StyleSmuggler

CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)

Citrix's security bulletin CTX697096, published 2026-09-27, fixes eight NetScaler ADC / NetScaler Gateway vulnerabilities, two of which Citrix says have been exploited (Citrix, 2026-09-27); watchTowr notes they were exploited as zero-days, "before any fix existed" (watchTowr, 2026-09-27). CVE-2026-88771 (CWE-20, improper input validation, CVSS 4.0 9.5) lets an unauthenticated remote attacker execute arbitrary commands on every NetScaler ADC/Gateway deployment in its default configuration; no feature needs to be enabled first. CVE-2026-88772 (CWE-119, memory overflow to RCE or DoS, CVSS 4.0 9.5) is reachable wherever DTLS is enabled, which Citrix states is the default on any VPN virtual server, so most VPN-fronting Gateway deployments meet the precondition unless DTLS was explicitly disabled. Citrix's own bulletin states plainly: "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed" (Citrix, 2026-09-27). CISA added both to its Known Exploited Vulnerabilities catalog on 2026-09-27 and flags them for forensic triage (CISA Known Exploited Vulnerabilities Catalog, 2026-09-27), and CERT-EU's advisory the same day states "Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild" and recommends a compromise assessment on every internet-facing appliance (CERT-EU, 2026-09-27).

The disclosure path itself is a defender-relevant data point. NetScaler administrators reported being told by IT suppliers and security teams to shut appliances down over the weekend of 26-27 September, before any CVE identifier or vendor advisory existed; BleepingComputer reports that NCSC-NL reportedly sent a pre-notification to its constituency and that NCSC-NL declined to confirm the leaked notice's contents (BleepingComputer, 2026-09-27) but published its own public advisory NCSC-2026-0394 the same day once Citrix's bulletin shipped (NCSC-NL, 2026-09-27). watchTowr independently and publicly flagged credible rumors of unpatched, in-the-wild NetScaler RCEs on 2026-09-26, a day ahead of Citrix's own bulletin. No public attribution of the exploiting activity exists; watchTowr's FAQ states "No attribution has been made public," while noting NetScaler perimeter appliances have historically been targeted by both state-sponsored and ransomware-affiliated actors, consistent with the CitrixBleed (CVE-2023-4966) and CitrixBleed 2 (CVE-2025-5777) history on the same product line (watchTowr, 2026-09-27).

The same bulletin fixes six configuration-dependent companion flaws not reported exploited: an HTTP request-smuggling flaw (CVE-2026-88773, CVSS 9.3), a policy-bypass flaw via HTTP URL-based expressions (CVE-2026-88774, CVSS 7.0), three further memory-overflow conditions gated respectively on a Gateway/AAA virtual server, an Oracle-type load-balancing virtual server, or a non-HTTP Layer-7 protocol on an LB/CS/CGNAT-LSN/NAT64 device (CVE-2026-88775/88776/88777, each CVSS 8.8), and a predictable-TCP-ISN weakness (CVE-2026-88778, CVSS 8.8) whose remediation is not covered by the version upgrade alone: it additionally requires enabling Enhanced ISN Generation. This is a distinct CVE family from CVE-2026-19490 and from the CitrixBleed/CitrixBleed 2 lineage named above; watchTowr states directly that appliances already patched for CVE-2026-19490 remain vulnerable to CVE-2026-88771/88772 unless running one of the new fixed builds (watchTowr, 2026-09-27). Fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 (FIPS/NDcPP); watchTowr flags an upgrade caveat on the 13.1 branch: run show ns variable first, and if it returns any variables, install 13.1-64.24 instead to avoid a known reboot loop during the upgrade. A separate bulletin of 2026-10-03 adds CVE-2026-88779 for SAML-configured appliances, which these builds do not fix (see the 2026-10-04 update below).

Detection and hunting. Citrix has published no workaround for either exploited flaw (watchTowr, 2026-09-27); Mandiant's interim network controls are described in the update below, and its DTLS and UDP/443 controls address CVE-2026-88772 alone, so the priority is upgrading, not mitigating in place. Before patching, capture logs, an instance snapshot where the appliance is virtual, a support bundle and a core dump from every appliance that has been internet-facing, since the upgrade can overwrite forensic evidence of prior compromise (watchTowr, 2026-09-27; Unit 42, 2026-09-30). A limited IOC scan is available from 14.1-73.36+ with telemetry enabled via the NetScaler Console Security Advisory page or through Citrix Support, but Citrix itself cautions the indicators do not cover every exploitation technique (watchTowr, 2026-09-27), so a clean scan is not proof an appliance was not already compromised before patching, and CERT-EU recommends a compromise assessment on every internet-facing appliance (CERT-EU, 2026-09-27). Zscaler's telemetry adds appliance-initiated downloads to unfamiliar addresses, an unexpected executable under /var and a Perl CGI handler in the web server configuration to the post-exploitation checks (Zscaler ThreatLabz, 2026-10-16). Rapid7 adds, from one investigated intrusion, a setuid bit set on /bin/sh, web shells behind CSS-looking Apache aliases, nsaaad crashes followed by Pitboss reboots, an outbound agent that polls an external endpoint every 15 seconds and implant files synchronised to the HA peer, and says to inspect both nodes of every HA pair and to rotate the LDAP and RADIUS credentials, SSL private keys and key-encryption material held in the configuration, which that intrusion staged and exfiltrated (Rapid7, 2026-10-19).

Triage: for CVE-2026-88771 the precursor sits in the appliance's own logs: header, username or other request values carrying shell metacharacters (semicolons, backticks) together with Pitboss crash-message text such as "PPE unexpectedly died", which the crash-log monitor script later parses as root (watchTowr Labs, 2026-09-28). Legitimate clients have no reason to send crash-message text in a request field, so such a log line is the signal rather than a benign lookalike. For CVE-2026-88772, GTIG names a DTLS handshake-failure "Internal Error" line in the syslog, which successful exploitation produced, and packet-engine termination or watchdog "NOT restarting" lines in the FreeBSD system log, which NetScaler does not forward to a SIEM by default. A handshake failure followed within minutes by a packet-engine termination on the same appliance is a strong exploitation signal, but GTIG advises alerting on the watchdog messages and terminations independently rather than requiring both (GTIG/Mandiant, 2026-09-29).

Builds on: The precondition is wider than the headline version numbers suggest; on older builds a Gateway… · CVE-2026-8451, Citrix NetScaler ADC/Gateway: pre-auth SAML memory overread (CitrixBleed… · Citrix confirms attacks on a new NetScaler SAML flaw that the September fixed builds do not… · Adobe rates its own emergency hotfix priority 1 for a flaw stores were already being…

CVE-2026-75650 ("StyleSmuggler"), Magento/Adobe Commerce: unauthenticated CVSS 10.0 RCE via template-engine injection, exploited three days before Adobe's hotfix existed

Sansec found StyleSmuggler on 2026-09-04 at 22:40 UTC and published the following day specifically because stores were already being compromised, reproducing the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9 within hours (Sansec, 2026-09-05). The bug abuses Magento's own template engine through the styles property, reached via a POST /graphql request carrying the malicious styles parameter, to smuggle PHP past existing input safeguards, and runs in two stages: first the attacker poisons a location Magento itself writes to and later re-renders through its template filter; Sansec's own published check searches a failure report under var/report/, but Magento hosting firm Disrex Group, which handled two live compromises, found both of its infections instead poisoned var/log/system.log, a location Sansec's check misses entirely (The Hacker News, 2026-09-06), with attacker-controlled PHP; second, the attacker triggers Magento's built-in "Payment Transaction Failed Reminder" customer-notification email, and the poisoned content executes the moment Magento renders that template (Sansec, 2026-09-05). Nobody needs to open the email, and the attack succeeds even when delivery fails (Sansec, 2026-09-05). Adobe assigned CVE-2026-75650 (CVSS 10.0, CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine) and shipped an emergency hotfix, APSB26-146, on 2026-09-07 at 20:20 UTC with its highest priority rating, three days after the first confirmed exploitation (Adobe PSIRT, 2026-09-07; Sansec, 2026-09-05). The fix ships as a composer patch (VULN-39341) rather than a full point release, tested against the 2026-aug release branch of Adobe Commerce, Adobe Commerce B2B and Magento Open Source 2.4.4 through 2.4.9; older versions in those branches are affected too, but Sansec reports the patch is unverified there (Sansec, 2026-09-05).

Disrex's own two compromises, reported independently of Sansec, sharpen the timeline and the triage picture. Both stores were breached inside the roughly eight-hour window between Sansec's first observed exploitation and the moment any defense existed, and Disrex states patch level was irrelevant during that window; one victim ran Magento Open Source 2.4.8 as a Sansec Shield customer with the module installed, enabled and licensed, and was still hit hours before Shield's first blocking rule went live (The Hacker News, 2026-09-06). Disrex reports a concrete false-negative worth defenders' attention: its own eComscan run on one compromised store returned clean eleven hours after the implant first executed, because the scheduled scan was scoped to the store's document root while the implant had installed itself one directory above it, under the site account's home directory, a scan-scope gap, not a detection-engine failure. Disrex also names a reliable success indicator the exploit itself leaves behind: a TypeError from array_merge() with an integer argument, logged immediately after the poisoned include executes; a stealthier variant instead returns an empty array and leaves nothing to find, so its absence does not clear a host. One of Disrex's two compromises first surfaced through exactly the "Payment Transaction Failed Reminder" tell this entry describes above: a merchant forwarded a failed-transaction email whose template variables had never resolved (raw {{var ...}} tags, a customer address on an invalid domain, a zero-value total) and that forward alone started the investigation that found the implant within the hour (The Hacker News, 2026-09-06).

Patch level offered no protection during the exposure window: the first confirmed victim ran Magento 2.4.6-p15 with the July and August 2026 security patches applied (the latest patch level Adobe offers for that release line) and a clean security:patch-status (Sansec, 2026-09-05; The Hacker News, 2026-09-06), and Sansec's own Shield product blocked a probe against an already-current 2.4.7-p10 store on 2026-09-07, confirming that current patch level was no defense during the exposure window (Sansec, 2026-09-05). Moving session storage to Redis or a database is not a mitigation either: one merchant's session-storage defense stopped one attempt, and the same operator succeeded eight seconds later by routing the poisoned payload through a file uploaded via Magento's custom options instead (Sansec, 2026-09-05). On success, the implant is a small Rust binary (Disrex describes the sample from its own compromises as stripped and statically linked) that installs itself under a hidden directory outside the web root and re-persists via a cron entry written directly into the cron spool file rather than through the crontab command, so the change leaves no corresponding audit line and an empty crontab -l is not evidence of a clean host (Sansec, 2026-09-05; The Hacker News, 2026-09-06). The implant renames its own process to masquerade as a kernel worker thread, the fontconfig cache builder, or the genuine NTP daemon, and one observed build re-dropped and renamed itself mid-run from one masquerade to another while keeping the same underlying agent identity, a process-naming change with no corresponding new infection (Sansec, 2026-09-05). It reads /proc/self/status for TracerPid before beaconing: if a debugger or tracer is attached, the implant still installs itself but never calls out, which matters for anyone attempting to reproduce or analyze it live (Sansec, 2026-09-05).

Command-and-control is disguised as time synchronization: every 60 seconds the implant sends short UDP datagrams to port 123 shaped to resemble NTP server replies, carrying a chunked telemetry record (host, user, operating system, resource usage, and implant version) rather than legitimate time data, traffic that passes most egress filtering unremarked because it looks like a routine NTP exchange (Sansec, 2026-09-05). Two details separate it from a genuine NTP client for a defender who does look: a real client issues one query per interval, where one observed build burst nine datagrams roughly ten milliseconds apart every sixty seconds; and every datagram is marked NTP server-mode, which a client has no legitimate reason to send at all (Sansec, 2026-09-05). Sansec has so far found no evidence the backdoor has been used beyond installation and beaconing (Sansec, 2026-09-05).

Sansec separately documents a second, apparently unrelated actor exploiting the same flaw: a reconnaissance probe sent as an ordinary-looking GraphQL request carries PHP code inside a request header rather than the request body, reads the host's kernel/OS string, PHP user, working directory, and whether the media directory is writable, then exfiltrates that single-line answer one fragment at a time as a sequence of externally-resolved hostname labels to a public callback service; a technique that needs no response body at all, since the operator reconstructs the answer from the callback log (Sansec, 2026-09-05). Only when that probe reports the media directory writable does the same actor follow up with a web shell planted inside the product-image cache directory, reachable solely with a custom request header (Sansec, 2026-09-05).

Every version of Adobe Commerce, Adobe Commerce B2B and Magento Open Source in the 2.4.4–2.4.9 line is affected with no authentication or user interaction required (Adobe PSIRT, 2026-09-07); Switzerland's NCSC has issued its own advisory confirming the exploitation and backdoor-persistence risk for its constituency (NCSC Switzerland / GovCERT.ch, 2026-09-07). Any public body or supplier running a storefront, ticketing portal or fee-payment system on this platform (tourism boards, cantonal shops, public-transport ticketing among them) is in the affected population even without a Swiss-specific victim yet reported.

Triage: the exploitation trigger is Magento's own "Payment Transaction Failed Reminder" email, so an unexplained burst of these messages (especially containing unresolved template placeholders or Magento's template-error fallback text) is a Magento-specific tell that costs no additional tooling to check; legitimate declined-payment traffic can produce the same notification, so treat the burst as a lead, not a confirmation. On the network side, a web-tier host that only ever needs outbound HTTPS suddenly emitting repeated small UDP datagrams to port 123 is not a legitimate NTP client, which issues a single periodic query rather than a burst of server-mode replies; filtering by process name alone is insufficient once an implant has renamed itself to match the very daemon a defender would otherwise exclude from suspicion.