Citrix NetScaler ADC/Gateway HTTP request smuggling, CTX697096, not reported exploited, CVSS4.0 9.3

watchTowr Labs' root-cause analysis, published 2026-09-28, names the actual vulnerable component behind CVE-2026-88771: not the nsppe packet engine that has carried most historical NetScaler CVEs, but ns_monuploadd_err.pl, a Perl script that searches NetScaler system logs for Pitboss packet-engine crash messages, "missed too many heartbeats" or "unexpectedly died", to recover a core-dump filename (watchTowr Labs, 2026-09-28). The pre-patch script extracted that filename with an unsanitized shell pipeline and re-interpolated the attacker-influenced string into a second backtick command: "The Command Injection happens in the next line, when Perl interpolates that string into another backtick command" (watchTowr Labs, 2026-09-28), executing as root because nearly every NetScaler process runs with root privileges. Critically, the trigger is not confined to the SSLVPN/AAA login form watchTowr used to demonstrate it: "it is worth mentioning that this is not limited to a single endpoint. Any endpoint or port that logs data controlled in an HTTP header can trigger this vulnerability" (watchTowr Labs, 2026-09-28): failed logins, rate-limited requests and arbitrary request parameters or User-Agent headers can all poison the log the monitor script later parses. Citrix's fix replaces the unsafe pipeline with a strict regex capture that only accepts a well-formed PPE name and numeric PID and executes find via Perl's list form rather than shell interpolation. watchTowr also clarifies exploitation-status granularity across the eight-CVE bulletin: only CVE-2026-88771 and CVE-2026-88772 are confirmed exploited, matching Citrix's bulletin, and has published a public detection-artefact tool. NCSC Switzerland's Cyber Security Hub, NCSC UK and CERT-FR each published same-day advisories on 2026-09-28 relaying Citrix's confirmation of active exploitation (NCSC Switzerland, 2026-09-28; NCSC UK, 2026-09-28; CERT-FR, 2026-09-28).

Exploitation predates the bulletin. Google's Mandiant and Threat Intelligence Group identified in-the-wild exploitation of CVE-2026-88772 and report that the campaign has run since at least early September, with organizations in North America and Europe in government, financial services, technology, education, and legal and professional services likely impacted (GTIG/Mandiant, 2026-09-29). eSentire independently reports CVE-2026-88771 exploited against internet-facing NetScaler Gateway appliances as early as 5 September (eSentire, 2026-09-29), and GreyNoise recorded a failed pre-disclosure attempt on 24 September that already used the setuid-and-handler playbook described below (GreyNoise, 2026-09-28). GTIG and GreyNoise name no actor. CERT-EU traced the activity through NetScaler logs from the European Court of Auditors and the European Central Bank, which showed requests carrying Base64-encoded shell commands in the HTTP User-Agent header (CERT-EU, 2026-09-28). An appliance upgraded after the 27 September bulletin may therefore already have been compromised: "Patching does not remove persistence an attacker already installed" (Censys, 2026-09-30).

What the actor leaves behind. After the DTLS exploit runs shellcode as root, a first-stage web shell rewrites the appliance web-server configuration so that files with non-script extensions run as PHP; in one variant an alias maps requests for image files under the VPN media path onto a staged shell, so the traffic looks like image fetches, and the shells answer with HTTP 404 while taking Base64 commands from HTTP request headers, including NSC-prefixed ones (GTIG/Mandiant, 2026-09-29). The installer sets the setuid bit on /bin/sh so later web requests run as root, scrubs its staging path from /etc/crontab and reboots the appliance to apply the change (GTIG/Mandiant, 2026-09-29). The PHP shell WHIPSHOT relays requests over loopback to SLAPSHOT, a Python TCP tunneler that Mandiant saw used for internal reconnaissance and credential theft in at least one intrusion (GTIG/Mandiant, 2026-09-29).

Exploit availability for CVE-2026-88772. GTIG states it holds no exploit code (GTIG/Mandiant, 2026-09-29). watchTowr published a root-cause analysis and a detection-artifact generator on 29 September: DTLS handshake reassembly keeps almost the whole record for each one-byte fragment, so after 120 records the buffer chain holds about 174 KB, which a packet-engine function copies into a 35,840-byte scratch buffer without a size check (watchTowr Labs, 2026-09-29). NCSC Switzerland's advisory now lists a proof of concept for both CVEs (NCSC-CH, 2026-09-29), and Help Net Security reports the activity turned into opportunistic mass exploitation after a public root-cause analysis and proof of concept for CVE-2026-88771, while its text says there was no public proof of concept for CVE-2026-88772 (Help Net Security, 2026-09-29).

Interim controls and containment. For appliances that cannot be patched at once Mandiant lists three network restrictions: disabling DTLS on internet-facing Gateway virtual servers where it is not needed and blocking inbound UDP/443 at an upstream firewall or edge router (local ACLs let the traffic reach the packet engine first) are specific to CVE-2026-88772 and "should not be relied on to mitigate CVE-2026-88771", while upstream IP allow-listing, where source ranges are predictable, is not scoped to one CVE and may be impractical for large remote workforces (GTIG/Mandiant, 2026-09-29). For a suspected compromise it advises isolating the node, halting high-availability configuration sync until both nodes are validated because a compromised node can replicate a modified web-server configuration to the standby, restricting appliance egress, and, after patching, rotating appliance and integration credentials and terminating Gateway and ICA sessions (GTIG/Mandiant, 2026-09-29). NetScaler 12.1 and 13.0 are end of life and no longer receive security updates, and Citrix has not said whether they are affected (Tenable, 2026-09-27). Censys counts 42,735 exposed NetScaler ADC and Gateway hosts, with Switzerland among the countries at roughly 4% each; these are exposed instances, not confirmed-vulnerable ones (Censys, 2026-09-30).

Hunting. By telemetry class: appliance web-server configuration containing handler or alias directives that point public paths at script directories; script content in the client plug-in and media directories, which should hold compiled clients and static assets; 404 responses with multi-kilobyte bodies or long processing times on media paths; the setuid bit on /bin/sh; lock and port-pointer files in the temp directory; and, for CVE-2026-88772, a DTLS handshake-failure "Internal Error" line in the syslog, and packet-engine termination or watchdog "NOT restarting" lines in the FreeBSD system log, which NetScaler does not forward to a SIEM by default (GTIG/Mandiant, 2026-09-29). GTIG treats a handshake failure followed within minutes by a packet-engine termination as a strong exploitation signal, but advises alerting on each event on its own rather than requiring both, alongside configuration drift (GTIG/Mandiant, 2026-09-29).

A shared municipal operator shut down as a precaution. The two municipal data centres of the Rhineland-Palatinate association ZIDKOR shut down centrally hosted specialist applications on Sunday 27 September after a security vulnerability became known, taking resident-registration, ID-card, vehicle-registration and civil-registry services offline across all 194 full-time administered municipalities, cities and counties while they installed the vendor's patches; the operators say no successful cyberattack occurred, and each administration ran its own continuity plan with no central instruction (ZIDKOR release via AK-Kurier, 2026-09-28). Mainz and Kaiserslautern reported regular service again on the morning of 29 September (dpa via Rhein-Zeitung, 2026-09-29). The operators name no vendor; heise assesses that the trigger was probably the NetScaler updates released that weekend, a link it added to its article after publication (heise online, 2026-09-29). Cantonal and communal IT providers that host citizen services behind a shared NetScaler front end face the same trade-off between shutting down to patch and staying reachable.

Unit 42's threat brief, updated 2026-09-30, adds first-party telemetry on the pre-disclosure activity (Unit 42, 2026-09-30). Its earliest observed activity is on 2026-08-21: requests for an admin-UI stylesheet and a Gateway language resource that those two hosts and a third address then repeated against more than 100 other systems on 21 and 22 August, which Unit 42 reads as version fingerprinting (Unit 42, 2026-09-30). Between 2026-09-04 and 2026-09-24 the DTLS exploitation delivered web shells as .deb packages that the actor repeatedly fetched from the appliance's /vpn/scripts/linux/ client-installer folder, rotating infrastructure over that period; the recovered PHP web shell offers command execution, file download and upload over an RC4-encrypted channel and uses the appliance's SUID helper for privilege escalation (Unit 42, 2026-09-30). From 2026-09-10 to 2026-09-27 a continuous stream of requests reached the Gateway's /logon/LogonPoint/Authentication/GetUserName page, which Unit 42 calls anomalous and worth investigating (Unit 42, 2026-09-30).

On 2026-09-21 Unit 42 saw a three-stage chain against a US-based target: a request with a Base64 dropper command in the User-Agent, answered with a 404 and written to the VPN HTTP access log; a login request whose extra text is logged in ns.log after the pitboss PPE missed too many heartbeatsNSPPE marker; and the vulnerable ns_monuploadd_err.pl script then running that text, which retrieves and decodes the staged payload and pipes it to sh or php (Unit 42, 2026-09-30). The payload sets the SUID and SGID bits on /bin/sh, creates a hidden PHP receiver under the Gateway's custom directory, adds Alias directives that present it as a versioned CSS file, switches php_flag engine to on in httpd.conf and reloads Apache with SIGHUP, leaving no restart entry (Unit 42, 2026-09-30). Unit 42 counted 50,277 exposed instances that could potentially be vulnerable as of 2026-09-27 and cautions that activity after that date may not match the original actors' indicators or TTPs (Unit 42, 2026-09-30).

Citrix published a second NetScaler bulletin on 2026-10-03, CTX697174, for CVE-2026-88779, a memory overflow reachable when the appliance is configured as a SAML service provider or identity provider; Citrix says it has observed targeted attacks and scopes the impact to denial of service (Citrix, 2026-10-03; Citrix, 2026-10-03). The flaw is independent of the vulnerabilities disclosed in the earlier bulletin CTX697096 (Citrix, 2026-10-02), and Citrix tells operators who upgraded to the September builds and meet the SAML precondition to upgrade again (Citrix, 2026-10-03). The fixed builds are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 (Citrix, 2026-10-03). A SAML-configured appliance on 14.1-73.37 or 13.1-64.23 is therefore fixed against the exploited command-injection and DTLS flaws described above but not against this one.

Belgium's Centre for Cybersecurity reported on 2026-10-06 that a proof of concept is publicly available for CVE-2026-88773, the HTTP request-smuggling flaw in the same bulletin, which an unauthenticated attacker can use on appliances with the HTTP configuration enabled to view and edit restricted data; it had seen no exploitation in the wild by that date (CCB, 2026-10-06). Citrix lists 14.1-73.37 and 13.1-64.23 and later as fixed, so an appliance on the September builds needs nothing further for this flaw (Citrix CTX697096).

Contradiction: CCB's advisory lists the affected software as 14.1 - 14.1-73.37 and 13.1 - 13.1-64.23 (CCB, 2026-10-06), while Citrix names those builds as the first fixed releases (Citrix CTX697096); Citrix, as the vendor, is the authority on its own fixed builds.

Rapid7 published an incident analysis on 2026-10-19 of an early-October compromise of a NetScaler ADC on an affected 14.1 build, build number not given (Rapid7, 2026-10-19). Its logs show CVE-2026-88771 chained with CVE-2026-88779: text similar to a Pitboss crash message was inserted into an authentication username, repeated nsaaad crashes and a Pitboss reboot followed, and after the reboot the call-home crash handler processed the retained text and executed a payload as root, a chaining that avoided waiting 24 hours for the injected payload to run (Rapid7, 2026-10-19). The crash-and-reboot cycle recurred over several days and let the operator refresh persistence and deploy new components (Rapid7, 2026-10-19).

After the first root execution the operator installed cookie-authenticated PHP web shells behind Apache aliases that look like CSS files and answer with HTTP 404 bodies, set /bin/sh to mode 6555, and kept access through cron entries, boot scripts, watchdog loops, an outbound agent that polls every 15 seconds and an HTTP-fronted TCP proxy, with logic that synchronises implant files to the HA peer and forces a failover so the implanted node stays active (Rapid7, 2026-10-19). A Go tool recovered from the appliance mapped routes, DNS, LDAP and Active Directory, management services and VMware vCenter, and the configuration, historical configurations and system backups were staged and exfiltrated, one archive through the web root; Rapid7 says the archive can hold encrypted credentials, LDAP and RADIUS bind information, SSL private keys and key-encryption material (Rapid7, 2026-10-19). Rapid7 says the activity overlaps public WHIPSHOT and SLAPSHOT reporting and names no actor (Rapid7, 2026-10-19).

Rapid7 recommends patching to the fixed builds for both CVEs and verifying the September builds, collecting volatile evidence before rebooting or rebuilding, inspecting both nodes of every HA pair, and rotating all credentials and keys exposed through the configuration (Rapid7, 2026-10-19).