Citrix NetScaler ADC/Gateway Zero-Days Under Active Global Exploitation
Citrix confirmed two critical remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway—CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5)—that attackers have been exploiting as zero-days. CVE-2026-88771 is an improper input validation flaw allowing unauthenticated command execution on default configurations. CVE-2026-88772 is a memory overflow that can lead to RCE or denial-of-service when DTLS is enabled (the default on many VPN virtual servers).
CISA added both to its Known Exploited Vulnerabilities catalog and urged immediate action. Patches are available in builds such as 14.1-73.37 and 13.1-64.23 (plus corresponding FIPS/NDcPP versions). Organizations are advised to check for compromise indicators before or while patching, as some admins reportedly took appliances offline over the weekend. NetScaler devices sit at the network edge for VPN, load balancing, and authentication, so successful exploitation gives attackers a strong foothold.
What to do: Inventory NetScaler instances, apply the fixed builds urgently, review logs for anomalous activity, and consider temporary isolation of unpatched appliances if feasible.
JADEPUFFER (Storm-3168) Uses Compromised Azure Service Principals for Destructive Cloud Attacks
Microsoft detailed activity by the threat actor tracked as JADEPUFFER (Microsoft: Storm-3168), previously linked to agentic ransomware operations. In one observed incident, attackers leveraged compromised Azure service principals to perform extensive reconnaissance followed by bulk destructive actions—deleting storage accounts, targeting Key Vaults, Function Apps, VMs, App Services, and more—within roughly 18 hours in a single environment.
The activity highlights the growing risk of non-human identities: service principals with broad permissions enable rapid lateral movement and damage without traditional user credentials. Resource locks and deletion protection blocked some attempts, underscoring the value of those controls.
What to do: Audit service principal permissions and lifetimes, enforce least privilege and just-in-time access, monitor for unusual enumeration or deletion patterns, and enable independent safeguards such as resource locks.
Kiteworks Issues (and Later Lifts) Precautionary Server Shutdown Advisory
Kiteworks (formerly Accellion) notified customers of credible threat intelligence from federal/law-enforcement sources indicating a possible imminent targeting of some customer systems, potentially via unknown zero-day paths. The company recommended a temporary precautionary shutdown window (initially described as several hours over the weekend) while it worked with authorities. No confirmed compromise of Kiteworks or customer systems was reported.
The shutdown recommendation was later lifted (as of September 27). Customers were urged to ensure they are running the latest release (9.5.1), which addresses all known vulnerabilities. The episode was unusual because it asked organizations to power down production managed-file-transfer systems without a public CVE or confirmed breach.
What to do: Confirm systems are on the current supported version, review access logs, and maintain heightened monitoring of file-transfer and content-collaboration platforms.
These three stories illustrate the current threat landscape: edge-device zero-days that hit hard and fast, identity abuse in the cloud (especially non-human identities), and proactive vendor responses driven by intelligence sharing. Stay patched, monitor identities, and treat edge and cloud management planes as high-value targets.