{"schema":"sb.node.v1","id":"sb:e/b2ab9a826512eeba765a2082","kind":"entity","label":{"text":"citrix netscaler","locale":"en"},"identity":{"anchor":"label:en:citrix netscaler","strength":"label"},"asOf":{"knowledgeCutoff":"2026-10-30T15:52:39.451756+00:00","releaseId":"sb-75fa59dc51b6","snapshot":"deploy c8fa70aa3206cf84ae097fc0d8cd4597ed6d2293"},"lens":{"kind":"public"},"build":{"plane":"projected","builtFrom":["entity_graph.slim.json","entity_receipts (deploy asset)","event_graph.json","truth_records (deploy asset)","corroborated_record.json"],"rule":"node-projection.entity@v1"},"standing":{"evidence":{"supporting":34,"separatePublishers":9,"basis":"documents that mention the subject and the outlets that carried them; a mention is evidence the referent is in use, not evidence about any claim","receiptsOnTopic":{"state":"partial","share":0.441,"named":15,"of":34,"basis":"documents whose own title or summary lead names the subject, over every counted document that mentions it anywhere (the entity graph's measurement); receipts are drawn only from rows whose own title or URL names the subject (the entity graph's subject gate)","blind":["only 44% of the 34 documents measured name the subject in their own text; the rest mention it in passing, so standing.evidence.supporting overstates coverage about it"]}},"admission":{"state":"provisional","kind":"observed","kindBasis":"no-vocabulary-row","policy":"promotion (observed tier; not promoted)","reason":"seen recurring in the corpus and kept in the graph at the observation bar; not promoted into the vocabulary"},"disposition":{"state":"served","reason":"public record"},"validity":{"from":"2026-09-05","to":"2026-10-29","basis":"first and last day we saw it mentioned; not the subject's own lifetime"},"measurement":{"state":"partial","blind":["assertion coverage 0: about 100% of mentions carry no typed assertion"]}},"dimensions":{"domains":["cybersecurity"],"activeDays":20,"assertions":{}},"up":[],"upNote":"An entity is a root: it is contained by nothing. Pan out by following R.","children":{"count":9,"byKind":{"observation":9},"withheld":{"state":"withheld","count":3,"reason":"3 receipts withheld: no source link (the same rule the topic record applies)"},"items":[{"id":"sb:o/3ddc4348417d4165d21a45a6","kind":"observation","label":"www.theregister.com · 2026-10-06 · Citrix NetScaler security snafus get even worse amid more 0-day reports","url":"https://www.theregister.com/security/2026/10/05/citrix-netscaler-security-snafus-get-even-worse-amid-more-0-day-reports/5301232","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/fd369c6607316e55d0593bab","kind":"observation","label":"SecurityWeek · 2026-10-05 · Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier","url":"https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/133623f87a28cd4d3bcc4d22","kind":"observation","label":"The Hacker News · 2026-10-01 · Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs","url":"https://thehackernews.com/2026/10/citrix-netscaler-post-exploitation.html","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/fa3eb10dc94eaefd8d0f0975","kind":"observation","label":"BleepingComputer · 2026-09-30 · Hackers exploit Citrix NetScaler zero-day to deploy web shells","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-citrix-netscaler-zero-day-to-deploy-web-shells/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/92a51786b75d4983d35af40a","kind":"observation","label":"The Hacker News · 2026-09-30 · Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution","url":"https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/a8687f3243f1c428e2f9de3d","kind":"observation","label":"Help Net Security · 2026-09-28 · Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)","url":"https://www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/0535af275461b13849437c4f","kind":"observation","label":"The Hacker News · 2026-09-28 · CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally","url":"https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/aa6f923fe15cf42168438595","kind":"observation","label":"The Hacker News · 2026-09-27 · Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation","url":"https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}},{"id":"sb:o/4927a937cd368acaf3fc923b","kind":"observation","label":"BleepingComputer · 2026-09-05 · Critical Citrix NetScaler auth bypass now leveraged in attacks","url":"https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/","match":{"surface":"title","basis":"admitted by the entity graph's subject gate (title or URL); the headline names the subject as whole words (the door's on-topic test)"}}],"cursor":null,"order":"newest first; we keep the 9 newest receipts for this entity whose own title or URL (the entity graph's subject gate) names it; each says which in match. Its other observations are counted in standing.evidence.supporting but are not addressable in v1"},"relations":{"count":10,"byKind":{"co-mentioned":10},"items":[{"kind":"relation","label":"co-mentioned with citrix (34 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/bd83024a130148ae89efc059"},{"kind":"relation","label":"co-mentioned with netscaler (34 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/633cf420c17a8784e6f7a95e"},{"kind":"relation","label":"co-mentioned with cisa (23 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/04bf2491a0bbbed7f009dfff"},{"kind":"relation","label":"co-mentioned with cvss (18 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/3b3467ebbcdaa3e5d53deb6b"},{"kind":"relation","label":"co-mentioned with netscaler gateway (18 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/77dab91333107d34fa7e99a7"},{"kind":"relation","label":"co-mentioned with netscaler adc (15 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/fa72ae286953118ee2a8e210"},{"kind":"relation","label":"co-mentioned with cve-2026-88771 (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/e41ba1aa7e2985ff6e967a2a"},{"kind":"relation","label":"co-mentioned with cve-2026-88772 (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/2a37cf41b9b88daf9134fe5f"},{"kind":"relation","label":"co-mentioned with known exploited vulnerabilities (13 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/2bd3c8bedc951c37b13c279d"},{"kind":"relation","label":"co-mentioned with netherlands (11 documents)","role":"co-mentioned","relationKind":"co-mentioned","members":2,"id":"sb:r/08ee3ac882db3cbe0b8043f4"}],"cursor":null,"order":"situations first, then claims (the subject's own maintained record, then site-wide corroborated clusters; each label ends with its standing), then co-mentions by shared documents, descending. Co-mentions are the ten strongest the entity graph keeps per entity"},"edge":{"state":"continues"},"links":{"rest":"/api/v1/node/e/b2ab9a826512eeba765a2082","mcp":"traverse {\"id\":\"sb:e/b2ab9a826512eeba765a2082\"}","page":"/entity/citrix-netscaler/"},"limits":{"levelsPerCall":1,"pageSize":10,"maxPageSize":50,"membersMax":50,"statement":"One level per call: depth is 1 and only 1, and there is no whole-graph dump. pageSize 1-50 (default 10); a page limit is a cursor, never an edge. Members are listed up to 50. At most 60 traverse calls a minute per caller (runaway-loop protection, not a meter). One knowledge cutoff is served: the deploy's."},"actions":[{"verb":"unfold","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/b2ab9a826512eeba765a2082\",\"level\":\"children\"}"},{"verb":"fold","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/b2ab9a826512eeba765a2082\"}"},{"verb":"panOut","lit":false,"effect":"read","layer":"free-record","reason":"An entity is a root: it is contained by nothing. Pan out by following R."},{"verb":"follow","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/b2ab9a826512eeba765a2082\",\"level\":\"relations\"}"},{"verb":"receipts","lit":false,"effect":"read","layer":"free-record","reason":"receipts are the observations below this node; unfold to reach them"},{"verb":"edge","lit":true,"effect":"read","layer":"free-record","call":"traverse {\"id\":\"sb:e/b2ab9a826512eeba765a2082\"}"},{"verb":"asOf","lit":false,"effect":"read","layer":"free-record","reason":"v1 serves one knowledge cutoff, this deploy's; walking an earlier cutoff needs retained history, which v1 does not keep"},{"verb":"switchObserver","lit":false,"effect":"read","layer":"free-record","reason":"the public record is the same for every observer; traversal through a Watch's lens is not served in v1"},{"verb":"readOriginal","lit":false,"effect":"read","layer":"free-record","reason":"no translation is applied on this node; every label is the source's own text"},{"verb":"save","lit":false,"effect":"watch-declaration","layer":"watch","reason":"saving applies to a configured Watch; configure one around this node first (free), then save it"},{"verb":"deliver","lit":false,"effect":"watch-declaration","layer":"watch","reason":"delivery applies to a saved Watch"},{"verb":"format","lit":false,"effect":"watch-declaration","layer":"watch","reason":"output format applies to a saved Watch"},{"verb":"deltaR","lit":false,"effect":"read","layer":"watch","reason":"Delta R needs a saved Watch with a previous reading"},{"verb":"read","lit":false,"effect":"read","layer":"one-time-read","reason":"one-time Reads are not offered through this door; use ask"}]}