Citrix
A Citrix virtualization application delivery solution. Windows of remote applications are invisible to the accessibility tree and are presented only as a video stream.
Timeline (last 90 days)
Attackers exploited two CVSS 9.5 zero-day vulnerabilities to breach Citrix NetScaler ADC and Gateway devices.
NCSC-NL advised operators in a private pre-notification to shut down devices; Citrix released fixed versions on September 27, 2026, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same day.
Citrix's IOC guidance carries a disclaimer stating that these indicators do not cover all techniques, tactics, and procedures, and their forensic value may be limited.
Remote screen windows such as VNC, RDP or Citrix are essentially just a video stream, and the accessibility tree stops at the window border.
Microsoft's RDP protocol originated from Citrix's ICA protocol and was introduced in 1998 with Windows NT 4.0 Terminal Server Edition.
All Facts (5)
Citrix's IOC guidance carries a disclaimer stating that these indicators do not cover all techniques, tactics, and procedures, and their forensic value may be limited.
50%UnverifiedRemote screen windows such as VNC, RDP or Citrix are essentially just a video stream, and the accessibility tree stops at the window border.
50%UnverifiedMicrosoft's RDP protocol originated from Citrix's ICA protocol and was introduced in 1998 with Windows NT 4.0 Terminal Server Edition.
50%UnverifiedAttackers exploited two CVSS 9.5 zero-day vulnerabilities to breach Citrix NetScaler ADC and Gateway devices.
50%UnverifiedNCSC-NL advised operators in a private pre-notification to shut down devices; Citrix released fixed versions on September 27, 2026, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same day.
50%