CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)
Citrix confirms in-the-wild exploitation of two default-configuration NetScaler zero-days and publishes no workaround
Defender actions
- Upgrade every internet-facing NetScaler ADC/Gateway to 14.1-73.37+ (14.1-FIPS 14.1-73.37 FIPS+) or 13.1-64.23+ (13.1-FIPS/NDcPP 13.1-37.279+) now (a SAML-configured appliance needs the later builds named for CVE-2026-88779, and an identity provider 14.1-73.46 or 13.1-64.29); on a 13.1-branch appliance run
show ns variablefirst; if it returns any variables, install 13.1-64.24 instead to avoid a known reboot loop. Capture logs, an instance snapshot where the appliance is virtual, a support bundle and a core dump from each exposed appliance BEFORE patching, since the upgrade can remove forensic evidence of prior exploitation. - Run Mandiant's compromise checks, extended by the Unit 42 artifacts described in the update below, on every NetScaler that was internet-facing and unpatched at any time since early September, patched or not; isolate any hit and halt HA configuration sync until both nodes are validated.
- Find any NetScaler ADC or Gateway still on the end-of-life 12.1 or 13.0 branches and decide isolation or replacement now: they receive no security updates and Citrix has not said whether they are affected.
Analysis
Citrix's security bulletin CTX697096, published 2026-09-27, fixes eight NetScaler ADC / NetScaler Gateway vulnerabilities, two of which Citrix says have been exploited (Citrix, 2026-09-27); watchTowr notes they were exploited as zero-days, "before any fix existed" (watchTowr, 2026-09-27). CVE-2026-88771 (CWE-20, improper input validation, CVSS 4.0 9.5) lets an unauthenticated remote attacker execute arbitrary commands on every NetScaler ADC/Gateway deployment in its default configuration; no feature needs to be enabled first. CVE-2026-88772 (CWE-119, memory overflow to RCE or DoS, CVSS 4.0 9.5) is reachable wherever DTLS is enabled, which Citrix states is the default on any VPN virtual server, so most VPN-fronting Gateway deployments meet the precondition unless DTLS was explicitly disabled. Citrix's own bulletin states plainly: "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed" (Citrix, 2026-09-27). CISA added both to its Known Exploited Vulnerabilities catalog on 2026-09-27 and flags them for forensic triage (CISA Known Exploited Vulnerabilities Catalog, 2026-09-27), and CERT-EU's advisory the same day states "Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild" and recommends a compromise assessment on every internet-facing appliance (CERT-EU, 2026-09-27).
The disclosure path itself is a defender-relevant data point. NetScaler administrators reported being told by IT suppliers and security teams to shut appliances down over the weekend of 26-27 September, before any CVE identifier or vendor advisory existed; BleepingComputer reports that NCSC-NL reportedly sent a pre-notification to its constituency and that NCSC-NL declined to confirm the leaked notice's contents (BleepingComputer, 2026-09-27) but published its own public advisory NCSC-2026-0394 the same day once Citrix's bulletin shipped (NCSC-NL, 2026-09-27). watchTowr independently and publicly flagged credible rumors of unpatched, in-the-wild NetScaler RCEs on 2026-09-26, a day ahead of Citrix's own bulletin. No public attribution of the exploiting activity exists; watchTowr's FAQ states "No attribution has been made public," while noting NetScaler perimeter appliances have historically been targeted by both state-sponsored and ransomware-affiliated actors, consistent with the CitrixBleed (CVE-2023-4966) and CitrixBleed 2 (CVE-2025-5777) history on the same product line (watchTowr, 2026-09-27).
The same bulletin fixes six configuration-dependent companion flaws not reported exploited: an HTTP request-smuggling
flaw (CVE-2026-88773, CVSS 9.3), a policy-bypass flaw via HTTP URL-based expressions (CVE-2026-88774, CVSS 7.0),
three further memory-overflow conditions gated respectively on a Gateway/AAA virtual server, an Oracle-type
load-balancing virtual server, or a non-HTTP Layer-7 protocol on an LB/CS/CGNAT-LSN/NAT64 device
(CVE-2026-88775/88776/88777, each CVSS 8.8), and a predictable-TCP-ISN weakness (CVE-2026-88778, CVSS 8.8) whose
remediation is not covered by the version upgrade alone: it additionally requires enabling Enhanced ISN Generation.
This is a distinct CVE family from CVE-2026-19490 and from the CitrixBleed/CitrixBleed 2 lineage named above;
watchTowr states directly that appliances already patched for CVE-2026-19490 remain vulnerable to
CVE-2026-88771/88772 unless running one of the new fixed builds
(watchTowr, 2026-09-27). Fixed
builds
are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 (FIPS/NDcPP); watchTowr flags an upgrade caveat on the
13.1 branch: run show ns variable first, and if it returns any variables, install 13.1-64.24 instead to avoid a
known reboot loop during the upgrade. A separate bulletin of 2026-10-03 adds CVE-2026-88779 for SAML-configured appliances, which these builds do not fix (see the 2026-10-04 update below).
Detection and hunting. Citrix has published no workaround for either exploited flaw (watchTowr, 2026-09-27); Mandiant's interim network controls are described in the update below, and its DTLS and UDP/443 controls address CVE-2026-88772 alone, so the priority is upgrading, not mitigating in place. Before patching, capture logs, an instance snapshot where the appliance is virtual, a support bundle and a core dump from every appliance that has been internet-facing, since the upgrade can overwrite forensic evidence of prior compromise (watchTowr, 2026-09-27; Unit 42, 2026-09-30). A limited IOC scan is available from 14.1-73.36+ with telemetry enabled via the NetScaler Console Security Advisory page or through Citrix Support, but Citrix itself cautions the indicators do not cover every exploitation technique (watchTowr, 2026-09-27), so a clean scan is not proof an appliance was not already compromised before patching, and CERT-EU recommends a compromise assessment on every internet-facing appliance (CERT-EU, 2026-09-27).
Triage: for CVE-2026-88771 the precursor sits in the appliance's own logs: header, username or other request values carrying shell metacharacters (semicolons, backticks) together with Pitboss crash-message text such as "PPE unexpectedly died", which the crash-log monitor script later parses as root (watchTowr Labs, 2026-09-28). Legitimate clients have no reason to send crash-message text in a request field, so such a log line is the signal rather than a benign lookalike. For CVE-2026-88772, GTIG names a DTLS handshake-failure "Internal Error" line in the syslog, which successful exploitation produced, and packet-engine termination or watchdog "NOT restarting" lines in the FreeBSD system log, which NetScaler does not forward to a SIEM by default. A handshake failure followed within minutes by a packet-engine termination on the same appliance is a strong exploitation signal, but GTIG advises alerting on the watchdog messages and terminations independently rather than requiring both (GTIG/Mandiant, 2026-09-29). Check each alongside configuration drift.
Cited evidence
Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
Citrix has confirmed active exploitation of these 2 critical vulnerabilities in the wild.
No attribution has been made public.
The Command Injection happens in the next line, when Perl interpolates that string into another backtick command
It is worth mentioning that this is not limited to a single endpoint. Any endpoint or port that logs data controlled in an HTTP header can trigger this vulnerability.
organizations in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors were likely impacted by this exploitation campaign, which has been ongoing since at least early September
The DTLS and UDP/443 controls below are specific to CVE-2026-88772 and should not be relied on to mitigate CVE-2026-88771.
observed a threat actor exploiting CVE-2026-88771 against Internet-facing Citrix NetScaler Gateway appliances as early as September 5th, more than three weeks before the vulnerability was publicly disclosed
The vulnerable function then copies that entire chain into the 35,840-byte scratch buffer without checking whether it fits.
NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 have reached end-of-life (EOL) and no longer receive security updates, and Citrix has not said whether they are affected by these vulnerabilities.
Patching does not remove persistence an attacker already installed.
fueled by the publication of a root-cause analysis and a proof-of-concept exploit for CVE-2026-88771, which is remotely exploitable on unpatched devices with the default configuration
It is not a successful cyberattack, but a precaution to protect the data until the vulnerability is closed (translated from German)
The IT teams probably brought the Citrix NetScaler software up to date. (translated from German)
The earliest activity we identified occurred on Aug. 21, 2026
We believe any activity to this URL path is anomalous and worth investigating.
It is important to note that activity after Sept. 27, 2026 might not match the same indicators of compromise (IoCs) or tactics, techniques and procedures (TTPs) from the original zero-day activity.
NetScaler ADC and NetScaler Gateway 14.1-73.41 and later releases
please upgrade your deployment again with the software released as part of the
Updates6
watchTowr Labs' root-cause analysis, published 2026-09-28, names the actual vulnerable component behind
CVE-2026-88771: not the nsppe packet engine that has carried most historical NetScaler CVEs, but
ns_monuploadd_err.pl, a Perl script that periodically scans NetScaler system logs for Pitboss "PPE unexpectedly
died" crash messages to recover a core-dump filename
(watchTowr Labs, 2026-09-28).
The pre-patch script extracted that filename with an unsanitized shell pipeline and re-interpolated the
attacker-influenced string into a second backtick command: "The Command Injection happens in the next line, when
Perl interpolates that string into another backtick command"
(watchTowr Labs, 2026-09-28),
executing as root because nearly every NetScaler process runs with root privileges. Critically, the trigger is not
confined to the SSLVPN/AAA login form watchTowr used to demonstrate it: "it is worth mentioning that this is not
limited to a single endpoint. Any endpoint or port that logs data controlled in an HTTP header can trigger this
vulnerability"
(watchTowr Labs, 2026-09-28):
failed logins, rate-limited requests and arbitrary request parameters or User-Agent headers can all poison the log
the monitor script later parses. Citrix's fix replaces the unsafe pipeline with a strict regex capture that only
accepts a well-formed PPE name and numeric PID and executes find via Perl's list form rather than shell
interpolation. watchTowr also clarifies exploitation-status granularity across the eight-CVE bulletin: only CVE-2026-88771 and CVE-2026-88772 are confirmed exploited, matching Citrix's bulletin, and has published a
public detection-artefact tool. NCSC Switzerland's Cyber Security Hub, NCSC UK and CERT-FR each published same-day advisories on 2026-09-28 relaying Citrix's confirmation of active exploitation (NCSC Switzerland, 2026-09-28; NCSC UK, 2026-09-28; CERT-FR, 2026-09-28).
Exploitation predates the bulletin. Google's Mandiant and Threat Intelligence Group identified in-the-wild exploitation of CVE-2026-88772 and report that the campaign has run since at least early September, with organizations in North America and Europe in government, financial services, technology, education, and legal and professional services likely impacted (GTIG/Mandiant, 2026-09-29). eSentire independently reports CVE-2026-88771 exploited against internet-facing NetScaler Gateway appliances as early as 5 September (eSentire, 2026-09-29), and GreyNoise recorded a failed pre-disclosure attempt on 24 September that already used the setuid-and-handler playbook described below (GreyNoise, 2026-09-28). GTIG and GreyNoise name no actor. CERT-EU traced the activity through NetScaler logs from the European Court of Auditors and the European Central Bank, which showed requests carrying Base64-encoded shell commands in the HTTP User-Agent header (CERT-EU, 2026-09-28). An appliance upgraded after the 27 September bulletin may therefore already have been compromised: "Patching does not remove persistence an attacker already installed" (Censys, 2026-09-30).
What the actor leaves behind. After the DTLS exploit runs shellcode as root, a first-stage web shell rewrites the appliance web-server configuration so that files with non-script extensions run as PHP; in one variant an alias maps requests for image files under the VPN media path onto a staged shell, so the traffic looks like image fetches, and the shells answer with HTTP 404 while taking Base64 commands from HTTP request headers, including NSC-prefixed ones (GTIG/Mandiant, 2026-09-29). The installer sets the setuid bit on /bin/sh so later web requests run as root, scrubs its staging path from /etc/crontab and reboots the appliance to apply the change (GTIG/Mandiant, 2026-09-29). The PHP shell WHIPSHOT relays requests over loopback to SLAPSHOT, a Python TCP tunneler that Mandiant saw used for internal reconnaissance and credential theft in at least one intrusion (GTIG/Mandiant, 2026-09-29).
Exploit availability for CVE-2026-88772. GTIG states it holds no exploit code (GTIG/Mandiant, 2026-09-29). watchTowr published a root-cause analysis and a detection-artifact generator on 29 September: DTLS handshake reassembly keeps almost the whole record for each one-byte fragment, so after 120 records the buffer chain holds about 174 KB, which a packet-engine function copies into a 35,840-byte scratch buffer without a size check (watchTowr Labs, 2026-09-29). NCSC Switzerland's advisory now lists a proof of concept for both CVEs (NCSC-CH, 2026-09-29), and Help Net Security reports the activity turned into opportunistic mass exploitation after a public root-cause analysis and proof of concept for CVE-2026-88771, while its text says there was no public proof of concept for CVE-2026-88772 (Help Net Security, 2026-09-29).
Interim controls and containment. For appliances that cannot be patched at once Mandiant lists three network restrictions: disabling DTLS on internet-facing Gateway virtual servers where it is not needed and blocking inbound UDP/443 at an upstream firewall or edge router (local ACLs let the traffic reach the packet engine first) are specific to CVE-2026-88772 and "should not be relied on to mitigate CVE-2026-88771", while upstream IP allow-listing, where source ranges are predictable, is not scoped to one CVE and may be impractical for large remote workforces (GTIG/Mandiant, 2026-09-29). For a suspected compromise it advises isolating the node, halting high-availability configuration sync until both nodes are validated because a compromised node can replicate a modified web-server configuration to the standby, restricting appliance egress, and, after patching, rotating appliance and integration credentials and terminating Gateway and ICA sessions (GTIG/Mandiant, 2026-09-29). NetScaler 12.1 and 13.0 are end of life and no longer receive security updates, and Citrix has not said whether they are affected (Tenable, 2026-09-27). Censys counts 42,735 exposed NetScaler ADC and Gateway hosts, with Switzerland among the countries at roughly 4% each; these are exposed instances, not confirmed-vulnerable ones (Censys, 2026-09-30).
Hunting. By telemetry class: appliance web-server configuration containing handler or alias directives that point public paths at script directories; script content in the client plug-in and media directories, which should hold compiled clients and static assets; 404 responses with multi-kilobyte bodies or long processing times on media paths; the setuid bit on /bin/sh; lock and port-pointer files in the temp directory; and, for CVE-2026-88772, a DTLS handshake-failure "Internal Error" line in the syslog, and packet-engine termination or watchdog "NOT restarting" lines in the FreeBSD system log, which NetScaler does not forward to a SIEM by default (GTIG/Mandiant, 2026-09-29). GTIG treats a handshake failure followed within minutes by a packet-engine termination as a strong exploitation signal, but advises alerting on each event on its own rather than requiring both, alongside configuration drift (GTIG/Mandiant, 2026-09-29).
A shared municipal operator shut down as a precaution. The two municipal data centres of the Rhineland-Palatinate association ZIDKOR shut down centrally hosted specialist applications on Sunday 27 September after a security vulnerability became known, taking resident-registration, ID-card, vehicle-registration and civil-registry services offline across all 194 full-time administered municipalities, cities and counties while they installed the vendor's patches; the operators say no successful cyberattack occurred, and each administration ran its own continuity plan with no central instruction (ZIDKOR release via AK-Kurier, 2026-09-28). Mainz and Kaiserslautern reported regular service again on the morning of 29 September (dpa via Rhein-Zeitung, 2026-09-29). The operators name no vendor; heise assesses that the trigger was probably the NetScaler updates released that weekend, a link it added to its article after publication (heise online, 2026-09-29). Cantonal and communal IT providers that host citizen services behind a shared NetScaler front end face the same trade-off between shutting down to patch and staying reachable.
Unit 42's threat brief, updated 2026-09-30, adds first-party telemetry on the pre-disclosure activity (Unit 42, 2026-09-30). Its earliest observed activity is on 2026-08-21: requests for an admin-UI stylesheet and a Gateway language resource that those two hosts and a third address then repeated against more than 100 other systems on 21 and 22 August, which Unit 42 reads as version fingerprinting (Unit 42, 2026-09-30). Between 2026-09-04 and 2026-09-24 the DTLS exploitation delivered web shells as .deb packages that the actor repeatedly fetched from the appliance's /vpn/scripts/linux/ client-installer folder, rotating infrastructure over that period; the recovered PHP web shell offers command execution, file download and upload over an RC4-encrypted channel and uses the appliance's SUID helper for privilege escalation (Unit 42, 2026-09-30). From 2026-09-10 to 2026-09-27 a continuous stream of requests reached the Gateway's /logon/LogonPoint/Authentication/GetUserName page, which Unit 42 calls anomalous and worth investigating (Unit 42, 2026-09-30).
On 2026-09-21 Unit 42 saw a three-stage chain against a US-based target: a request with a Base64 dropper command in the User-Agent, answered with a 404 and written to the VPN HTTP access log; a login request whose extra text is logged in ns.log after the pitboss PPE missed too many heartbeatsNSPPE marker; and the vulnerable ns_monuploadd_err.pl script then running that text, which retrieves and decodes the staged payload and pipes it to sh or php (Unit 42, 2026-09-30). The payload sets the SUID and SGID bits on /bin/sh, creates a hidden PHP receiver under the Gateway's custom directory, adds Alias directives that present it as a versioned CSS file, switches php_flag engine to on in httpd.conf and reloads Apache with SIGHUP, leaving no restart entry (Unit 42, 2026-09-30). Unit 42 counted 50,277 exposed instances that could potentially be vulnerable as of 2026-09-27 and cautions that activity after that date may not match the original actors' indicators or TTPs (Unit 42, 2026-09-30).
Citrix published a second NetScaler bulletin on 2026-10-03, CTX697174, for CVE-2026-88779, a memory overflow reachable when the appliance is configured as a SAML service provider or identity provider; Citrix says it has observed targeted attacks and scopes the impact to denial of service (Citrix, 2026-10-03; Citrix, 2026-10-03). The flaw is independent of the vulnerabilities disclosed in the earlier bulletin CTX697096 (Citrix, 2026-10-02), and Citrix tells operators who upgraded to the September builds and meet the SAML precondition to upgrade again (Citrix, 2026-10-03). The fixed builds are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 (Citrix, 2026-10-03). A SAML-configured appliance on 14.1-73.37 or 13.1-64.23 is therefore fixed against the exploited command-injection and DTLS flaws described above but not against this one.
For CVE-2026-88771, the precursor in the appliance's own logs is header or username values carrying shell metacharacters together with crash-message text such as "PPE unexpectedly died" (watchTowr Labs, 2026-09-28). For CVE-2026-88772, GTIG names a DTLS handshake-failure line, packet-engine terminations and watchdog "NOT restarting" lines, and advises alerting on each on its own rather than requiring both (GTIG/Mandiant, 2026-09-29). Citrix has published no workaround (watchTowr, 2026-09-27), and Mandiant's DTLS and UDP/443 controls apply to CVE-2026-88772 only, while its upstream IP allow-listing is not scoped to one CVE (GTIG/Mandiant, 2026-09-29).
The pointers above to the 14.1-73.41 and 13.1-64.28 builds for SAML-configured appliances are not the end of the upgrade path for identity providers: Citrix's bulletin CTX697191 of 2026-10-08 lists those builds as affected by CVE-2026-107406 when the appliance is a SAML identity provider, and names 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS and 13.1.37.283 and later as fixed (Citrix, 2026-10-08).
Sources27
Revision history
- Published 2026-09-28T0404Z-intel
- Update 2026-09-29T0405Z-intel
watchTowr Labs published a full root-cause analysis on 2026-09-28: the vulnerable component for CVE-2026-88771 is ns_monuploadd_err.pl, a crash-log-monitoring script, not the nsppe packet engine historically named in NetScaler CVEs, and the trigger is not limited to the SSLVPN login form: any endpoint or port that logs attacker-controlled header data can poison the log the script later parses. watchTowr also confirms per-CVE exploitation status across the bulletin (only CVE-2026-88771 and CVE-2026-88772 exploited; the rest patched but not reported exploited, matching this entry's existing table) and published a public detection tool. NCSC-CH, NCSC-UK and CERT-FR each issued same-day advisories confirming active exploitation.
Changed: techniques sources evidence actions body
- Update 2026-09-30T0404Z-intel
Google's Mandiant and GTIG report the exploitation campaign has run since at least early September, with government among the impacted sectors in North America and Europe, and describe post-exploitation web-server-configuration persistence, the WHIPSHOT web shell and the SLAPSHOT tunneler; eSentire places CVE-2026-88771 exploitation from 5 September. watchTowr published the CVE-2026-88772 root cause and NCSC Switzerland now lists a proof of concept for both flaws. Mandiant's interim controls (disable DTLS, block UDP/443 upstream) cover CVE-2026-88772 only, NetScaler 12.1 and 13.0 are end of life with no fix, and a shared municipal operator in Rhineland-Palatinate shut down citizen-service systems statewide as a precaution, a shutdown heise links to these NetScaler updates while the operators name no vendor.
Changed: summary immediate_action tags cves entities techniques sources evidence actions body
- Update 2026-10-02T0404Z-intel
Palo Alto Networks Unit 42's threat brief adds first-party telemetry: version fingerprinting of NetScaler Gateways from 2026-08-21, web shells delivered as .deb packages from the client-installer folder between 2026-09-04 and 2026-09-24, and a three-stage log-poisoning chain seen on 2026-09-21, with the log artifacts each leaves. Earlier text is corrected: the KEV remediation deadline is dropped; the evidence to capture before patching is an instance snapshot where the appliance is virtual (not a configuration snapshot), cited to watchTowr and Unit 42; the triage discriminator for CVE-2026-88771 now describes the logged crash-message imitation instead of a valid-session premise; the NCSC-CH, NCSC UK and CERT-FR advisories are described as relaying Citrix's confirmation, with links; the pre-notification reported by BleepingComputer is no longer presented as the source of the shutdown calls; a stale statement that NCSC-CH had not yet published an advisory is replaced; and a dead Censys link points to its canonical page.
Changed: headline summary techniques sources evidence actions immediate_action body
- Update 2026-10-04T0405Z-intel
Citrix's bulletin CTX697174 (2026-10-03) fixes CVE-2026-88779, a SAML-triggered memory overflow that the September fixed builds do not cover; Citrix confirms targeted attacks and tells SAML-configured appliances that already took the September builds to upgrade again, to 14.1-73.41, 13.1-64.28 or the FIPS builds.
Changed: summary immediate_action actions references sources evidence body
- Correction 2026-09-30T0639Z-audit
The headline says Citrix has published no workaround. The Triage line follows watchTowr's root-cause analysis for CVE-2026-88771 and GTIG's log artifacts for CVE-2026-88772, which GTIG advises alerting on individually, and the zero-day timing is cited to watchTowr. Only Mandiant's DTLS and UDP/443 controls are limited to CVE-2026-88772 and its upstream IP allow-listing is not tied to one flaw, the KEV sentence drops the US directive, a reference to an exploitation table that does not exist is removed, and the takeaway adds GTIG's sector statement.
Changed: headline body
- Improvement 2026-10-09T0255Z-intel
The pointers to the SAML builds now carry the 2026-10-08 bulletin CTX697191: identity-provider appliances need 14.1-73.46 or 13.1-64.29 (or the FIPS builds) after the 14.1-73.41 and 13.1-64.28 builds, which Citrix lists as affected by CVE-2026-107406.
Changed: summary immediate_action actions sources body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.