{"schema":"sb.node.v1","id":"sb:e/606cd5e5785f0fa78e06bf09","kind":"entity","label":{"text":"netscaler","locale":"en"},"identity":{"anchor":"label:en:netscaler","strength":"label"},"asOf":{"knowledgeCutoff":"2026-10-07T13:21:22.920897+00:00","snapshot":"deploy f8c17d23cb0113e79e6889c106f9cd7d602771c2"},"lens":{"kind":"public"},"build":{"plane":"projected","builtFrom":["entity_graph.slim.json","entity_receipts (deploy asset)","event_graph.json","truth_records (deploy asset)","corroborated_record.json"],"rule":"node-projection.entity@v1"},"standing":{"evidence":{"supporting":27,"separatePublishers":8,"basis":"documents that mention the subject and the outlets that carried them; a mention is evidence the referent is in use, not evidence about any claim"},"admission":{"state":"provisional","reason":"entity graph provenance 'observed'; the node carries no promotion receipt in v1","policy":"EQ-PROMOTION (receipt not carried)"},"disposition":{"state":"served","reason":"public record"},"validity":{"from":"2026-09-05","to":"2026-10-06","basis":"first and last day we saw it mentioned; not the subject's own lifetime"},"measurement":{"state":"partial","blind":["assertion coverage 0.333: about 67% of mentions carry no typed assertion"]}},"dimensions":{"domains":["cybersecurity"],"activeDays":11,"assertions":{"military-action":8,"utterance":1}},"up":[],"upNote":"An entity is a root: it is contained by nothing. Pan out by following R.","children":{"count":12,"byKind":{"observation":12},"items":[{"id":"sb:o/c294a6782d1b9c14ee2cf21c","kind":"observation","label":"The Hacker News · 2026-10-06 · ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests","url":"https://thehackernews.com/2026/10/weekly-recap-netscaler-and-fortimail-0.html"},{"id":"sb:o/50f8574ffd55bf63f75daa27","kind":"observation","label":"The Hacker News · 2026-10-05 · New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline","url":"https://thehackernews.com/2026/10/new-netscaler-zero-day-exploited-in.html"},{"id":"sb:o/fd369c6607316e55d0593bab","kind":"observation","label":"SecurityWeek · 2026-10-05 · Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier","url":"https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/"},{"id":"sb:o/4c0d80872aa0ff2d9c0a6e9e","kind":"observation","label":"BleepingComputer · 2026-10-05 · Citrix patches NetScaler SAML zero-day exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/"},{"id":"sb:o/b8f649d9c19494244aa1a7f0","kind":"observation","label":"Help Net Security · 2026-10-04 · Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited","url":"https://www.helpnetsecurity.com/2026/10/04/week-in-review-researcher-breaks-into-microsoft-analytics-service-netscaler-rce-0-day-exploited/"},{"id":"sb:o/a71bfef1401b26c63314ad4d","kind":"observation","label":"The Stack · 2026-10-01 · Runtime: The Polycurious CISO; enter Gemini 4; JPMorgan punches holes in NetScaler","url":"https://www.thestack.technology/runtime-the-polycurious-ciso-enter-gemini-4-jpmorgan-punches-holes-in-netscaler/"},{"id":"sb:o/ba282e378b5032a4caf707e5","kind":"observation","label":"SecurityWeek · 2026-10-01 · Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks","url":"https://www.securityweek.com/government-finance-orgs-targeted-in-weeks-long-netscaler-zero-day-attacks/"},{"id":"sb:o/133623f87a28cd4d3bcc4d22","kind":"observation","label":"The Hacker News · 2026-10-01 · Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs","url":"https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html"},{"id":"sb:o/fa3eb10dc94eaefd8d0f0975","kind":"observation","label":"BleepingComputer · 2026-09-30 · Hackers exploit Citrix NetScaler zero-day to deploy web shells","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/"},{"id":"sb:o/92a51786b75d4983d35af40a","kind":"observation","label":"The Hacker News · 2026-09-30 · Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution","url":"https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html"}],"cursor":"c1.eyJpZCI6InNiOmUvNjA2Y2Q1ZTU3ODVmMGZhNzhlMDZiZjA5IiwibCI6ImNoaWxkcmVuIiwibyI6MTAsImsiOm51bGwsImEiOiIyMDI2LTEwLTA3VDEzOjIxOjIyLjkyMDg5NyswMDowMCJ9","order":"newest first; we keep the 12 newest receipts for this entity. Its other observations are counted in standing.evidence.supporting but are not addressable in v1"},"relations":{"count":10,"byKind":{"co-mentioned":10},"items":[{"kind":"relation","label":"co-mentioned with citrix (20 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/ed55bdac1278329d8f5c9780"},{"kind":"relation","label":"co-mentioned with netscaler gateway (17 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/7626b031e0e62518458580d4"},{"kind":"relation","label":"co-mentioned with cisa (16 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/c3c885a44784ce52dfa60a5d"},{"kind":"relation","label":"co-mentioned with netscaler adc (15 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/6ba1c869747473914dc365d1"},{"kind":"relation","label":"co-mentioned with citrix netscaler (14 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/633cf420c17a8784e6f7a95e"},{"kind":"relation","label":"co-mentioned with cve-2026-88771 (14 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/98aea0eb8959467af0bc0cb3"},{"kind":"relation","label":"co-mentioned with cve-2026-88772 (14 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/566dbd44cc9381a6146f2113"},{"kind":"relation","label":"co-mentioned with cvss (12 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/03bc9669c1ba55a016ac21d8"},{"kind":"relation","label":"co-mentioned with ai (12 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/0d408200a1791378a0129c69"},{"kind":"relation","label":"co-mentioned with citrix netscaler adc (10 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/9f0ad95b249294a61d4e78f5"}],"cursor":null,"order":"situations first, then claims (the subject's own maintained record, then site-wide corroborated clusters; each label ends with its standing), then co-mentions by shared documents, descending. Co-mentions are the ten strongest the entity graph keeps per entity"},"edge":{"state":"continues"},"links":{"rest":"/api/v1/node/e/606cd5e5785f0fa78e06bf09","mcp":"traverse {\"id\":\"sb:e/606cd5e5785f0fa78e06bf09\"}","page":"/entity/netscaler/"},"limits":{"levelsPerCall":1,"pageSize":10,"maxPageSize":50,"membersMax":50,"statement":"One level per call: depth is 1 and only 1, and there is no whole-graph dump. pageSize 1-50 (default 10); a page limit is a cursor, never an edge. Members are listed up to 50. At most 60 traverse calls a minute per caller (runaway-loop protection, not a meter). One knowledge cutoff is served: the deploy's."},"actions":[{"verb":"unfold","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/606cd5e5785f0fa78e06bf09\",\"level\":\"children\"}"},{"verb":"fold","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/606cd5e5785f0fa78e06bf09\"}"},{"verb":"panOut","lit":false,"effect":"read","layer":"cantina","reason":"An entity is a root: it is contained by nothing. Pan out by following R."},{"verb":"follow","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/606cd5e5785f0fa78e06bf09\",\"level\":\"relations\"}"},{"verb":"receipts","lit":false,"effect":"read","layer":"cantina","reason":"receipts are the observations below this node; unfold to reach them"},{"verb":"edge","lit":true,"effect":"read","layer":"cantina","call":"traverse {\"id\":\"sb:e/606cd5e5785f0fa78e06bf09\"}"},{"verb":"asOf","lit":false,"effect":"read","layer":"cantina","reason":"v1 serves one knowledge cutoff, this deploy's; walking an earlier cutoff needs retained history (EQ-REPLAY), which v1 does not keep"},{"verb":"switchObserver","lit":false,"effect":"read","layer":"cantina","reason":"the public record is the same for every observer; traversal through a Watch's lens is not served in v1"},{"verb":"readOriginal","lit":false,"effect":"read","layer":"cantina","reason":"no translation is applied on this node; every label is the source's own text"},{"verb":"save","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"saving applies to a configured Watch; configure one around this node first (free), then save it"},{"verb":"deliver","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"delivery applies to a saved Watch"},{"verb":"format","lit":false,"effect":"watch-declaration","layer":"workshop","reason":"output format applies to a saved Watch"},{"verb":"deltaR","lit":false,"effect":"read","layer":"workshop","reason":"Delta R needs a saved Watch with a previous reading"},{"verb":"read","lit":false,"effect":"read","layer":"docking-bay","reason":"one-time Reads are parked until the Commander decides their shape (#938)"}]}