DanSec

Vendor

Citrix

In 43 briefs, most recently 4 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

27 Citrix vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 7 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Binance $6.34B theft by North Korean actors, Beget cloud wipe, and a cPGuard supply chain backdoor.
  2. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  3. ASOS customer data theft, the FakeGit GitHub malware campaign with 17,000+ repos, and Flax Typhoon disruption by the FBI, plus new exploited flaws.
  4. The Denmark CPR breach of 8.8M people, Citrix NetScaler zero-day CVE-2026-88779, and the ShinyHunters leader's arrest in Jordan.
  5. Bitget $387.5M zero-day theft, Pentagon DMDC breach of 3M+ service members' records, and Zammad zero-day chain hitting DIVD, plus Citrix and Cisco exploitation.
  6. Bitget's $387.5M breach via a zero-day, actively exploited Citrix NetScaler flaws, and Star Blizzard phishing campaigns hitting over 100 organizations.
  7. The $350M Bitget crypto exchange breach, Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 under active exploitation, and ShinyHunters' Oracle …
  8. Citrix NetScaler zero-days under active exploitation, ShinyHunters abusing Oracle PeopleSoft CVE-2026-35273, and Microsoft SharePoint CVE-2026-65660 added to …
  9. AdaptHealth breach hits 4.1M people, Trezor users targeted by phishing, Veradigm patient data leak; plus Fortinet and Cisco exploits.
  10. IDScan breach exposing 153M driver's licenses, rogue AI agents hijacking a German wiki, and actively exploited Citrix NetScaler flaw.
  11. Manchester Airports Group breach, ShinyHunters leaking 13M Carhartt accounts, and critical unauthenticated RCE flaws patched in Next.js.
  12. ClarityCheck leaks 9M face images, Operation CameraSwarm hijacks 14,000 Dahua cameras, and GitLab flaw CVE-2026-19478 is exploited.
  13. Adobe ColdFusion RCE exploitation, a River Bank & Trust data breach, and Armored Likho APT intrusions in Russia, Brazil and Kazakhstan.
  14. Google and FBI disrupt NetNut proxy network, Scattered Spider suspect extradited, and Pegasus spyware hits EU Parliament investigators; plus Cursor and WinRAR …
  15. The Medtronic data breach by ShinyHunters, exposed Oracle E-Business Suite instances under attack, and Scattered Spider arrest news.
  16. Aflac Japan breach hits 4.38M customers, Nissan PeopleSoft campaign and Nidec $2M Blackfield extortion.
  17. Drift DEX's $285M North Korea-attributed heist, the Axios npm supply chain compromise, and the TeamPCP campaign hitting European Commission cloud systems.
  18. Citrix NetScaler CVE-2026-3055 exploited, ShinyHunters claims 350GB European Commission theft, and Iranian hackers breach FBI director Kash Patel's personal …
  19. Iran-linked hackers hit FBI chief Kash Patel's email and Stryker; Citrix NetScaler CVE-2026-3055 under recon; Infinity Stealer targets macOS.
  20. LeakBase admin arrest, HackerOne employee data breach via Navia, and Microsoft 365 device code phishing hitting 340+ organizations.
  21. Infinite Campus and HackerOne breaches, TeamPCP's LiteLLM PyPI supply chain attack, and malvertising abusing a Huawei driver to kill EDR.
  22. Mazda security incident, Crunchyroll's alleged 6.8M-user breach, and the TeamPCP Trivy supply chain attack with Kubernetes wipers.
  23. The Oracle EBS data theft fallout, Operation Endgame takedowns, and actively exploited Fortinet and WatchGuard flaws in today's cybersecurity news.
  24. Citrix Bleed 2 and Cisco ISE zero-day exploitation, the Synnovis ransomware data breach, and a 67,000-package npm spam worm.
  25. F5 breach, Muji ransomware outage via Askul, AWS two-hour outage, and Salt Typhoon's Snappybee attack on a European telecom, plus GlassWorm and WatchGuard …
  26. Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
  27. Miljödata breach disrupts 200+ Swedish municipalities; Citrix NetScaler flaw CVE-2025-7775 exploited; Salesforce data theft via Salesloft Drift OAuth tokens.
  28. Nevada state government cyberattack shuts offices; Salesloft Drift token breach exposes Salesforce data; Citrix NetScaler zero-day CVE-2025-7775 patched.
  29. Farmers Insurance 1.1M-person breach via Salesforce attacks, BianLian's Aspire Rural Health breach, and Docker Desktop container escape CVE-2025-9074 (CVSS …
  30. The Allianz Life Salesforce data theft, unpatched Citrix NetScaler CitrixBleed 2 exposure, and the Charon ransomware campaign against Middle East public sector …
  31. Connex Credit Union breach hits 172,000 members; Citrix NetScaler CVE-2025-6543 exploited against Dutch critical orgs; BlackSuit ransomware infrastructure …
  32. NCSC attributes Microsoft 365 Authentic Antics malware to APT28, CrushFTP zero-day hijacks servers, and Google sues BADBOX 2.0 botnet operators.
  33. The $27M BigONE crypto exchange breach, Salt Typhoon's nine-month Army National Guard intrusion, and Cisco ISE CVE-2025-20337 (CVSS 10) with other …
  34. Louis Vuitton and McDonald's data breaches, Gravity Forms WordPress plugin supply chain attack, and Gigabyte UEFI firmware flaws enabling Secure Boot bypass.
  35. The McHire chatbot data exposure of 64M applicants, the Gravity Forms supply-chain backdoor, and Wing FTP Server and FortiWeb exploitation.
  36. UK arrests over Scattered Spider attacks on M&S, Co-op and Harrods; Qantas breach hits 5.7M customers; Citrix NetScaler CVE-2025-5777 added to KEV.
  37. M&S ransomware by DragonForce, the SK Telecom breach exposing 27 million records, and the BaitTrap fake news investment fraud network.
  38. Ingram Micro ransomware outage, Qantas extortion over 6 million customer records, and a $140M theft from six Brazilian banks.
  39. Qantas breach hits 6M customers, Cisco Unified CM hardcoded root SSH backdoor patched, and Gamaredon spearphishing Ukraine. Plus Scattered Spider and NimDoor.
  40. Swiss federal data exposed via Radix ransomware breach, Scattered Spider targets airlines, and over 1,200 unpatched Citrix NetScaler servers under active …
  41. Ahold Delhaize breach hits 2.2M people, Cloudflare mitigates record DDoS, Russia throttles Cloudflare, Citrix Bleed 2 exploited.
  42. Citrix NetScaler 'CitrixBleed 2' exploitation, Cyber Fattah's leak of 2024 Saudi Games data, and arrests of BreachForums operators in France.
  43. The McLaren Health Care breach (743,000 patients), Citrix NetScaler patches, and Salt Typhoon's breach of Canadian telecoms via a Cisco flaw.