The number of observables was getting wacky enough that the tiny table in the OP was pointless. Removed, but all observable references are in the post. The MISP feed has everything.
2 Likes
watchTowr’s analysis of CVE-2026-88772:
2 Likes
Hang onto your hats, looks like the fix may have been incomplete.
Edit: moved to independent post
2 Likes
Unrelated, CISA has put out a SIGMA rule related to last weekend’s vulns, haven’t had time to see if it parses any new IOCs or not.
Vendor advisory: https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/
3 Likes
Post updated with new observables from Reddit.
Independent report of attempted exploit, taken from the same reddit thread Kevin referenced yesterday. Seems there could be multiple states:
- Auth request to download first stage (indicates attempt, does not indicate success/fail)
- First stage on disk (indicates first stage download, does not indicate whether run)
- Changes to apache/cron, webshell files (indicates first stage ran)
- HTTP PUTs to known infrastructure or associated logs (indicates data exfil)
1 Like
Per that reddit post, patch is out as of about an hour ago.
1 Like
Added new advisory and patched versions.
1 Like
