Citrix NetScaler ADC/Gateway memory overflow to RCE/DoS via DTLS, exploited as a zero-day, CTX697096, CISA KEV 2026-09-27, CVSS4.0 9.5

watchTowr Labs' root-cause analysis, published 2026-09-28, names the actual vulnerable component behind CVE-2026-88771: not the nsppe packet engine that has carried most historical NetScaler CVEs, but ns_monuploadd_err.pl, a Perl script that periodically scans NetScaler system logs for Pitboss "PPE unexpectedly died" crash messages to recover a core-dump filename (watchTowr Labs, 2026-09-28). The pre-patch script extracted that filename with an unsanitized shell pipeline and re-interpolated the attacker-influenced string into a second backtick command: "The Command Injection happens in the next line, when Perl interpolates that string into another backtick command" (watchTowr Labs, 2026-09-28), executing as root because nearly every NetScaler process runs with root privileges. Critically, the trigger is not confined to the SSLVPN/AAA login form watchTowr used to demonstrate it: "it is worth mentioning that this is not limited to a single endpoint. Any endpoint or port that logs data controlled in an HTTP header can trigger this vulnerability" (watchTowr Labs, 2026-09-28): failed logins, rate-limited requests and arbitrary request parameters or User-Agent headers can all poison the log the monitor script later parses. Citrix's fix replaces the unsafe pipeline with a strict regex capture that only accepts a well-formed PPE name and numeric PID and executes find via Perl's list form rather than shell interpolation. watchTowr also clarifies exploitation-status granularity across the eight-CVE bulletin: only CVE-2026-88771 and CVE-2026-88772 are confirmed exploited, matching Citrix's bulletin, and has published a public detection-artefact tool. NCSC Switzerland's Cyber Security Hub, NCSC UK and CERT-FR each published same-day advisories on 2026-09-28 relaying Citrix's confirmation of active exploitation (NCSC Switzerland, 2026-09-28; NCSC UK, 2026-09-28; CERT-FR, 2026-09-28).

Exploitation predates the bulletin. Google's Mandiant and Threat Intelligence Group identified in-the-wild exploitation of CVE-2026-88772 and report that the campaign has run since at least early September, with organizations in North America and Europe in government, financial services, technology, education, and legal and professional services likely impacted (GTIG/Mandiant, 2026-09-29). eSentire independently reports CVE-2026-88771 exploited against internet-facing NetScaler Gateway appliances as early as 5 September (eSentire, 2026-09-29), and GreyNoise recorded a failed pre-disclosure attempt on 24 September that already used the setuid-and-handler playbook described below (GreyNoise, 2026-09-28). GTIG and GreyNoise name no actor. CERT-EU traced the activity through NetScaler logs from the European Court of Auditors and the European Central Bank, which showed requests carrying Base64-encoded shell commands in the HTTP User-Agent header (CERT-EU, 2026-09-28). An appliance upgraded after the 27 September bulletin may therefore already have been compromised: "Patching does not remove persistence an attacker already installed" (Censys, 2026-09-30).

What the actor leaves behind. After the DTLS exploit runs shellcode as root, a first-stage web shell rewrites the appliance web-server configuration so that files with non-script extensions run as PHP; in one variant an alias maps requests for image files under the VPN media path onto a staged shell, so the traffic looks like image fetches, and the shells answer with HTTP 404 while taking Base64 commands from HTTP request headers, including NSC-prefixed ones (GTIG/Mandiant, 2026-09-29). The installer sets the setuid bit on /bin/sh so later web requests run as root, scrubs its staging path from /etc/crontab and reboots the appliance to apply the change (GTIG/Mandiant, 2026-09-29). The PHP shell WHIPSHOT relays requests over loopback to SLAPSHOT, a Python TCP tunneler that Mandiant saw used for internal reconnaissance and credential theft in at least one intrusion (GTIG/Mandiant, 2026-09-29).

Exploit availability for CVE-2026-88772. GTIG states it holds no exploit code (GTIG/Mandiant, 2026-09-29). watchTowr published a root-cause analysis and a detection-artifact generator on 29 September: DTLS handshake reassembly keeps almost the whole record for each one-byte fragment, so after 120 records the buffer chain holds about 174 KB, which a packet-engine function copies into a 35,840-byte scratch buffer without a size check (watchTowr Labs, 2026-09-29). NCSC Switzerland's advisory now lists a proof of concept for both CVEs (NCSC-CH, 2026-09-29), and Help Net Security reports the activity turned into opportunistic mass exploitation after a public root-cause analysis and proof of concept for CVE-2026-88771, while its text says there was no public proof of concept for CVE-2026-88772 (Help Net Security, 2026-09-29).

Interim controls and containment. For appliances that cannot be patched at once Mandiant lists three network restrictions: disabling DTLS on internet-facing Gateway virtual servers where it is not needed and blocking inbound UDP/443 at an upstream firewall or edge router (local ACLs let the traffic reach the packet engine first) are specific to CVE-2026-88772 and "should not be relied on to mitigate CVE-2026-88771", while upstream IP allow-listing, where source ranges are predictable, is not scoped to one CVE and may be impractical for large remote workforces (GTIG/Mandiant, 2026-09-29). For a suspected compromise it advises isolating the node, halting high-availability configuration sync until both nodes are validated because a compromised node can replicate a modified web-server configuration to the standby, restricting appliance egress, and, after patching, rotating appliance and integration credentials and terminating Gateway and ICA sessions (GTIG/Mandiant, 2026-09-29). NetScaler 12.1 and 13.0 are end of life and no longer receive security updates, and Citrix has not said whether they are affected (Tenable, 2026-09-27). Censys counts 42,735 exposed NetScaler ADC and Gateway hosts, with Switzerland among the countries at roughly 4% each; these are exposed instances, not confirmed-vulnerable ones (Censys, 2026-09-30).

Hunting. By telemetry class: appliance web-server configuration containing handler or alias directives that point public paths at script directories; script content in the client plug-in and media directories, which should hold compiled clients and static assets; 404 responses with multi-kilobyte bodies or long processing times on media paths; the setuid bit on /bin/sh; lock and port-pointer files in the temp directory; and, for CVE-2026-88772, a DTLS handshake-failure "Internal Error" line in the syslog, and packet-engine termination or watchdog "NOT restarting" lines in the FreeBSD system log, which NetScaler does not forward to a SIEM by default (GTIG/Mandiant, 2026-09-29). GTIG treats a handshake failure followed within minutes by a packet-engine termination as a strong exploitation signal, but advises alerting on each event on its own rather than requiring both, alongside configuration drift (GTIG/Mandiant, 2026-09-29).

A shared municipal operator shut down as a precaution. The two municipal data centres of the Rhineland-Palatinate association ZIDKOR shut down centrally hosted specialist applications on Sunday 27 September after a security vulnerability became known, taking resident-registration, ID-card, vehicle-registration and civil-registry services offline across all 194 full-time administered municipalities, cities and counties while they installed the vendor's patches; the operators say no successful cyberattack occurred, and each administration ran its own continuity plan with no central instruction (ZIDKOR release via AK-Kurier, 2026-09-28). Mainz and Kaiserslautern reported regular service again on the morning of 29 September (dpa via Rhein-Zeitung, 2026-09-29). The operators name no vendor; heise assesses that the trigger was probably the NetScaler updates released that weekend, a link it added to its article after publication (heise online, 2026-09-29). Cantonal and communal IT providers that host citizen services behind a shared NetScaler front end face the same trade-off between shutting down to patch and staying reachable.

Unit 42's threat brief, updated 2026-09-30, adds first-party telemetry on the pre-disclosure activity (Unit 42, 2026-09-30). Its earliest observed activity is on 2026-08-21: requests for an admin-UI stylesheet and a Gateway language resource that those two hosts and a third address then repeated against more than 100 other systems on 21 and 22 August, which Unit 42 reads as version fingerprinting (Unit 42, 2026-09-30). Between 2026-09-04 and 2026-09-24 the DTLS exploitation delivered web shells as .deb packages that the actor repeatedly fetched from the appliance's /vpn/scripts/linux/ client-installer folder, rotating infrastructure over that period; the recovered PHP web shell offers command execution, file download and upload over an RC4-encrypted channel and uses the appliance's SUID helper for privilege escalation (Unit 42, 2026-09-30). From 2026-09-10 to 2026-09-27 a continuous stream of requests reached the Gateway's /logon/LogonPoint/Authentication/GetUserName page, which Unit 42 calls anomalous and worth investigating (Unit 42, 2026-09-30).

On 2026-09-21 Unit 42 saw a three-stage chain against a US-based target: a request with a Base64 dropper command in the User-Agent, answered with a 404 and written to the VPN HTTP access log; a login request whose extra text is logged in ns.log after the pitboss PPE missed too many heartbeatsNSPPE marker; and the vulnerable ns_monuploadd_err.pl script then running that text, which retrieves and decodes the staged payload and pipes it to sh or php (Unit 42, 2026-09-30). The payload sets the SUID and SGID bits on /bin/sh, creates a hidden PHP receiver under the Gateway's custom directory, adds Alias directives that present it as a versioned CSS file, switches php_flag engine to on in httpd.conf and reloads Apache with SIGHUP, leaving no restart entry (Unit 42, 2026-09-30). Unit 42 counted 50,277 exposed instances that could potentially be vulnerable as of 2026-09-27 and cautions that activity after that date may not match the original actors' indicators or TTPs (Unit 42, 2026-09-30).

Citrix published a second NetScaler bulletin on 2026-10-03, CTX697174, for CVE-2026-88779, a memory overflow reachable when the appliance is configured as a SAML service provider or identity provider; Citrix says it has observed targeted attacks and scopes the impact to denial of service (Citrix, 2026-10-03; Citrix, 2026-10-03). The flaw is independent of the vulnerabilities disclosed in the earlier bulletin CTX697096 (Citrix, 2026-10-02), and Citrix tells operators who upgraded to the September builds and meet the SAML precondition to upgrade again (Citrix, 2026-10-03). The fixed builds are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 (Citrix, 2026-10-03). A SAML-configured appliance on 14.1-73.37 or 13.1-64.23 is therefore fixed against the exploited command-injection and DTLS flaws described above but not against this one.