Swarming Against Citrix 0-Day Exploitation

Reported 01 Oct 2026 by otx · Severity: medium

A malicious cyber actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker, using IP address 149.104.78.141, attempted exploitation that was detected through behavioral analysis despite no CVE-speci