NetScaler Zero-Days Hit Government and Finance Orgs

NetScaler zero-days exploited for weeks against government and finance

The lead story today is Citrix NetScaler. SecurityWeek and Help Net Security both report weeks-long attacks against government and finance organizations using NetScaler zero-days, tracked as CVE-2026-88771 and CVE-2026-88772. Help Net Security attributes the activity to suspected state-sponsored actors and dates exploitation back to early September.

CVE-2026-88771 is a Critical severity NetScaler Application Delivery Controller flaw with a CVSS of 9.8 and is already on the CISA KEV list. If you run NetScaler ADC or Gateway exposed to the internet, treat this as patch now, not patch later, and review your appliances for signs of compromise given exploitation predates public disclosure.

New to the CISA KEV catalog

CISA added one new vulnerability to its Known Exploited Vulnerabilities catalog on September 29. It is CVE-2026-86950, an out-of-bounds write affecting multiple Apple products, with a CVSS of 8.8. It is not ransomware-linked, but KEV listing means confirmed active exploitation, so move Apple device patching to the front of the queue across your managed fleet.

Hot movers worth your attention

Several KEV-listed CVEs are seeing heavy exploitation signal. Two carry ransomware links, which is the clearest reason to act fast:

• CVE-2026-63077, JetBrains TeamCity deserialization, Critical severity, CVSS 9.8, KEV listed and ransomware-linked, EPSS 0.8957.
• CVE-2026-41940, WebPros cPanel and WHM missing authentication, Critical severity, CVSS 9.8, KEV listed and ransomware-linked, EPSS 0.9853.
• CVE-2024-27199, an older JetBrains TeamCity path traversal, High severity, KEV listed and ransomware-linked, with an EPSS of 0.9999.
• CVE-2026-71362, Adobe Commerce and Magento incorrect authorization, Critical severity, CVSS 9.1, KEV listed, EPSS 0.8751.
• CVE-2026-65660, Microsoft SharePoint code injection, Critical severity, CVSS 9.3, KEV listed.

What the press adds for Microsoft 365 and Entra admins

Two items hit close to home. BleepingComputer reports that Microsoft will begin blocking Entra ID script injection attacks starting in October, so expect behavior changes and plan to test any affected customizations.

Cyber Security News describes attackers breaking into Microsoft 365 through forgotten accounts nobody was watching, and a separate report on turning a single compromised account into access to Azure DevOps and Kubernetes. Both point at the same weakness: stale identities and over-scoped access. Senserva's Three Free Unlimited Audits let you run a complete check of your own Microsoft 365, Intune, Defender, and Entra ID environment to surface dormant and over-privileged accounts.

Elsewhere, OpenSSL fixed a High severity flaw, CVE-2026-84782, that can leak server memory in plaintext, and OpenInfra Europe's JFrog Artifactory instance was breached with packages potentially compromised, tracked as CVE-2026-82329. If you pull dependencies from affected sources, verify integrity.

Do this first

Prioritize by exploitation evidence, not just CVSS.

• Patch internet-facing Citrix NetScaler for CVE-2026-88771 and CVE-2026-88772, then hunt for compromise given early-September activity.
• Apply the Apple update for CVE-2026-86950, newly KEV listed.
• Patch the ransomware-linked bugs: TeamCity CVE-2026-63077 and CVE-2024-27199, and cPanel CVE-2026-41940.
• Install this month's Windows cumulative updates. KB5046616 for Windows Server 2022 and KB5046617 for Windows 11 24H2 ARM64 each address dozens of CVEs and are flagged KEV-relevant.
• Audit Entra ID and Microsoft 365 for stale accounts ahead of the October script injection blocking change.
• Use Senserva's free Microsoft Patch Tracker to rank your open patches by KEV, EPSS, and ransomware linkage.

Sources

• Cyber Security News: Hackers Broke Into Microsoft 365 Through Forgotten Accounts Nobody Was Watching (2026-09-30)
• SecurityWeek: Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks (2026-09-30)
• Help Net Security: Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) (2026-09-30)
• BleepingComputer: Microsoft to block Entra ID script injection attacks starting October (2026-09-30)
• Cyber Security News: OpenSSL Fixes High-Severity Flaw That Can Leak Server Memory in Plaintext (2026-09-30)
• Help Net Security: OpenInfra Europe’s JFrog Artifactory instance breached, packages potentially compromised (2026-09-30)
• CISA Cybersecurity Advisories: CISA Adds One Known Exploited Vulnerability to Catalog (2026-09-29)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-01.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.