Citrix NetScaler: Active Exploitation and Critical Vulnerabilities

TLP CLEAR // CS-SA-26-1001

Executive Summary

The CRITICALSTART® Cyber Research Unit (CRU) is tracking active exploitation of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway appliances, which sit at the edge of many enterprise networks. Citrix has disclosed ten Common Vulnerabilities and Exposures (CVE) entries in three bulletins since September 27, 2026, and three are listed in the Known Exploited Vulnerabilities (KEV) catalog of the Cybersecurity and Infrastructure Security Agency (CISA): CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779.^{[1, 2, 5]} The first two allow remote code execution (RCE) and were exploited before fixes existed. The third is a denial of service (DoS) flaw that CISA says attackers can use to trigger code planted through CVE-2026-88771.^{[1, 4, 7]} A tenth flaw, CVE-2026-107406, was disclosed October 8 and affects some builds that fixed the earlier issues. No exploitation of it has been reported.^{[3, 15]} Organizations should inventory their appliances, upgrade to builds that address all ten, and check for compromise regardless of patch status.^{[3, 7, 11]}

Background

NetScaler ADC and Gateway appliances provide load balancing, authentication, and remote access for many organizations, so a flaw in them can expose both the appliance and the networks behind it.^[15] Publications of NetScaler zero-days began circulating on September 26, and Citrix published bulletin CTX697096 the next day. It covered eight vulnerabilities, including CVE-2026-88771, an unauthenticated command injection, and CVE-2026-88772, a memory overflow in the Datagram Transport Layer Security (DTLS) service. Both are scored 9.5 on the Common Vulnerability Scoring System (CVSS) v4.0.^{[1, 11]} Citrix reported that both were already being exploited.^[1] Customers worldwide were warned to disconnect appliances before fixes existed, and multiple hospitals did so, briefly losing patient-portal access.^[15]

On October 2, administrators reported crashes and reboots on appliances that already carried the September fixes. Citrix confirmed a separate flaw and published CTX697174 on October 3 for CVE-2026-88779, a memory overflow in Security Assertion Markup Language (SAML) processing. It affects appliances configured as a SAML service provider (SP) or identity provider (IdP), and Citrix rates it a DoS flaw (CVSS 8.7).^{[2, 13, 14]} CISA added it to KEV on October 4.

In a revision on October 9, CISA described how attackers may use it to force reboots that run code planted through CVE-2026-88771.^{[4, 5]} Reports of suspicious activity on patched appliances raised questions about a broader impact, but the evidence cited here does not establish RCE through CVE-2026-88779 itself.^{[12, 13, 14]}

On October 8, Citrix disclosed CVE-2026-107406 (CVSS 9.5), a SAML memory overflow that can lead to RCE or DoS. It applies to some builds that fixed the earlier flaws, so earlier patch plans need rechecking. Citrix said it was not aware of unmitigated exploits.^{[3, 15]} Researchers have documented web shells, tunneling tools, and credential theft on compromised appliances, which supports a thorough compromise assessment. That does not mean every exposed appliance was compromised. watchTowr reported that most attempts on its sensors were simple callbacks that tested whether the bug worked.^{[7, 9, 11]}

Vulnerability Context

Summary Table

CVE-2026-88771: Log Poisoning to Command Execution

CVE-2026-88771 is an unauthenticated command-injection vulnerability that can allow remote attackers to execute arbitrary commands. Citrix assigns it a CVSS v4.0 score of 9.5 and lists no additional feature prerequisite beyond an affected deployment^[1]. watchTowr's analysis describes how an attacker can submit a request containing attacker-controlled text that NetScaler writes into a log file. A scheduled maintenance script, ns_monuploadd_err.pl, can later pass that text to a shell.^[10] Because the request and the command execution are separated in time, and the script can take up to 24 hours to run, exploitation may not produce immediate visible activity.^{[10, 11]}

Researchers also noted that only the last matching log entry runs, so competing attackers were racing one another. A crash of the packet engine or the SAML service can trigger a warm reload that runs the last injected entry immediately.^[11] Researchers reported payloads that create web shells, edit web-server configuration, change file permissions, and collect configuration data.^{[8, 9]} Rapid7 described a payload that archives /flash/nsconfig into a web-accessible location, which could expose the configuration, encrypted credentials, and TLS (Transport Layer Security) private keys.^[9]

CVE-2026-88772: DTLS Memory Corruption

CVE-2026-88772 is a memory-overflow vulnerability in the Datagram Transport Layer Security (DTLS) implementation. Citrix assigns it a CVSS v4.0 score of 9.5 and identifies RCE or DoS as potential impacts. The vulnerability requires DTLS to be enabled, which is the default on Gateway virtual servers unless explicitly disabled^[1]. Mandiant and GTIG assessed, from frontline telemetry rather than recovered exploit code, that malformed DTLS records sent over User Datagram Protocol (UDP) port 443 corrupt memory in the NetScaler Packet Processing Engine (NSPPE) and give root access.^[7] watchTowr's analysis describes overflowing a fixed-size reassembly buffer to gain code execution.^[11]

Mandiant and GTIG reported two log patterns they associate with successful exploitation: a DTLS handshake failure with an internal-error reason, and an NSPPE exit followed by a pitboss ... NOT restarting NSPPE message.^[7] A handshake failure or crash alone does not prove successful exploitation. The surrounding sequence of events matters.

Post-Exploitation Activity

Mandiant and GTIG reported WHIPSHOT, a PHP (Hypertext Preprocessor) web shell that hides encoded command-and-control (C2) traffic in Hypertext Transfer Protocol (HTTP) headers, and SLAPSHOT, a Python tunneler that proxies traffic into internal networks. Their reporting describes reconnaissance and credential theft in at least one intrusion.^[7]

watchTowr's sensor network captured a wider range of activity, including a Sliver C2 implant, a trojanized SSH server, a Perl installer that adds an administrator account and a password-protected web shell, and an operator who sprayed SSH keys and web shells and swept for credentials and API keys. Some of this activity failed. The Perl installer's web shell did not work under default settings, because the packet engine strips the cookie it needs.^[11] Other responders reported the Platypus remote-access tool, and Binary Defense found that web shell directories do not synchronize to the high availability (HA) secondary node, so both nodes need separate triage.^[17] A reported filename or network indicator should prompt investigation, not automatically establish compromise or attribution. Conversely, the absence of a known indicator does not show that an appliance is clean.

CVE-2026-88779: SAML Memory Overflow and Denial of Service

CVE-2026-88779 affects NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Citrix assigns the vulnerability a CVSS v4.0 score of 8.7 and identifies denial of service as its documented impact. Repeated triggering may cause sustained disruption. Administrators can inspect configuration for the following entries:

• add authentication samlAction
• add authentication samlIdPProfile

These entries indicate SAML configuration and should be evaluated against the appliance's version and the conditions in CTX697174.^[2] watchTowr reproduced the crash behavior and described the vulnerability as a denial-of-service issue. Separate reporting described suspicious activity on patched appliances, including a possible binary download and one administrator logged crafted SAML usernames that fetch a payload from 213.209.159[.]55 shortly before crashes. The reports warrant investigation, but the evidence cited here does not conclusively establish RCE through CVE-2026-88779.^[13]

CRU recommends reviewing SAML-enabled appliances that experienced unexplained crashes, reboots, unusual downloads, or suspicious outbound connections during the relevant period. Correlate appliance logs, network telemetry, process activity, file changes, and evidence from both high-availability nodes.

CVE-2026-107406: Additional Critical SAML Vulnerability

CVE-2026-107406 is a separate memory-overflow vulnerability disclosed on October 8. Citrix assigns it a CVSS v4.0 score of 9.5 and identifies potential RCE or DoS. For applicability, the appliance must be configured as a SAML SP or IdP, and the role depends on the build.^[3]

• On 14.1-73.37 to 14.1-73.41, 13.1-64.23 to 13.1-64.28, and the matching FIPS and NDcPP builds, the flaw applies only when the appliance is a SAML IdP.^[3]
• On builds before 14.1-73.37 or 13.1-64.23 (and the matching FIPS and NDcPP builds), it applies when the appliance is either a SAML SP or IdP.^[3]

Finding a SAML entry in the configuration is not enough on its own. Administrators need to match the entry against the version range in CTX697191.^{[3, 16]} The bulletin lists no workaround, and removing unused SAML configurations reduces exposure but does not fix the flaw.^{[3, 17]} The disclosure alone does not show that any appliance was exploited. Rapid7's Stephen Fewer noted that memory-corruption bugs are generally harder to exploit at scale than CVE-2026-88771, and no successful exploitation had been publicly reported.^[15]

MITRE ATT&CK Mapping

The mapping below, drawn from the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework, describes behaviors that researchers observed or reported. Which techniques apply to a given intrusion depends on what an investigation establishes.

Implications for Organizations

NetScaler appliances can hold configuration data, authentication secrets, certificates, and private keys, and a compromised appliance can give an attacker a path into internal networks. Researchers have documented web shells, tunneling tools, and credential-theft activity in this campaign.^{[7, 9, 11]}

Patching and compromise assessment are separate workstreams. An appliance may be patched yet still contain persistence artifacts, and an exposed appliance is not necessarily compromised. watchTowr advises that internet-facing appliances that were unpatched should be treated as potentially compromised, and that patched appliances should still be reviewed for earlier exploitation.^[11]

If compromise is confirmed or strongly suspected, the response should extend beyond the appliance to identity infrastructure, directory services, certificates, and systems reachable through the Gateway. Credential rotation and rebuilding should be coordinated so that stolen secrets cannot be reused.^{[7, 9]} Because Citrix issued three bulletins in under two weeks, organizations may also prefer to move directly to the current target build instead of upgrading in steps.^{[1, 2, 3]}

Prioritized Mitigation Strategies

To improve your organization's security posture considering the Citrix NetScaler exploitation, CRU recommends the following:

Immediate (Within 24 hours)

• Inventory all customer-managed NetScaler instances. Include internet-facing systems, internal instances, test and disaster-recovery systems, both HA nodes, and Secure Private Access hybrid deployments. Record exact builds and editions.^{[1, 2, 3]}
• Check applicability against all three bulletins. Record SAML role, DTLS status, and relevant TCP settings for each appliance.^{[1, 2, 3]}
• Preserve evidence before rebooting or upgrading when compromise is suspected. Collect logs, technical support bundles, remote syslog records, network telemetry, and memory or virtual machine snapshots where feasible. watchTowr notes that running processes and memory-resident implants are lost on restart.^{[7, 11]}
• Upgrade to an appropriate current fixed release. Choose a build that addresses every applicable vulnerability, including CVE-2026-107406, and do not rely only on the original matrix.^[3]
• Use interim mitigations only where supported. For CVE-2026-88772, blocking inbound UDP/443 upstream or disabling DTLS on affected Gateway virtual servers may reduce exposure where appropriate, but this does not address CVE-2026-88771. For CVE-2026-88779, Citrix offers Global Deny List signatures through NetScaler Console on specific intermediate builds. For SAML issues, use only mitigations that Citrix documents for the release and configuration.^{[7, 12]}
• Restrict outbound connectivity. Investigate unexpected outbound traffic from NetScaler appliances and apply egress controls that fit operational needs. Treat the indicator table below as an aid to investigation, not a complete blocklist.^[7]
• Run available detection tooling. Use the latest Citrix-recommended indicator of compromise (IOC) scan. A clean result is one piece of evidence, not proof, and the latest script can report a false positive for nobody processes.^{[12, 17]}

Short Term

• Hunt on both HA nodes. Look for unexpected httpd.conf handlers or aliases, suspicious PHP files, unexplained setuid changes, unusual scheduled tasks, pitboss log entries containing shell characters, DTLS handshake failures followed by NSPPE exits, and unexpected authentication-service crashes. Compare findings with current vendor and researcher indicators.^{[7, 8, 10, 17]}
• Investigate SAML-related crashes and downloads. Correlate service failures, reboots, unexpected binaries, file changes, and outbound connections. A crash alone does not establish RCE but correlated suspicious activity merits forensic review even though the vendor describes the flaw as DoS.^{[4, 13]}
• Rebuild compromised appliances. Isolate affected systems as appropriate, control HA synchronization, deploy a trusted image at a fixed release, and migrate only a reviewed configuration.^{[7, 17]}
• Rotate potentially exposed secrets. Prioritize administrator credentials, LDAP (Lightweight Directory Access Protocol) bind credentials, RADIUS (Remote Authentication Dial-In User Service) and TACACS (Terminal Access Controller Access-Control System) secrets, SNMP (Simple Network Management Protocol) credentials, certificates, and private keys, and coordinate with dependent services.^{[7, 9, 11]}
• Review downstream systems for lateral movement, unauthorized authentication, or credential misuse.^{[7, 9]}
• Review Enhanced ISN Generation. For CVE-2026-88778, apply the configuration change Citrix prescribes. An upgrade alone may not satisfy it.^[1]
• Centralize logging. Forward system, application, authentication, and network events to a security information and event management (SIEM) platform and keep enough history for retrospective investigation.^[17]

Conclusion

Citrix reported exploitation of CVE-2026-88771 and CVE-2026-88772, which were exploited before fixes existed. A third flaw, CVE-2026-88779, was added to KEV and is documented by Citrix as a SAML denial-of-service issue. CISA describes how it can be used to force reboots that trigger code planted through CVE-2026-88771 on unpatched appliances, and RCE through the flaw itself is not established by the evidence cited here.^{[2, 4, 5]} Citrix then disclosed CVE-2026-107406, a critical SAML memory overflow with potential RCE or DoS impact that affects some builds that fixed the earlier flaws. Organizations need to account for it when checking patch status and SAML configuration.^[3]

The recommended response is to inventory affected instances, confirm each vulnerability's prerequisites, upgrade to an appropriate fixed release, investigate for compromise, preserve evidence where needed, and rotate secrets that may have been exposed. A successful upgrade is essential, but it does not show that an appliance is free of persistence or that downstream systems are unaffected.^{[3, 7, 9, 11]}

For more threat reports, including H2 2025 detailing trending cybersecurity concerns visit Critical Start's Intel Hub. Should anything new surface, this advisory will be updated. This advisory was written using the best intelligence available at the time and is subject to change as additional information becomes available.

What Critical Start is Doing

CRU continues to actively monitor the Citrix NetScaler exploit campaign and work closely with the SOC for heightened vigilance and Security Engineering team to implement any relevant detections. For future updates, CRU will post updates via Cyber Operations Risk & Response™ Bulletins and on the CRITICALSTART® Intelligence Hub.

Further Reading

1. [1] Citrix (September 27, 2026). NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 (CTX697096). https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html
2. [2] Citrix (October 3, 2026). NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-88779 (CTX697174). https://support.citrix.com/external/article/CTX697174/citrix-netscaler-adc-and-citrix-netscale.html
3. [3] Citrix (October 8, 2026). NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-107406 (CTX697191). https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html
4. [4] CISA (September 27, 2026; revised October 9, 2026). Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway. Read through search-result excerpts of the revision note, because the page blocked direct retrieval. https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
5. [5] CISA (October 4, 2026). CISA Adds One Known Exploited Vulnerability to Catalog. https://www.cisa.gov/news-events/alerts/2026/10/04/cisa-adds-one-known-exploited-vulnerability-catalog
6. [6] CISA. Known Exploited Vulnerabilities Catalog. Check here for the current listing status of each CVE. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
7. [7] Mandiant and Google Threat Intelligence Group (September 29, 2026). Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances. https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances/
8. [8] Unit 42, Palo Alto Networks (September 30, 2026; updated October 1, 2026). Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild. https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
9. [9] Rapid7 (September 28, 2026; updated October 5, 2026). Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772. https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/
10. [10] watchTowr Labs (September 28, 2026). Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771). https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/
11. [11] watchTowr Intel (October 7, 2026). Post-Exploitation Analysis and Artifacts: Citrix NetScaler CVE-2026-88771. https://watchtowr.com/intelligence/post-exploitation-analysis-artifacts-citrix-netscaler-cve-2026-88771/
12. [12] watchTowr (October 5, 2026; updated October 6, 2026). Frequently Asked Questions About the Citrix NetScaler Denial Of Service (Memory Overflow) (CVE-2026-88779). https://watchtowr.com/intelligence/citrix-netscaler-cve-2026-88779-faq/
13. [13] L. Abrams, BleepingComputer (October 4, 2026; updated October 5, 2026). Citrix patches NetScaler SAML zero-day exploited in attacks. https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/
14. [14] E. Kovacs, SecurityWeek (October 5, 2026). Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier. https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/
15. [15] D. Jones, Cybersecurity Dive (October 12, 2026). CISA calls on Citrix NetScaler customers to patch as new flaws disclosed. https://www.cybersecuritydive.com/news/cisa-citrix-netscaler-customers-patch-new-flaws-disclosed/832741/
16. [16] G. Baran, Cyber Security News (October 9, 2026). Citrix Urges NetScaler ADC and Gateway Customers to Patch for New Critical RCE Vulnerability. Used for build ranges only; its researcher credits differ from the Citrix bulletin. https://cybersecuritynews.com/citrix-netscaler-adc-and-gateway-rce/
17. [17] PitScaler (updated October 14, 2026). CVE-2026-88771: Citrix NetScaler unauthenticated remote code execution. Independent, sourced tracker; secondary. Relays findings from eSentire, Beazley Security, Binary Defense, the Mandiant chief technology officer, the Citrix community blog, the NHS England alert, and the October 14 KEV re-check. https://pitscaler.com/cve-2026-88771/

---

Appendix

Indicators of Compromise

The indicators below were reported in research on this campaign. Infrastructure changes, indicators may be shared or reused, and not every victim shows every artifact. Validate each indicator against its original source and observation period before operational use. watchTowr also maintains a public indicator repository.^{[7, 8, 11]}

This list is not exhaustive. Researchers reported many payloads and variations, and web shell names and hashes often differ between victims.^{[8, 11]}