Vulnerability Alerts28 September 20263 min read

Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: patch today, then assume compromise

Two critical remote code execution flaws in NetScaler ADC and Gateway were exploited a week before disclosure. Patching closes the door; it does not evict anyone who already walked through it.

By the Aureon Intelligence analyst team

On 27 September 2026 Citrix disclosed two critical vulnerabilities in NetScaler ADC and NetScaler Gateway, and the US Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities catalogue the same day. Exploitation had started at least a week earlier. For any organisation that exposes a NetScaler appliance to the internet, the question is no longer whether to patch but whether the appliance was already compromised before the patch existed.

What was disclosed

  • CVE-2026-88771 is an improper input validation flaw (CWE-20) that allows unauthenticated remote code execution in the default configuration. It carries a CVSS v4 score of 9.5 with low attack complexity.
  • CVE-2026-88772 is a memory overflow (CWE-119) that leads to remote code execution when DTLS is enabled. It also carries a CVSS v4 score of 9.5, with high attack complexity.

Both issues affect NetScaler ADC and NetScaler Gateway, including the FIPS and NDcPP variants. Fixed builds are 14.1-73.37 and later, 13.1-64.23 and later on the 13.1 branch, 14.1-FIPS 14.1-73.37 and later, and 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later.

The timeline matters more than the score

Rapid7's telemetry places the earliest exploitation attempts on 20 September 2026, with webshell deployment observed from 24 September. Disclosure followed on 27 September. That is a seven-day window in which a fully patched appliance did not exist.

This pattern is now routine for edge devices: VPN gateways, application delivery controllers and SD-WAN managers are high-value, internet-facing and rarely covered by endpoint detection. Adversaries invest in them because one foothold on an appliance yields authenticated access to everything behind it.

Indicators published so far

Rapid7 published a webshell artefact associated with the campaign:

  • Path: /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
  • SHA-256: ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1

Treat this as a starting point, not a complete list. Operators vary their tooling, and a clean search for one file does not establish a clean appliance.

What to do now

  1. Patch on an emergency basis. Upgrade to the fixed builds outside the normal change window. If you cannot patch immediately, restrict access to the management and virtual server interfaces and disable DTLS where it is not required.
  2. Hunt before you trust. Review the appliance file system for unexpected files in the logon customisation directories, inspect recent configuration changes, and compare the running configuration against a known-good backup. Export and preserve logs before they rotate.
  3. Rotate what the appliance can see. If compromise is confirmed or cannot be excluded, treat session tokens, service account credentials, TLS private keys and any stored secrets as exposed. Terminate active sessions after patching.
  4. Look behind the appliance. A webshell on a NetScaler is rarely the objective. Check for new accounts, Kerberos ticket anomalies, lateral movement from the appliance's subnet and outbound connections to unfamiliar infrastructure.
  5. Record the decision trail. Insurers and regulators will ask when you knew, what you did and why. A dated log of patching, hunting and containment decisions is worth more than any single indicator.

When to call for help

If you find the webshell, if logs are missing for the exposure window, or if the appliance terminates VPN access for privileged users, engage an incident response team before rebuilding. Rebuilding destroys the evidence that tells you how far the intrusion went, and that evidence is what determines your notification obligations and your insurance position.

Sources

CitrixNetScalerzero-dayKEVincident response
This article is provided for general information and reflects public sources and the authors' professional opinion at the date of publication. Vulnerability details and recommendations change quickly; validate them against vendor advisories and your own environment before acting.
Keep reading

More insights.

All insights
Threat Landscape2 October 20264 min read

ClickFix inside ChatGPT: Malicious Custom GPTs used to deliver a remote access trojan

Attackers bought search ads for the word chatgpt, published fake Custom GPTs on the real ChatGPT domain and sent users to a counterfeit Cloudflare check that ends with a PowerShell command. The domain is no longer the signal. The instruction is.

Read article
Threat Landscape2 October 20265 min read

TerminalFix: The ClickFix lure moves to Windows Terminal and ends in a covert tunnel

Sophos links a campaign it tracks as STAC4924 to the group behind Vice Society and Rhysida. The chain hides shellcode as English words, fetches its servers from a forum profile and leaves a Python tunnel on the host. No encryption has been seen yet, which is exactly the point.

Read article
Vulnerability Alerts2 October 20265 min read

Zimbra CVE-2026-73570: What intruders did on compromised mail servers, and what to check on yours

An unauthenticated command injection in the SNMP notification path of Zimbra Collaboration was probed before public disclosure and exploited at scale afterwards. Microsoft's reconstruction shows web shells, a route to root through PAM, credential dumps and a cloud exfiltration attempt. The fix is 10.1.20. The work starts after the patch.

Read article