Threat Advisory: Citrix & Oracle Flaws Actively Exploited
Citrix Zero-Days and Oracle PeopleSoft Flaw Under Active Exploit
Related Entities
Threat Actors
Products & Tech
CVE Identifiers
Full Report
Executive Summary
A September 30, 2026 threat forecast warns of a convergence of critical remote code execution (RCE) vulnerabilities being actively exploited against internet-facing enterprise systems. The most immediate threats are two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772. Both flaws were exploited before patches were available and have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Simultaneously, the threat group ShinyHunters (UNC6240) has re-weaponized a critical vulnerability in Oracle PeopleSoft, CVE-2026-35273, using new techniques to bypass Web Application Firewalls (WAFs). Organizations are urged to treat any unpatched, internet-facing NetScaler and PeopleSoft instances as compromised and prioritize immediate patching and investigation.
Vulnerability Details
Citrix NetScaler ADC & Gateway
- CVE-2026-88771 & CVE-2026-88772: These are two distinct zero-day vulnerabilities affecting Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway products.
- Impact: Both vulnerabilities allow for unauthenticated Remote Code Execution (RCE), enabling an attacker to take full control of an affected appliance.
- CVSS Score: Both are rated 9.5 (Critical).
- Exploitation Status: Confirmed to be actively exploited in the wild before patches were released. CISA added both to its KEV catalog on September 27, with a remediation deadline of September 30 for federal agencies.
Oracle PeopleSoft
- CVE-2026-35273: A critical vulnerability in Oracle's PeopleSoft enterprise resource planning (ERP) software.
- Impact: Allows for unauthenticated Remote Code Execution.
- CVSS Score: 9.8 (Critical).
- Exploitation Status: After initial mass exploitation in May/June 2026, the ShinyHunters group has developed a new exploit variant that reportedly bypasses common WAF rules, leading to a renewed wave of attacks.
Affected Systems
- Citrix: A wide range of Citrix NetScaler ADC and Gateway versions are affected. Administrators must consult the Citrix security bulletin for a complete list of vulnerable builds.
- Oracle: Oracle PeopleSoft instances, particularly those that are internet-facing. The renewed attacks are targeting technology, healthcare, and government sectors in addition to the previously targeted higher education institutions.
Exploitation Status
All three vulnerabilities are under active and widespread exploitation. The Citrix flaws are being used as zero-days, indicating sophisticated threat actors. The re-weaponization of the PeopleSoft flaw by a known group like ShinyHunters suggests a focused campaign to steal data from high-value ERP systems. The combination of these perimeter and application-level RCEs creates a highly dangerous environment for defenders.
Impact Assessment
The compromise of these systems can lead to severe consequences:
- Full System Takeover: RCE on perimeter appliances like NetScaler provides a powerful foothold for attackers to pivot into the internal network.
- Data Theft: Compromise of PeopleSoft ERP systems can lead to the theft of massive amounts of sensitive data, including financial records, employee PII, and proprietary business information.
- Ransomware Deployment: Threat actors often use such access to deploy ransomware across the victim's network.
- Unified "Intrusion Economy": Attackers can chain these exploits, using the NetScaler RCE for initial access, the PeopleSoft exploit for data theft, and then leveraging that access to compromise connected cloud environments.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
httpaccess.log / httpsaccess.lognsppe processDetection Methods
- Vulnerability Scanners: Use up-to-date vulnerability scanners to identify unpatched Citrix and Oracle systems in your environment.
- Log Analysis: Ingest and analyze web server logs from NetScaler and PeopleSoft systems into a SIEM. Search for IOCs and exploit patterns published by Citrix, Oracle, and security researchers. This is an application of
D3-NTA: Network Traffic Analysis. - Endpoint Detection and Response (EDR): While EDR may have limited visibility on network appliances, it is critical for detecting post-exploitation activity on PeopleSoft application servers, such as suspicious process creation or command-line activity.
Remediation Steps
- PATCH IMMEDIATELY: This is the highest priority. Apply the security updates provided by Citrix and Oracle to all affected systems. Due to active exploitation, this should be treated as an emergency change.
- Assume Compromise: For any internet-facing, unpatched systems, assume they are already compromised. Isolate them from the network and begin a forensic investigation.
- Hunt for Malicious Activity: Use the observables and detection methods above to hunt for signs of compromise.
- Rotate Credentials: If a compromise is suspected or confirmed, rotate all credentials associated with the affected systems.
- Restrict Access: If patching is not immediately possible, restrict all access to the management interfaces of these systems to a small set of trusted IP addresses. This is a temporary compensating control, not a substitute for patching.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary and most effective mitigation is to apply the security patches provided by Citrix and Oracle immediately.
Mapped D3FEND Techniques:
Restrict network access to the management interfaces of Citrix NetScaler and PeopleSoft systems to only authorized personnel and trusted IP ranges.
Mapped D3FEND Techniques:
Restrict Web-Based Content
Use a Web Application Firewall (WAF) with up-to-date rules to block known exploit patterns, though be aware that attackers are actively developing bypasses.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The most critical and immediate action for organizations is to apply the security patches released by Citrix and Oracle. For CVE-2026-88771, CVE-2026-88772, and CVE-2026-35273, these are not routine updates; they are emergency changes that must be deployed immediately due to active, widespread exploitation. Prioritize all internet-facing Citrix NetScaler ADC/Gateway and Oracle PeopleSoft instances. Because these are zero-day or near-zero-day exploits, waiting for a standard patch cycle is not an option. The 'assume compromise' principle should be applied: any unpatched, internet-facing device should be considered compromised. Patching not only fixes the vulnerability but is also a critical step in evicting an attacker who may have already gained access. After patching, it is essential to proceed with threat hunting to look for signs of post-exploitation activity.
As a compensating control and defense-in-depth measure, organizations must implement strict inbound traffic filtering for their critical appliances. Access to the management interfaces of Citrix NetScaler and Oracle PeopleSoft systems should never be exposed to the public internet. Create explicit firewall rules that only allow access from a limited set of internal, trusted IP addresses (e.g., a dedicated management bastion host or SOC network). For the application interfaces themselves, deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block the exploit patterns for these CVEs. While the report notes that ShinyHunters has developed a WAF bypass for the PeopleSoft flaw, a well-configured WAF can still defeat less sophisticated attempts and provide valuable logging for threat hunting.
Timeline of Events
CISA adds CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog.
A threat forecast is issued highlighting the convergence of Citrix and Oracle exploits.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.