CVE | CVE-2026-88778 | High | Score 74/100 | First seen |
| CVE | CVE-2026-88771 | High | Score 82/100 | First seen |
| CVE | CVE-2025-6543 | Medium | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…