Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772

Most NetScaler advisories describe bugs that need a particular feature switched on. CVE-2026-88771 does not: Citrix lists its precondition as every deployment in the default configuration, and it lets an unauthenticated attacker run commands on the appliance. Its companion, CVE-2026-88772, is a memory overflow reached over DTLS, which VPN virtual servers enable by default.

Unit 42 found attackers fingerprinting appliances from 21 August 2026 and using web shells planted on them from 4 to 24 September, all before disclosure. Citrix published bulletin CTX697096 on 27 September, and CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same day. On 3 October Citrix published a separate bulletin, CTX697174, for CVE-2026-88779, a SAML denial-of-service bug fixed only in later builds. CISA listed it on 4 October.

Who is affected

Customer-managed NetScaler ADC and NetScaler Gateway, including Secure Private Access hybrid deployments that use NetScaler instances. Citrix says Cloud Software Group updates its own managed cloud services.

The preconditions differ. CVE-2026-88771 needs only the default configuration. CVE-2026-88772 needs DTLS: a Gateway is exposed unless DTLS is explicitly turned off, as is any other virtual server of type DTLS. CVE-2026-88779 needs the appliance to act as a SAML service provider or identity provider.

How the NetScaler flaws work

CVE-2026-88771: command execution without a login

Citrix classifies it as improper input validation (CWE-20) and scores it 9.5 in CVSS 4.0; NVD's CVSS 3.1 score is 9.8. Unit 42 watched a three-stage chain against a US target on 21 September. The attacker gets crafted text written into ns.log through a failed login, and a Perl script on the appliance later processes that log and runs the planted text as a command.

CVE-2026-88772: a memory overflow over DTLS

Citrix describes a memory overflow (CWE-119) that can lead to code execution or denial of service, also 9.5 in CVSS 4.0 but with high attack complexity. NVD scores it 8.1. Unit 42 tied it to the web shells: the attacker repeatedly fetched .deb files from /vpn/scripts/linux/, a folder that normally holds client installation packages.

CVE-2026-88779: a SAML crash, and what CISA adds

Citrix calls this a memory overflow (CWE-119) that leads to denial of service, scored 8.7 in CVSS 4.0 with an availability impact only. Its bulletin says nothing about code execution or reboots.

CISA goes further. Its alert, updated 9 October, says attackers may use the bug on unpatched systems to force a reboot that speeds up execution of code already planted through CVE-2026-88771. That is CISA's assessment, not Citrix's classification.

Is it being exploited?

Yes, by several primary accounts:

• Citrix reports exploits of CVE-2026-88771 and CVE-2026-88772 against unmitigated appliances. Its CVE-2026-88779 bulletin does not say whether that bug was exploited.
• CISA added the first two to KEV on 27 September with a 30 September deadline and forensic triage required, and CVE-2026-88779 on 4 October with a 7 October deadline.
• Unit 42 traced fingerprinting to 21 August, with the same requests sent to more than 100 other systems over two days. Web shell requests ran from 4 to 24 September, and a separate stream of attacker requests ended at 01:54 UTC on 27 September, hours before Citrix published. Unit 42 names no actor.

Unit 42 also counted 50,277 exposed instances that could be vulnerable, as of 27 September.

Check your exposure

Confirm your build, the preconditions and the published indicators before you patch:

# Gateway and AAA vservers; a VPN vserver without "-dtls OFF" meets the 88772 precondition
grep -E "^add (vpn|authentication) vserver" /nsconfig/ns.conf
 
# SAML service provider or identity provider: the 88779 precondition
grep -E "add authentication (samlAction|samlIdPProfile)" /nsconfig/ns.conf
 
# Web shell locations and Apache entries Unit 42 published
ls -la /vpn/scripts/linux/ /var/netscaler/logon/LogonPoint/custom/
grep -n "ctxs.receiver" /etc/httpd.conf
 
# Log poisoning marker from Unit 42's hunting query
grep -i "pitboss" /var/log/ns.log

Local logs rotate quickly, which is why CISA advises forwarding NetScaler logs to a SIEM. CISA also says Citrix has made indicators of compromise available through NetScaler Console.

Fix it

Follow CISA's order: look for compromise, preserve evidence, then patch. Updating can reduce what investigators can see afterward.

Upgrade to the builds in the right-hand column of the table; Citrix offers no workaround for these three CVEs. If you find signs of compromise, Citrix's CTX694799 sets out the recovery:

1. Preserve evidence: VPX snapshots, remote syslog and NetScaler Console logs, a support bundle and a Packet Engine core dump.
2. Isolate the appliance.
3. Revoke service account secrets, RADIUS shared secrets, OAuth tokens, API keys, SNMP community names and certificates, and reset accounts that signed in through the Gateway or AAA virtual servers.
4. Investigate connected systems, especially authentication servers and management jump hosts.
5. Wipe MPX appliances or replace VPX instances, upgrade, then restore a backup that predates the compromise.
6. Change local passwords, rotate key encryption keys, replace restored certificates and monitor for at least 90 days.

Detect attempts and compromise

Unit 42 published these signals:

• Web shell files. /vpn/scripts/linux/nsg64.deb, /vpn/scripts/linux/nsgclient18.deb and /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver. The SHA-256 of nsg64.deb is ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec.
• Apache changes. A <Files ".ctxs.receiver"> block in /etc/httpd.conf, aliases that serve the shell under a stylesheet-like path, and the PHP engine switched on.
• Privilege changes. /bin/sh with the SUID and SGID bits set.
• Poisoned logs. pitboss lines with "PPE missed too many heartbeats" or "PPE unexpectedly died" followed by shell-like text. On a patched appliance a match shows an attempt, not execution.
• Odd requests. Any traffic to /logon/LogonPoint/Authentication/GetUserName, which Unit 42 considers worth investigating.

Unit 42 also lists nine IP addresses as network indicators, and CISA has published Sigma rules for this activity. If any signal fired, treat the appliance as compromised and follow CTX694799.

Beyond this patch

These appliances were attacked weeks before a CVE number existed. Disclosure is a prompt to hunt for compromise, and the evidence often lives only on the box until logs rotate. Forwarding appliance logs off the device keeps that history; the SOC pipeline docs explain how Rokkhe turns forwarded events into cases with evidence attached.