Citrix NetScaler

Vulnerability

Threat entity extracted from intelligence sources

Entities›vulnerability›Citrix NetScaler

Frequency

occurrences

First Seen

November 12, 2025

Last Seen

September 19, 2026

API

Overview

Recent Events

Profile

1 / 2

REC

Recon

No techniques detected

Resource Dev

No techniques detected

Initial Access

T1190 - Exploit Public-Facing ApplicationT1078 - Valid AccountsT1133 - External Remote ServicesT1566.001 - Spearphishing Attachment

Execution

T1203 - Exploitation for Client ExecutionT1059 - Command and Scripting Interpreter

Persistence

T1505.003 - Web Shell

Priv Esc

T1068 - Exploitation for Privilege Escalation

Defense Evasion

T1036.002 - Right-to-Left Override

Cred Access

T1003 - OS Credential DumpingT1110 - Brute ForceT1552.001 - Credentials In Files

Discovery

T1082 - System Information DiscoveryT1083 - File And Directory Discovery

Lateral Mov

T1021 - Remote Services

Collection

T1005 - Data From Local System

T1071 - Application Layer ProtocolT1105 - Ingress Tool Transfer

Exfil

T1041 - Exfiltration Over C2 ChannelT1567.002 - Exfiltration to Cloud Storage

Impact

T1486 - Data Encrypted for Impact

24 techniques detected across 12 tactics

Related Clusters (22)

SonicWall SMA1000 Faces Critical Zero-Day Exploitation

Sep 2·178 sources

Advanced Threat Actor Exploits Cisco and Citrix Zero-Day Vulnerabilities

Nov 12·8 sources

Resurgence of Exploitation Attempts on GlobalProtect and CitrixBleed Vulnerabilities

Jul 8·2 sources

AI Infrastructure Under Siege: Session Hijacking and Exploits Surge

Sep 5·5 sources

Critical Exploitation of Ruby on Rails Vulnerability CVE-2026-66066 Confirmed

Aug 31·5 sources

Critical Vulnerabilities in Citrix NetScaler ADC and Gateway Require Immediate Patching

Mar 23·30 sources

LockBit Ransomware Targets ICBC Financial Services and U.S. Bank

Aug 20·10 sources

APT Exploits Zero-Day Vulnerabilities in Cisco and Citrix Systems

Nov 18·16 sources

RansomHouse Targets Namibian Defence Ministry in Cyberattack

Sep 19·10 sources

DeepSeek AI Used in Autonomous Cyberattack Campaign by Chinese Threat Actor

Aug 2·12 sources

HTTP Terminator Reveals New Attack Techniques in Cybersecurity Research

Aug 12·3 sources

Ransomware Attack in Pennsylvania Exposes Personal and Medical Data

Nov 18·43 sources

Shift in Ransomware Tactics Targeting Cloud Assets

Nov 19·56 sources

Pennsylvania AG Confirms Ransomware Data Breach by INC Group

Nov 18·2 sources

Reconnaissance Campaign Targets Citrix NetScaler Infrastructure

Feb 4·3 sources

Overview of Web Application Firewalls (WAFs) and Their Importance

Sep 15·2 sources