Swarming Against Citrix 0-Day Exploitation

As cited

Copy frozen at 2026-09-28 18:31 UTC (site build).

vulnerabilities

Swarming Against Citrix 0-Day Exploitation

On September 24, 2026, a threat actor at IP address 149.104.78.141 attempted to exploit a zero-day vulnerability in Citrix NetScaler Gateway before public disclosure. GreyNoise detected the malicious behavior through behavioral analysis despite the absence of CVE-specific signatures at that time.

Why it matters: Security teams running Citrix NetScaler Gateway need to know that zero-day attacks are occurring in the wild, and behavioral detection tools can identify exploitation attempts when signature-based defenses are unavailable.

Source published

2026-09-28 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-28 17:31 UTC