Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: dos

Citrix patches NetScaler SAML zero-day exploited in attacks

Posted on October 5, 2026 by Kyle

Overview

Citrix has issued emergency updates to address CVE-2026-88779, a denial-of-service (DoS) vulnerability affecting NetScaler (formerly ADC and Gateway) appliances. This flaw, specifically impacting the SAML component, is actively being exploited in zero-day attacks. While confirmed for DoS, the potential for remote code execution (RCE) is under investigation, making immediate patching critical for organizations utilizing these appliances.

Technical Analysis

CVE-2026-88779 is a denial-of-service vulnerability impacting Citrix NetScaler appliances when configured to use SAML. The specific mechanism of the DoS is not publicly detailed, but it has been observed in active exploitation. Researchers are currently assessing whether the vulnerability can also be leveraged for remote code execution, which would significantly escalate its impact. The vulnerability affects NetScaler appliances running specific versions, for which patches have been released.

Detection

  • Monitor NetScaler appliance logs for unusual activity related to SAML authentication, including high volumes of failed or malformed SAML requests.
  • Look for unexpected process creation originating from NetScaler service accounts or web server processes (e.g., httpd, nginx, or NetScaler-specific processes) that spawn shell processes (sh, bash, cmd.exe, powershell.exe).
  • Observe network traffic for anomalous outbound connections from NetScaler appliances, which could indicate post-exploitation command and control (C2) activity.
  • Review system resource utilization on NetScaler appliances for sudden spikes indicative of a DoS attack.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

NetScaler Web Server Spawning Shell (Potential RCE)

title: NetScaler Web Server Spawning Shell (Potential RCE)
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects a web server process (common on appliances) spawning a shell, indicative of successful remote code execution on a vulnerable NetScaler appliance.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: 
      - '/usr/sbin/httpd'
      - '/usr/local/sbin/nginx'
      - '/opt/citrix/netscaler/bin/nsd'
      - '/opt/citrix/netscaler/bin/httpd'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/python'
      - '/usr/bin/perl'
      - '/usr/bin/php'
  condition: selection
level: critical

Mitigations

  1. Apply Patches Immediately: Install the latest security updates provided by Citrix for NetScaler appliances. This is the primary and most effective mitigation.
  2. Monitor Appliance Logs: Implement robust logging and monitoring for NetScaler appliances, focusing on SAML authentication events and process execution.
  3. Network Segmentation: Isolate NetScaler appliances on a dedicated network segment to limit potential lateral movement in case of compromise.
  4. Web Application Firewall (WAF): Deploy a WAF in front of NetScaler appliances to inspect and potentially block malicious SAML requests, although specific patterns for this zero-day may not be immediately available.

References

  • https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,513 input / 1,028 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged citrix, critical, dos, netscaler, rce, saml, vulnerability, zero-dayLeave a comment

TDengine Zero-Day Vulnerability: Single-Packet DoS

Posted on September 28, 2026 by Kyle

Overview

A high-severity zero-day vulnerability has been identified in the TDengine time-series database. This flaw allows an unauthenticated attacker to trigger a Denial of Service (DoS) condition by sending a single, specially crafted network packet to a vulnerable server. Organizations in industrial, IoT, energy, and automotive sectors utilizing TDengine are at risk, as successful exploitation can lead to the abrupt crash of critical operational technology (OT) servers.

Technical Analysis

  • Vulnerability Type: Zero-day Denial of Service (DoS).
  • Affected Product: TDengine time-series database.
  • Affected Versions: Specific affected versions are not publicly detailed at the time of writing, but as a zero-day, it is presumed to impact current and recent versions until a patch is released.
  • Attack Vector: Network-based. An unauthenticated attacker can exploit this vulnerability by sending a single malformed packet to the TDengine server’s listening port (default 6030/TCP).
  • Impact: Successful exploitation results in the immediate crash of the TDengine server process, leading to a complete Denial of Service for any applications relying on the database.
  • Prerequisites: Direct network access to the TDengine server’s listening port.

Detection

  • Network Monitoring: Look for unusual or malformed network traffic directed at TDengine server ports (e.g., 6030/TCP). While specific packet signatures are unknown, an IDS/IPS might flag anomalous packet structures.
  • Host-Based Logging: Monitor TDengine server hosts for unexpected process terminations of the taosd process. Look for non-zero exit codes or service failures not associated with planned shutdowns.
  • System Logs: Review system logs (e.g., syslog, journalctl on Linux, Event Logs on Windows) for entries indicating crashes, core dumps, or service failures related to taosd.
  • Application Logs: Check TDengine’s own logs for critical error messages immediately preceding a server crash.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

TDengine Server Unexpected Process Termination

title: TDengine Server Unexpected Process Termination
id: 88c2b1e0-a1f2-4c3e-8b1e-f1c2b3e4a5d6
status: experimental
description: Detects unexpected termination of the TDengine server process (taosd) on Linux, which could indicate a successful DoS attack or other critical issue.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    syscall: 'exit_group'
    exe|endswith: '/taosd'
    a0|!startswith: '0' # Exit code is not 0 (indicating abnormal termination)
  condition: selection
level: high

Mitigations

  1. Network Segmentation and Access Control: Restrict network access to TDengine servers to only essential, authorized systems and personnel. Implement strict firewall rules to limit inbound connections to the TDengine port (6030/TCP) from untrusted networks.
  2. Continuous Monitoring: Implement robust monitoring for TDengine server availability and performance. Alert on unexpected service interruptions or process crashes.
  3. Vendor Patching: Monitor official TDengine channels for security advisories and patches addressing this vulnerability. Apply updates promptly once available.
  4. Anomaly Detection: Deploy network anomaly detection systems to identify unusual traffic patterns or malformed packets targeting OT assets.

References

  • https://www.darkreading.com/ics-ot-security/one-packet-crash-servers-tdengine

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1499 — Endpoint Denial of Service
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,471 input / 1,019 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged dos, high, ics, ot, tdengine, vulnerabilityLeave a comment

CVE-2026-88772: Citrix NetScaler RCE/DoS Vulnerability

Posted on September 27, 2026 by Kyle

Overview

CVE-2026-88772 identifies an improper restriction of operations within the bounds of a memory buffer vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. This vulnerability poses a critical risk, allowing unauthenticated remote attackers to achieve remote code execution (RCE) or cause a denial of service (DoS) on affected appliances. Immediate patching is crucial for all organizations utilizing these products.

Technical Analysis

This vulnerability, classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), exists in specific versions of Citrix NetScaler ADC and NetScaler Gateway. Exploitation can lead to either full remote code execution, granting an attacker arbitrary control over the appliance, or a denial of service, rendering the device inoperable.

  • Affected Products: Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • Affected Versions:
    • ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP.
    • Gateway: before 14.1-73.37 and before 13.1-64.23.
  • Impact: Remote Code Execution (RCE) or Denial of Service (DoS).
  • Attack Vector: Network-based, likely exploiting a service exposed by the NetScaler appliance.

Detection

Detecting exploitation of CVE-2026-88772 requires vigilant monitoring of NetScaler appliance logs and behavior. Look for the following indicators:

  • Unexpected Process Creation: Monitor for the creation of unusual or unauthorized processes on the NetScaler appliance, especially shell processes (sh, bash, cmd.exe, powershell.exe) or other executables spawned by NetScaler services.
  • Abnormal Resource Utilization: Sudden and sustained spikes in CPU, memory, or network traffic on the NetScaler appliance, potentially indicating a DoS attack or resource-intensive RCE payload execution.
  • Suspicious Log Entries: Review NetScaler system logs for error messages, crashes, or unusual access patterns that deviate from baseline behavior.
  • Network Anomalies: Monitor network traffic to and from the NetScaler for unusual connections, data exfiltration attempts, or command-and-control (C2) communications originating from the appliance.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Citrix NetScaler – Suspicious Process Creation (Linux)

title: Citrix NetScaler - Suspicious Process Creation (Linux)
id: 00000000-0000-4000-8000-000000000001
status: experimental
description: Detects suspicious process creation on a Linux-based Citrix NetScaler appliance, indicative of potential RCE exploitation. This rule targets common shell or utility execution from NetScaler-related parent processes.
logsource:
  product: linux
  service: auditd
detection:
  selection_parent:
    - ParentProcessName|contains: 'netscaler'
    - ParentProcessName|contains: 'nsd'
    - ParentProcessName|contains: 'httpd'
  selection_child:
    - ProcessName|endswith: ['sh', 'bash', 'dash', 'zsh', 'python', 'perl', 'php', 'nc', 'wget', 'curl', 'chmod', 'chown', 'rm', 'mkdir', 'tar', 'unzip', 'openssl']
    - CommandLine|contains: ['/bin/sh', '/bin/bash', '/usr/bin/python', '/usr/bin/perl', 'wget ', 'curl ']
  condition: selection_parent and selection_child
level: critical

Mitigations

Prioritize the following actions to mitigate the risk posed by CVE-2026-88772:

  1. Apply Patches Immediately: Upgrade all affected Citrix NetScaler ADC and Gateway appliances to the patched versions as recommended by Citrix. Refer to the official Citrix security bulletin for specific update instructions.
  2. Network Segmentation and Access Control: Restrict network access to NetScaler management interfaces and critical services to only trusted IP addresses and necessary personnel. Implement strict firewall rules.
  3. Regular Backups: Ensure regular and verified backups of NetScaler configurations and system images to facilitate rapid recovery in case of a successful DoS attack or compromise.
  4. Enhanced Monitoring: Implement robust logging and monitoring solutions for NetScaler appliances, forwarding logs to a SIEM for real-time analysis and alerting on suspicious activities.

References

  • https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-88772

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1499 — Endpoint Denial of Service
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,876 input / 1,460 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged citrix, critical, dos, netscaler, rce, vulnerabilityLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.