predictive threat intelligence

platformmodulesCapabilitiesResources
Request Trial

THREAT ALERT:

Augur Monitoring

Active exploitation of

Citrix NetScaler Zero-day

‍

Threat Research Team
Download PDF

Citrix has confirmed active, in-the-wild exploitation of two critical zero-day vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway. CVE-2026-88771 and CVE-2026-88772 both carry a CVSS v4 score of 9.5, and both allow remote code execution. CVE-2026-88771 does not require authentication or an additional feature to be enabled on affected builds, which means appliances in their default configuration are exposed. CISA added both to its Known Exploited Vulnerabilities catalog on September 27, 2026. 

‍

The exposure is broad. These appliances sit at the network edge, handling VPN, remote access, and authentication, and Citrix says that every NetScaler ADC and NetScaler Gateway deployment is affected by at least one of the eight flaws in the bulletin. Fixed builds (14.1-73.37 and 13.1-64.23, plus FIPS editions) are available now. Organizations should upgrade immediately and check for signs of prior compromise, since patching alone does not evict an attacker who already has access. 

‍

What Augur is Doing

We strongly suspect we already have predictive coverage of the infrastructure tied to this activity. Our research team is in the process of confirming that now. 

‍

In parallel, we’re working directly with our clients to mitigate the impact. 

‍

More to come soon.

‍

For the full vulnerability details from Citrix: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

‍

The Augur Difference. Let Us Prove It To You.

Experience firsthand the benefits of preemptive cyber defense with a quick proof of value (POV). We can have you up and running in less than a day, and after 30 days, get an Augur report detailing:

  • Threats Augur identified
  • Advance warning timelines
  • Data-driven insight on alert reduction and improved SOC efficiency

‍

Click here to talk to an Augur specialist now.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Subscribe for early access to threat intelligence insights and updates.

© 2026 Augur Security, Inc,

Close Modal
Close Modal

See Malicious Infrastructure Before It Becomes an Attack

Traditional cybersecurity reacts after attackers deploy infrastructure, weaponize domains, or compromise environments, relying on post-compromise indicators, reactive threat feeds, and detection-based security models. Augur identifies malicious infrastructure before weaponization using predictive threat intelligence built from global internet telemetry, infrastructure attribution modeling, and machine learning-based behavioral analysis of attacker infrastructure across DNS, BGP, and hosting signals.In 2025 alone, Augur identified more than 423,000 emerging threats with an average lead time of 7 days ahead of traditional intelligence sources and a false-positive rate of just 0.007%..

Request a trial of Augur to see how far ahead your security team could be operating.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.