Two Citrix NetScaler Zero-Days, Three Weeks Undetected, and Now Mass Exploitation

Citrix published a security bulletin on September 27, 2026 covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway, its application delivery controllers and remote-access gateways. Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited as zero-days before the fix existed. Both carry a CVSS 4.0 base score of 9.5, at the top of the critical band.

Related reading: Fortinet's FortiMail Zero-Day Lets Attackers Write Files Without Logging In · Cisco's SD-WAN Manager Zero-Day Lets Attackers In as Admin.

The same day, the U.S. Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog, saying it had received reports and partner threat intelligence confirming that attackers were exploiting them globally. For the thousands of organizations that terminate VPN and remote access on a NetScaler appliance, the message echoes CitrixBleed in 2023: treat the perimeter device as a target, and do not assume a patch alone clears an intruder who arrived before it.

What Citrix disclosed on September 27

The bulletin, CTX697096, fixes eight CVEs. The two that matter most are the exploited ones.

CVE-2026-88771 is an improper input validation flaw (CWE-20) that lets an unauthenticated attacker run arbitrary operating system commands on the appliance. According to Rapid7, it affects vulnerable deployments in their default configuration, with no optional feature required, and the vendor rated its attack complexity as low. That combination is what turned a targeted intrusion into a broad automated hunt once details became public.

CVE-2026-88772 is a memory overflow (CWE-119) that can lead to remote code execution or a denial of service when DTLS is enabled, which it is by default on VPN virtual servers. Citrix rated its attack complexity as high, and no public proof-of-concept had surfaced as of Help Net Security's report on September 29.

The remaining six CVEs, CVE-2026-88773 through CVE-2026-88778, were not reported as exploited. They include an HTTP request smuggling flaw rated 9.3 and several memory overflows rated 8.8. CVE-2026-88778 is a predictable TCP initial-sequence-number flaw (CWE-342) that the upgrade alone does not close: administrators must also enable Enhanced ISN Generation.

Citrix's fixed builds are 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1-37.279 and later for the 13.1-FIPS and 13.1-NDcPP branches. The bulletin lists no workaround. On the 13.1 branch, watchTowr advises running show ns variable first, because appliances with variables defined should move to 13.1-64.24 to avoid a reboot loop during the upgrade.

Weeks of quiet access before the warning

The disclosure compressed a longer timeline than the dates suggest. Mandiant researchers told CyberScoop that the earliest known exploitation of CVE-2026-88772 happened on September 3, 2026, more than three weeks before Citrix confirmed it. Google's threat intelligence group and Mandiant later said the campaign had been ongoing since at least early September.

By the time the bulletin landed, Mandiant said organizations in North America and Europe across government, financial services, education, telecom, and legal and professional services had likely been compromised. "We are aware of dozens of impacted organizations," Mandiant Consulting CTO Charles Carmakal wrote on LinkedIn, attributing the activity to advanced and suspected state-sponsored threat actors.

The intrusions were not smash-and-grab. Palo Alto Networks' Unit 42 documented a .deb-packaged PHP web shell that provided remote command execution plus file exfiltration and upload, with command-and-control traffic encrypted under a hard-coded key. In another chain tied to CVE-2026-88771, attackers used three stages of log poisoning to get a PHP shell executed by a NetScaler Perl script, then patched Apache's httpd.conf to serve the shell under a filename that looked like a versioned CSS asset. Google's threat intelligence group and Mandiant later named the toolkit: WHIPSHOT, a PHP web shell, and SLAPSHOT, a Python TCP tunnel that let the intruder pivot into internal networks, The Register reported.

Rapid7 said it observed exploitation attempts as early as September 20, including a command that archived /flash/nsconfig, the directory holding the device configuration, encrypted admin passwords, SSL certificates and private keys, and wrote the archive to a web-served path. On a vulnerable appliance, the archive could be downloaded without authentication.

GreyNoise, which runs a sensor network that records attacker behavior, said it caught an attempt to exploit CVE-2026-88771 against a NetScaler Gateway on September 24, three days before public disclosure. The attempt failed on the sensor, according to the firm, but it exposed a playbook: obtain admin access, hide a web shell behind a fake stylesheet address, scrub the logs, and restart the server.

Why edge appliances keep getting hit

NetScaler appliances sit at the edge of enterprise networks, terminating VPN and remote access, load-balancing traffic, and authenticating users. A compromised appliance hands an attacker a foothold that endpoint detection tools do not see, because the device does not run an endpoint agent. That is why these products keep appearing in exploitation campaigns.

The recent history is crowded. CVE-2023-4966, known as CitrixBleed, was a NetScaler buffer overflow; CVE-2025-5777, CitrixBleed 2, was an out-of-bounds read. A 2026 run of flaws followed, including CVE-2026-19490, which CISA added to KEV on September 9, and CVE-2026-8452, added August 26. Google's threat intelligence group attributed about half of enterprise-related zero-days in 2025 to security and networking products.

The public exposure is large. Censys told Help Net Security it detects around 42,000 internet-facing NetScaler hosts, with the United States accounting for 13,549 (32%), Germany 5,678 (13%), and the Netherlands, United Kingdom and Switzerland roughly 4% each. Palo Alto Networks' Cortex Xpanse put the number of potentially vulnerable exposed instances at 50,277 as of September 27. Security researcher Kevin Beaumont said his firmware-version scanning found fewer than 10% of exposed hosts patched, and that he was tracking more than 100 victim organizations.

Once watchTowr Labs published a root-cause analysis and a proof-of-concept for CVE-2026-88771, the character of the attacks changed. Xavier Bellekens, chief executive of the deception firm Lupovis, told Help Net Security that his sensors recorded live exploitation within minutes of the PoC's release. "If you run NetScaler and you haven't patched, assume you are already being probed," he said.

CERT-EU published its own advisory, 2026-014, with technical detail and threat-hunting pointers, and other national CERTs issued alerts. The transition from private exploitation to a public free-for-all took days. The root-cause write-up and PoC appeared soon after the patch, and the scanners followed within minutes. That compressed window leaves little room for the staged rollout large enterprises usually prefer, and it is now the normal pattern for internet-facing products rather than an exception.

"Patching alone may not eradicate the threat actor from your environment." — Charles Carmakal, CTO of Mandiant Consulting

What defenders should do first

The patch is necessary, but it is not the first step, and it may not be sufficient on its own. CISA's alert asks organizations to check for signs of compromise before patching, because an update "may result in loss of forensic visibility." Carmakal made the same point: examine systems for compromise before upgrading, preserve evidence of web shells or other malicious files, and investigate the scope of the intrusion. If an attacker already had root, changing the software underneath them removes the entry point without removing the intruder.

watchTowr's guidance runs through the sequence: capture logs, a snapshot, a support bundle and a core dump from each exposed appliance; run Citrix's IOC scan or request the indicators; install the fixed build; rotate passwords, secrets and certificates stored on or used through the appliance; and keep management interfaces off the public internet. Because a compromised NetScaler can expose VPN credentials and session tokens, responders should assume those are burned, rotate them, and terminate active sessions.

Caveats

A few limits are worth keeping in view. Who is behind the attacks remains unknown: neither Citrix, CISA nor Google has publicly attributed the campaign, and watchTowr chief executive Benjamin Harris told The Register there was no clear trend among targets. The link between the two exploited CVEs is also unsettled; GreyNoise observed CVE-2026-88771 attempts from September 24, while Mandiant traced CVE-2026-88772 to September 3, and researchers say the two campaigns may or may not involve the same actors.

Citrix's detection script has its own gap. The vendor told Help Net Security it "might fail to identify actual compromises," since attackers change tactics and infrastructure. A clean scan is therefore not proof of safety. The exposed-host counts are point-in-time measurements from internet scanners that cannot see whether a given appliance is patched or already compromised, and the number of victim organizations is a floor, not a total.

There is also the question of why disclosure took so long. watchTowr warned publicly on September 26 that unpatched NetScaler RCE flaws were being exploited, a day before Citrix published. The Dutch national cyber security centre had privately notified some parties earlier. Citrix has said it found the flaws while investigating incidents in customer environments, which means both the exploitation and the vendor's awareness predated any public alert.

What to watch

Three things will show how far this goes. The first is whether a public exploit for CVE-2026-88772 appears. CVE-2026-88771 already has one, and that is what triggered the current mass scanning; a second PoC would lower the barrier for the harder-to-exploit bug and widen the pool of attackers. The second is attribution. If governments or vendors name a state-linked group, the incident shifts from a patching story to a geopolitical one. The third is how many compromised organizations surface after the fact. Mandiant's "dozens" is an early figure, and the victim tally from independent researchers suggests the true count is still climbing. NetScaler appliances also tend to stay in service for years, so a portion of the exposed estate will remain unpatched long after the news cycle moves on, and each of those hosts is a standing invitation for whichever actor arrives last.

For now the practical instruction is narrow and urgent. If an internet-facing NetScaler ADC or Gateway has not been updated to a fixed build, it should be treated as exposed. If it has been updated, it still deserves a compromise check before anyone trusts it again.

Cover: The Citrix headquarters building. Photo by Coolcaesar via Wikimedia Commons, CC BY-SA 3.0.