Citrix NetScaler zero-days CVE-2026-88771-88778 exploited in wild

1. Executive summary

Citrix patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway on 27 September 2026, two of which, CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5 critical and both in CISA KEV since 2026-09-27, were exploited as zero-days to plant web shells on internet-facing appliances. Google Threat Intelligence Group and Mandiant report the campaign has run since at least early September against government, financial services, education, and legal and professional services organisations in North America and Europe, using custom malware (WHIPSHOT, SLAPSHOT) to hold persistent root access and tunnel traffic into internal networks. EPSS puts exploitation probability at 82% for CVE-2026-88771 and 78% for CVE-2026-88772, so unpatched appliances should be treated as compromised until proven otherwise. For EMEA financial services the exposure is direct: NetScaler terminates VPN and reverse-proxy traffic at the perimeter, and root on that appliance gives an attacker control of how the internal network talks to the outside. No actor has been publicly attributed.

2. Regulatory framing

3. Technical analysis & attack chain

NetScaler ADC and Gateway consolidate reverse proxy, load balancing, WAF, firewall, and SSL VPN on one appliance. Root on that appliance gives an attacker control of the boundary between the internal network and the internet. The eight CVEs disclosed on 27 September 2026 are tracked sequentially from CVE-2026-88771 to CVE-2026-88778. Two were exploited before patches existed.

Confirmed exploitation sequence, from the sources:

1. Reconnaissance and first exploitation attempts predate disclosure. GreyNoise observed an attempt to exploit CVE-2026-88771 against a NetScaler Gateway on 24 September 2026. Google researchers place the CVE-2026-88772 campaign as ongoing since at least early September.
2. Initial access is unauthenticated remote code execution. CVE-2026-88771 lets an unauthenticated attacker execute arbitrary commands remotely (CWE-20, improper input validation). CVE-2026-88772 is a memory overflow (CWE-119) that leads to remote code execution or denial of service when DTLS is enabled, which it is by default on VPN virtual servers.
3. Post-exploitation plants web shells. Help Net Security reports the two zero-days were used to plant web shells on compromised devices. Google and Mandiant describe custom malware used to establish persistent root access and proxy traffic into internal corporate networks: WHIPSHOT, a PHP web shell disguised as a Debian package that hides Base64-encoded command-and-control payloads in native HTTP headers and functions as an HTTP transport, and SLAPSHOT, a TCP tunnelling tool written in Python.
4. A separate crash bug was used to accelerate the intrusion. CVE-2026-88779, disclosed after the initial batch and not part of the eight above, is a memory overflow affecting instances configured as a SAML service provider or SAML identity provider. Citrix describes it as a denial-of-service issue with no identified impact on data integrity. WatchTowr reproduced it and assesses it is a DoS bug that can only crash systems, and suspects it was used to deliberately crash machines to make exploitation of CVE-2026-88771 faster. Kevin Beaumont, who calls CVE-2026-88771 and CVE-2026-88772 "PitScaler" and CVE-2026-88779 "PitScaler 2", reported exploitation attempts against patched honeypots and a honeypot running a downloaded malware binary. CISA added CVE-2026-88779 to KEV on 4 October 2026 with a 7 October remediation deadline.
5. A second exploitation path was observed against already-patched appliances. Administrators reported reboots of fully patched systems. Logs showed authentication requests carrying shell commands hidden in the username field, intended to fetch and run a malicious script. One administrator who obtained the script said it attempts to plant web shells, survive reboots, and upload the appliance's configuration and backups, but cautioned there is no proof the script actually ran.

The remaining CVEs in the 27 September batch, CVE-2026-88773 through CVE-2026-88778, are not described individually in the sources beyond their classification. The verified data records CVE-2026-88773 as HTTP request smuggling (CWE-444, CVSS 9.3, EPSS 3%), CVE-2026-88774 as improper input validation (CWE-20, CVSS 7.0, EPSS 0%), CVE-2026-88775 as classic buffer overflow (CWE-120, CVSS 8.8, EPSS 1%), CVE-2026-88776 and CVE-2026-88777 as memory buffer restriction flaws (CWE-119, CVSS 8.8, EPSS 1%), and CVE-2026-88778 as CWE-342 (CVSS 8.8, EPSS 1%). None of these six is in CISA KEV. The source text does not give per-CVE mechanism detail for them, and this advisory does not infer any.

Attribution is unconfirmed. No actor has been publicly named. Google and Mandiant describe the targeting set without naming a group. watchTowr's Benjamin Harris said no attribution has been made public and no clear trend by industry or organisation size has emerged, adding that NetScaler vulnerabilities have historically been exploited by both state-sponsored groups and ransomware operators. DataBreaches.net refers to "suspected state hackers" but this is a headline characterisation, not an attribution. No MITRE ATT&CK profile is available for any named actor in this item because none has been named. Treat all actor claims as unconfirmed.

Confidence caveats. The post-exploitation toolkit detail (WHIPSHOT, SLAPSHOT, the Debian-package disguise, Base64 payloads in HTTP headers) rests on the Google Threat Intelligence Group and Mandiant advisory as reported by The Register; it is single-sourced to that reporting and should be verified against the original Google advisory before it is used for hunting. The username-field shell-command technique and the script's capabilities rest on Reddit user reports relayed by SecurityWeek, with the administrator's own caveat that the script may not have run; treat as unconfirmed. The claim that CVE-2026-88779 was used to accelerate CVE-2026-88771 exploitation is watchTowr's suspicion, not a confirmed fact. The "50,000 devices may still be exposed" figure appears only in a DataBreaches.net headline summarising a Datawater report and is not corroborated elsewhere in the sources.

4. Mitigation & containment

P1, within 24 hours.

• Hunt for compromise before patching. Mandiant's Charles Carmakal advises NetScaler customers to examine systems for compromise before upgrading, because patching alone may not eradicate the actor. Search the appliance for web shells and unexpected files, and preserve evidence before remediation.
• Patch CVE-2026-88771 and CVE-2026-88772 to the Citrix fixed build. Both are in CISA KEV with a 2026-09-27 addition date. If a patch cannot be applied immediately, restrict or disconnect the edge-facing deployment, which is the interim measure administrators took over the weekend of 26 September.
• Patch CVE-2026-88779 on any instance configured as a SAML service provider or SAML identity provider. It is in CISA KEV with a 7 October 2026 federal deadline and has been used to crash appliances.
• Review authentication logs for shell commands embedded in the username field of authentication requests, the technique reported against patched appliances.
• Check for outbound HTTP traffic from the appliance carrying Base64-encoded content in native HTTP headers, consistent with the WHIPSHOT transport described by Google and Mandiant.

P2, within 72 hours.

• Patch the remaining six CVEs from the 27 September batch: CVE-2026-88773 (request smuggling, CVSS 9.3), CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778. None is in KEV and EPSS is at or below 3% for each, so they rank below the two exploited zero-days, but they are the same appliance and the same patch cycle.
• Where DTLS is enabled on VPN virtual servers, confirm the CVE-2026-88772 fix is applied; DTLS is on by default on those servers and is the precondition for the memory overflow.
• Inventory every NetScaler ADC and Gateway instance, including virtual appliances and any managed by a third party, and confirm build version against the Citrix advisory.

P3, within 7 days.

• Watch for follow-on advisories. The source notes a gap in CVE publishing from CVE-2026-88779 through CVE-2026-88787 and expects further Citrix patches; keep the emergency patch process ready.
• Review third-party contracts for notification obligations covering exploited vulnerabilities disclosed after incident response at other customers, given the source's account that the flaws were found during forensic work at already-compromised organisations.
• If compromise is confirmed, run the DORA Art. 19 classification and reporting process and preserve appliance configuration and backups, which the reported script attempted to upload.

5. Indicators of compromise

No atomic indicators (file hashes, domains, IP addresses, file paths) are present in the source material. The sources describe behaviours and named malware families but give no machine-pivotable values.

Behavioural indicators:

6. Detection

The sources give no file hashes, mutex names, registry keys, or hard-coded strings from the malware itself. The named malware (WHIPSHOT, SLAPSHOT) and the techniques are described at capability level only, with no artefacts that would appear in a malicious file or command line. A YARA rule built on product names or CVE identifiers would detect reporting about the threat, not the threat, so none is emitted.

For Sigma, the one log-observable behaviour with enough specificity is shell metacharacters or command syntax in the username field of an authentication event. This is a behavioural rule keyed to the reported technique; tune the field name to your NetScaler log schema before deployment.

title: NetScaler Authentication Username Field Carries Shell Command
id: 8f3c2a10-6b7e-4d21-9a55-1c0e7b4d9f62
status: experimental
description: Detects authentication requests where the username field contains shell metacharacters or command syntax, consistent with reported post-exploitation against Citrix NetScaler appliances.
author: Adverse Trace
date: 2026-10-27
references:

  - https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/
logsource:
  product: citrix
  service: netscaler
detection:
  selection:
    username|contains:

      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
      - 'curl '
      - 'wget '
      - '/bin/sh'
  condition: selection
falsepositives:

  - Legitimate usernames containing shell metacharacters (rare; verify against directory)
level: high

CVE assessment

8 referenced CVEs — 2 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

7. Sources

• SecurityWeek, "This is Fine: What NetScaler Zero-Days Tell Us about the New Normal", https://www.securityweek.com/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal/, 2026-10-27
• SecurityWeek, "Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier", https://www.securityweek.com/exploitation-of-citrix-netscaler-zero-day-hits-appliances-patched-days-earlier/, n.d.
• SecurityWeek, "Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug", https://www.securityweek.com/citrix-confirms-2-netscaler-zero-days-after-admins-pulled-the-plug/, n.d.
• Tenable Research, "Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities", https://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities, n.d.
• Help Net Security, "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)", https://www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/, 2026-09-28
• The Register, "Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services", https://www.theregister.com/security/2026/09/29/custom-malware-used-in-citrix-0-day-attacks-targeting-govt-banks-professional-services/5299867, 2026-09-29
• DataBreaches.net, "Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.", https://databreaches.net/2026/10/01/suspected-state-hackers-exploited-citrix-netscaler-for-weeks-50000-devices-may-still-be-exposed/, 2026-10-01

8. Adverse Trace position

Adverse Trace assesses CVE-2026-88771 and CVE-2026-88772 as the priority for EMEA financial services clients: both are CVSS 9.5 critical, both are in CISA KEV since 2026-09-27, and EPSS puts exploitation probability at 82% and 78% respectively, against a campaign Google and Mandiant place as running since at least early September against financial services firms in Europe. CVE-2026-88779 is a secondary priority: in KEV since 4 October 2026, used to crash appliances, and assessed by WatchTowr as DoS-only. The remaining six CVEs are not in KEV and carry EPSS of 3% or below. Attribution is unconfirmed and we will not assign one until a named actor with a MITRE ATT&CK profile is published. The post-exploitation toolkit detail is single-sourced to Google and Mandiant as reported by The Register and should be verified against the original advisory before it is used for hunting. We will monitor for the follow-on Citrix advisories the source anticipates in the CVE-2026-88779 to CVE-2026-88787 range and issue an update if a new exploited NetScaler CVE is confirmed, and we will re-issue this advisory if a credible attribution is published.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.