Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
The NetScaler Zero-Day Siege and Pre-Auth RCE Chains : Technical Analysis and Exposure Assessment
Malware Families
Excerpt
Blog October 2, 2026 Vulnerability The NetScaler Zero-Day Siege and Pre-Auth RCE Chains: Technical Analysis and Exposure Assessment On September 27, 2026, Citrix published bulletin CTX697096 with eight NetScaler ADC and Gateway vulnerabilities . Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited before fixed builds existed. Both give remote code execution to an unauthenticated attacker. CISA added both to the KEV catalog the same day and gave federal…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-19490 | Medium | Score 56/100 | First seen |
| CVE | CVE-2026-88773 | High | Score 61/100 | First seen |
| CVE | CVE-2026-88772 | High | Score 82/100 | First seen |
| CVE | CVE-2026-88778 | High | Score 74/100 | First seen |
| CVE | CVE-2026-88771 | High | Score 82/100 | First seen |
| CVE | CVE-2026-19489 | Medium | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…