Mandiant finds NetScaler attacks predated detection by more than three weeks

Mandiant says attackers exploited Citrix NetScaler vulnerability CVE-2026-88772 from at least Sept. 3, more than three weeks before attacks were confirmed. Researchers told CyberScoop that organizations across North America and Europe were likely compromised; Mandiant Consulting's chief technology officer said dozens of organizations were impacted. The investigation found tools used to gain privileged access, move through networks and steal data. One intrusion used tunneler malware for internal reconnaissance and credential theft. Mandiant is still responding to active intrusions and says new evidence could change the campaign timeline.