Threat Advisory: Citrix & Oracle Flaws Actively Exploited

Executive Summary

A September 30, 2026 threat forecast warns of a convergence of critical remote code execution (RCE) vulnerabilities being actively exploited against internet-facing enterprise systems. The most immediate threats are two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772. Both flaws were exploited before patches were available and have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Simultaneously, the threat group ShinyHunters (UNC6240) has re-weaponized a critical vulnerability in Oracle PeopleSoft, CVE-2026-35273, using new techniques to bypass Web Application Firewalls (WAFs). Organizations are urged to treat any unpatched, internet-facing NetScaler and PeopleSoft instances as compromised and prioritize immediate patching and investigation.

Vulnerability Details

Citrix NetScaler ADC & Gateway

• CVE-2026-88771 & CVE-2026-88772: These are two distinct zero-day vulnerabilities affecting Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway products.
• Impact: Both vulnerabilities allow for unauthenticated Remote Code Execution (RCE), enabling an attacker to take full control of an affected appliance.
• CVSS Score: Both are rated 9.5 (Critical).
• Exploitation Status: Confirmed to be actively exploited in the wild before patches were released. CISA added both to its KEV catalog on September 27, with a remediation deadline of September 30 for federal agencies.

Oracle PeopleSoft

• CVE-2026-35273: A critical vulnerability in Oracle's PeopleSoft enterprise resource planning (ERP) software.
• Impact: Allows for unauthenticated Remote Code Execution.
• CVSS Score: 9.8 (Critical).
• Exploitation Status: After initial mass exploitation in May/June 2026, the ShinyHunters group has developed a new exploit variant that reportedly bypasses common WAF rules, leading to a renewed wave of attacks.

Affected Systems

• Citrix: A wide range of Citrix NetScaler ADC and Gateway versions are affected. Administrators must consult the Citrix security bulletin for a complete list of vulnerable builds.
• Oracle: Oracle PeopleSoft instances, particularly those that are internet-facing. The renewed attacks are targeting technology, healthcare, and government sectors in addition to the previously targeted higher education institutions.

Exploitation Status

All three vulnerabilities are under active and widespread exploitation. The Citrix flaws are being used as zero-days, indicating sophisticated threat actors. The re-weaponization of the PeopleSoft flaw by a known group like ShinyHunters suggests a focused campaign to steal data from high-value ERP systems. The combination of these perimeter and application-level RCEs creates a highly dangerous environment for defenders.

Impact Assessment

The compromise of these systems can lead to severe consequences:

• Full System Takeover: RCE on perimeter appliances like NetScaler provides a powerful foothold for attackers to pivot into the internal network.
• Data Theft: Compromise of PeopleSoft ERP systems can lead to the theft of massive amounts of sensitive data, including financial records, employee PII, and proprietary business information.
• Ransomware Deployment: Threat actors often use such access to deploy ransomware across the victim's network.
• Unified "Intrusion Economy": Attackers can chain these exploits, using the NetScaler RCE for initial access, the PeopleSoft exploit for data theft, and then leveraging that access to compromise connected cloud environments.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Vulnerability Scanners: Use up-to-date vulnerability scanners to identify unpatched Citrix and Oracle systems in your environment.
• Log Analysis: Ingest and analyze web server logs from NetScaler and PeopleSoft systems into a SIEM. Search for IOCs and exploit patterns published by Citrix, Oracle, and security researchers. This is an application of D3-NTA: Network Traffic Analysis.
• Endpoint Detection and Response (EDR): While EDR may have limited visibility on network appliances, it is critical for detecting post-exploitation activity on PeopleSoft application servers, such as suspicious process creation or command-line activity.

Remediation Steps

1. PATCH IMMEDIATELY: This is the highest priority. Apply the security updates provided by Citrix and Oracle to all affected systems. Due to active exploitation, this should be treated as an emergency change.
2. Assume Compromise: For any internet-facing, unpatched systems, assume they are already compromised. Isolate them from the network and begin a forensic investigation.
3. Hunt for Malicious Activity: Use the observables and detection methods above to hunt for signs of compromise.
4. Rotate Credentials: If a compromise is suspected or confirmed, rotate all credentials associated with the affected systems.
5. Restrict Access: If patching is not immediately possible, restrict all access to the management interfaces of these systems to a small set of trusted IP addresses. This is a temporary compensating control, not a substitute for patching.