Skip to content
HACKTECH
Exploited vulnerabilitiesReported Published 6 sources

Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 exploited for weeks

Citrix released fixes on 27 September 2026 for eight NetScaler ADC and NetScaler Gateway vulnerabilities, CVE-2026-88771 through CVE-2026-88778, and said exploits of CVE-2026-88771 and CVE-2026-88772 had been observed on unmitigated deployments. Attackers used them to deliver web shells. According to CyberScoop, Mandiant said the earliest known exploitation of CVE-2026-88772 was on 3 September, that it was aware of dozens of impacted organisations, and attributed the attacks to advanced and suspected state-sponsored threat actors. CISA added both flaws to its Known Exploited Vulnerabilities catalogue the same day, and added a third exploited flaw, CVE-2026-88779, a denial-of-service bug that affects only appliances with SAML enabled, on 4 October.

  • Citrix
  • NetScaler
  • zero-days
  • edge devices
  • web shells
  • CISA KEV
  • Mandiant

What the sources report

  • CVE-2026-88771 is an improper input validation flaw that lets unauthenticated attackers run commands on appliances in their default configuration. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled, which Help Net Security says is the default on VPN virtual servers. Unit 42 lists both at CVSS v4.0 9.5.
  • Affected customer-managed builds include NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus FIPS and NDcPP builds. Citrix said Secure Private Access hybrid deployments using NetScaler instances are also affected (Help Net Security).
  • Unit 42 traced version fingerprinting requests back to 21 August 2026 and saw DTLS-based .deb web shell activity from 4 to 24 September. Its Cortex Xpanse telemetry counted 50,277 exposed instances that could potentially be vulnerable as of 27 September. GreyNoise said CVE-2026-88771 had been exploited since at least 24 September (CyberScoop).
  • Mandiant and Google Threat Intelligence Group documented a PHP web shell (WHIPSHOT) and a Python tunneller (SLAPSHOT). The attackers edited httpd.conf so that disguised .deb or .sig files ran as PHP, and set the setuid bit on /bin/sh so that later web requests ran with higher privileges. GTIG said organisations in government, financial services, technology, education, and legal and professional services in North America and Europe were likely impacted.
  • CISA added CVE-2026-88771 and CVE-2026-88772 to KEV on 27 September with a 30 September deadline and required forensic triage. It added CVE-2026-88779 on 4 October with a 7 October deadline. The catalogue lists six NetScaler entries added in 2026, including these three.
  • The Dutch NCSC advised backing up appliance memory and log files going back at least one month before updating. Citrix acknowledged that its indicators of compromise might fail to identify actual compromises and advised customers to retain experienced forensic investigators (Help Net Security).

What it means for your organisation

Most edge devices such as NetScaler lack endpoint detection and response monitoring, which Mandiant said makes them attractive targets, and Google Threat Intelligence Group says edge-device vulnerabilities made up about half of enterprise-related zero-days in 2025. In this campaign attackers had at least three weeks of access before disclosure, so installing the fix did not show whether an appliance was already compromised. Buyers should plan for compromise assessment, off-box log retention and credential rotation on edge appliances, not just version checks.

What we check

  • List every internet-facing NetScaler ADC and Gateway, compare each build with Citrix's fixed versions, and record whether DTLS and SAML are enabled.
  • Look for web shells and httpd.conf changes that turn on the PHP engine or map .deb, .sig, .ico or CSS paths under /vpn and /logon/LogonPoint/custom to executable files, and check whether /bin/sh has the setuid bit set.
  • Search remote syslog and SIEM data for Base64 strings in User-Agent fields, 'pitboss' entries followed by injected commands and packet engine crash messages, since logs on the appliance may already have rotated.
  • Before rebuilding, capture a VM snapshot with memory, a technical support bundle and packet engine core dumps. Then rotate credentials and revoke sessions that passed through the gateway.
  • Trace connections from the appliance's internal interface for signs of reconnaissance, tunnelling and credential use against internal hosts.

Sources

Services that cover these checks

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Red team & purple team

    Objective-based adversary simulation: we agree the objectives, try to reach them over several weeks and measure what your detection and response do along the way. Purple mode runs the same scenarios with your defenders in the room, tuning detection as each technique is replayed.

    Duration: 3 to 6 weeks

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works