Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE3 IOCs
CVE-2026-88779: Citrix NetScaler Zero-Day Exploited Against SAML Deployments
Diamond Model
Indicators of Compromise
Indicators of Compromise3
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-88779 ddosexploitintel-blog | High | 71 | Oct 4, 26 |
| CVE | CVE-2026-88772 ddosexploitintel-blog | High | 81 | Sep 28, 26 |
| CVE | CVE-2026-88771 ddosexploitintel-blog | High | 82 | Sep 27, 26 |
IOC Relationship Graph
IOC Relationship Graph3 total IOCs
CVE