CVE Tools
Track your stack
Three Actively-Exploited Zero-Days Hit Citrix NetScaler in Eleven Days. One Was Running Since Early September.. CVE-2026-88771 and CVE-2026-88772 were being exploited for roughly a month before Citrix

Three Actively-Exploited Zero-Days Hit Citrix NetScaler in Eleven Days. One Was Running Since Early September.

CVE-2026-88771 and CVE-2026-88772 were being exploited for roughly a month before Citrix shipped a fix on September 27 — then a third zero-day, CVE-2026-88779, landed October 4 and is already being chained with the first.

CVE Tools5 min read

CVE-2026-88771In CISA KEVEPSS today 1.1%, 65th percentileCVSS 9.8Open the record

On September 26, 2026, admins in r/Citrix started reporting that their security teams had told them to power down NetScaler appliances — before Citrix had published anything. The next day, Citrix confirmed why: two critical remote-code-execution bugs, CVE-2026-88771 and CVE-2026-88772, had been exploited in the wild for weeks before anyone outside a handful of forensic investigators knew they existed. A week later, a third actively-exploited NetScaler bug landed, and researchers found it was already being chained with the first.

3actively-exploited NetScaler zero-daysSep 27 – Oct 4, 2026
~1 monthCVE-2026-88772 ran before disclosureper Unit 42 telemetry
2 orgsconfirmed compromised via CVE-2026-88771per Rapid7
0public PoC exploits for any of the threecve.tools index, as of Oct 11
CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsEPSS 1.1%CVSS 9.8CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of ServiceEPSS 1.3%CVSS 8.1CVE-2026-88779Memory overflow vulnerability leading to Denial of ServiceEPSS 0.6%CVSS 7.5

What the two September bugs actually are

CVE-2026-88771 is an improper-input-validation flaw (CWE-20) that lets an unauthenticated attacker run arbitrary commands. Citrix rates its attack complexity low, and watchTowr's writeup is blunt about the blast radius: it affects "every NetScaler ADC and NetScaler Gateway deployment on an affected version, including the default configuration" — no optional feature has to be switched on.

CVE-2026-88772 is a memory-overflow bug (CWE-119) that can trigger either RCE or denial of service, but only when DTLS is enabled on the appliance. Citrix rates its attack complexity high — harder to pull off than CVE-2026-88771 — but DTLS ships on by default for Gateway VPN virtual servers, so most Gateway deployments are exposed unless someone explicitly turned it off.

The exploitation timeline, from two independent vendors' telemetry

Pre- and post-disclosure exploitation of CVE-2026-88771 / CVE-2026-88772

  1. Reconnaissance begins
    Unit 42 observed two hosts fingerprinting NetScaler Gateway via CSS/JS version-check requests; activity spread to 100+ systems within a day.
  2. CVE-2026-88772 exploitation starts
    Four rotating VPS hosts began requesting .deb installer files from /vpn/scripts/linux/ — the delivery path for a PHP web shell, per Unit 42.
  3. Earliest CVE-2026-88771 attempts
    Rapid7 logged two command-injection attempts using a crafted authentication string to archive the /flash/nsconfig directory to a public web path — not yet widespread.
  4. Targeted CVE-2026-88771 activity
    Unit 42 observed three-stage command-injection activity from three IPs against a U.S.-based target.
  5. Web shell deployed
    Rapid7 observed a PHP web shell dropped at a NetScaler logon path on a second compromised organization.
  6. Last pre-disclosure request
    Unit 42's last logged anomalous request, hours before Citrix published its bulletin.
  7. Public disclosure
    Citrix bulletin CTX697096 ships patches; CISA adds both CVEs to KEV the same day.
  8. Third zero-day disclosed
    CVE-2026-88779 (SAML denial-of-service) added to KEV; researchers report it's being chained with CVE-2026-88771.

CVE-2026-88771 exploitation chain (per Rapid7 / Unit 42)

  1. Version-check recon — CSS/JS requests fingerprint NetScaler Gateway build
  2. Crafted auth string → command injection
  3. Archive /flash/nsconfig to public web path
  4. Unauthenticated download of config, creds, keys
  5. PHP web shell dropped (.ctxs.receiver)
  6. Hardcoded-cookie RCE via passthru()

What to hunt for

Indicators and hunting leads published by responders4 rules
other ×4
Known malicious infrastructure (IPs)
Hosts observed fingerprinting, exploiting or staging payloads against CVE-2026-88771/88772 since Aug 21, 2026
45.61.136.143
66.227.183.84
77.83.199.39
104.28.215.137
104.248.244.66
104.28.247.136
162.33.178.9
193.149.176.207
216.245.184.164
Unit 42 Threat Brief
On-disk artifacts
Dropped web-shell installer and hidden PHP web shell file
/vpn/scripts/linux/nsgclient18.deb
/vpn/scripts/linux/nsg64.deb
/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
Unit 42 Threat Brief
"pitboss" log-poisoning hunting queryGitHub
CVE-2026-88771 log-poisoning attempts — Unit 42 notes this does NOT indicate successful exploitation on patched devices NetScaler appliance logs
unit42.paloaltonetworks.com/netscaler-zero-days-exploited
Unit 42 Threat Brief
InsightIDR/MDR detection ruleGitHub
"Suspicious Web Request - Citrix NetScaler ADC and Gateway Appliance Exploitation (CVE-2026-88771)" Rapid7 InsightIDR or MDR
www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772
Rapid7

Then a third zero-day, chained with the first

On October 4, Citrix shipped bulletin CTX697174 for CVE-2026-88779, a memory-overflow bug (CVSS 7.5 in our v3.1 record) affecting NetScaler appliances configured as a SAML Service Provider or Identity Provider. Unlike the two RCE bugs, this one is a denial-of-service: a crafted request crashes the SAML authentication service, and the sixth crash in a row reboots the whole appliance. CISA added it to KEV the same day, with an aggressive three-day federal deadline of October 7 — a deadline that has already passed.

CVEDisclosedCVSS (vendor v4.0 / our v3.1)ImpactDefault exposureFixed in
CVE-2026-88771Sep 27, 20269.5 / 9.8Unauthenticated RCE (CWE-20)Every deployment, no config needed14.1-73.37, 13.1-64.23+
CVE-2026-88772Sep 27, 20269.5 / 8.1RCE or DoS (CWE-119)Gateway VPN with DTLS (on by default)14.1-73.37, 13.1-64.23+
CVE-2026-88779Oct 4, 20268.7 / 7.5DoS, crash-loop reboot (CWE-119)SAML SP/IdP configurations14.1-73.41, 13.1-64.28+
Citrix did a better job with their response to this vulnerability.
— Joe Toomey, Coalition, on Citrix's handling of CVE-2026-88779

The patch you shipped in August doesn't cover this

If your NetScaler fleet was fully patched for CVE-2026-19490 — the authentication-bypass bug Citrix disclosed on August 19 — that patch (build 14.1-73.32 / 13.1-63.21) does not protect against CVE-2026-88771 or CVE-2026-88772. They're unrelated bugs on the same appliance, and the fixed builds for the new pair (14.1-73.37+, 13.1-64.23+) are newer than what the August patch cycle shipped. Appliances have to be upgraded again.

  1. Upgrade to 14.1-73.41, 13.1-64.28, or the matching FIPS/NDcPP build — this supersedes the Sept 27 fix and also closes CVE-2026-88779.
  2. Before patching, per CISA's BOD 26-04 forensic-triage requirement for both September CVEs: check for the IOCs above and preserve logs/memory where possible — patching first can destroy evidence of prior compromise.
  3. Check whether /flash/nsconfig or any backup of it was ever exposed; if CVE-2026-88771 was exploited before you patched, treat nsroot credentials, SSL private keys and SSH host keys in that directory as burned and rotate them.
  4. Reduce internet exposure of the management interface where you can't patch immediately — no config-level workaround exists for CVE-2026-88771 or CVE-2026-88772.
  5. If you run SAML SP/IdP on NetScaler, patch for CVE-2026-88779 even if you consider DoS low priority — it's the one now confirmed chained with an RCE bug.

CVE data and KEV status current as of 2026-10-11