erroneo.us
Search all guides⌘K

Security Digest · Sep 27, 2026 · Vulnerability · Network edge

NetScaler CVE-2026-88771/88772: Exploited Pre-Auth RCE

Two NetScaler ADC/Gateway zero-days (CVSS 9.5) exploited since early Sept 2026; fixed in 14.1-73.41/13.1-64.28 incl. SAML follow-up. Patch and hunt now.

Published By erroneo.us Security Desk · Updated 3 min read7 sources

Our verdict

Act now

Every customer-managed NetScaler ADC or Gateway needs the latest build today, and any appliance that was unpatched in September should be investigated as compromised, because patching does not evict attackers.

Who must act: All customer-managed NetScaler ADC and Gateway 14.1 and 13.1 (including FIPS/NDcPP and Secure Private Access hybrid) deployments.

Who can relax: Citrix-managed cloud services and Adaptive Authentication customers, which Citrix updates itself.

Affected
NetScaler ADC and Gateway 14.1 before 14.1-73.37 (before 14.1-73.41 with SAML)
NetScaler ADC and Gateway 13.1 before 13.1-64.23 (before 13.1-64.28 with SAML)
NetScaler ADC FIPS before 14.1-73.37 FIPS (73.41 FIPS with SAML)
NetScaler ADC FIPS and NDcPP 13.1 before 13.1-37.279 (37.282 with SAML)
Fixed in
14.1-73.41 or later
13.1-64.28 or later
14.1-73.41 FIPS or later
13.1-37.282 FIPS/NDcPP or later
CVSS
9.5 (v4.0, vendor)
EPSS
1.3% (percentile 70)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Preserve evidence first: VPX snapshot, tech-support bundle, packet engine core dump, remote syslog
  2. Run Citrix's NetScaler Console IOC scan and Unit 42 hunting checks
  3. Upgrade to 14.1-73.41 / 13.1-64.28 (or FIPS equivalents), which also cover the SAML follow-up CVE-2026-88779
  4. If compromised, restore a pre-compromise backup and rotate local passwords, KEKs and SSL certificates
  5. Keep management interfaces off the internet and forward logs to a SIEM
  6. Plan off 13.1, which reached End of Maintenance on September 15, 2026

How to check if you are affected or compromised

  • Search ns.log for the string 'pitboss' (on unpatched devices it indicates likely execution)
  • Check for /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver and .deb files under /vpn/scripts/linux/
  • Review requests to /logon/LogonPoint/Authentication/GetUserName and connections to Unit 42's listed IPs
  • Look for setuid /bin/sh, unexpected PHP enablement or new aliases in httpd.conf

What happened#

On September 27, 2026, Cloud Software Group published bulletin CTX697096 covering eight NetScaler ADC and Gateway flaws and stating that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." CVE-2026-88771 is an improper input validation bug that lets an unauthenticated attacker run arbitrary commands on any deployment in default configuration. CVE-2026-88772 is a memory overflow reachable when DTLS is enabled, which is the default on VPN virtual servers, and leads to RCE or denial of service. Both are rated CVSS 4.0 9.5 (NVD adds a 3.1 score of 9.8 for CVE-2026-88771). CISA added both to KEV the same day and published an alert.

Unit 42's reconstruction shows these were true zero-days. Fingerprinting began on August 21. From September 4, actors used the DTLS bug to drop .deb web shells. On September 21, they ran a three-stage log-poisoning chain for CVE-2026-88771 against a U.S. target, writing commands into ns.log that a Perl monitoring script then executed. The last observed request came hours before the bulletin. The Hacker News reported that watchTowr had flagged two exploited, unpatched NetScaler RCEs the day before. No actor has been publicly named as of October 21, 2026.

A follow-up came a week later. Patched SAML appliances began rebooting, and on October 3 Citrix published CTX697174 for CVE-2026-88779 (CVSS 4.0 8.7), a memory overflow in SAML SP/IdP configurations. Citrix classifies it as denial of service, but BleepingComputer reported administrators seeing shell commands in crafted usernames. CISA notes that a forced reboot can help code injected via CVE-2026-88771 execute. It entered KEV on October 4. CISA's alert also lists a further identifier, CVE-2026-107406 (October 9), whose bulletin we could not retrieve.

Who is affected#

Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus the FIPS/NDcPP equivalents and Secure Private Access hybrid deployments. SAML users need 14.1-73.41 or 13.1-64.28. Unit 42 counted 50,277 exposed, potentially vulnerable instances on September 27. The 13.1 branch reached End of Maintenance on September 15.

Do you really need to act?#

Yes. There is no meaningful precondition: CVE-2026-88771 works in default configuration, exploitation predates disclosure by three weeks, and NetScaler bugs historically turn into mass exploitation within days of disclosure. Patching closes the hole but, as Unit 42 stresses, does not remove persistence an attacker already planted. Anyone who was exposed in September has an investigation to do, not just an upgrade.

What to do now#

  1. Before upgrading, preserve evidence: a VPX snapshot, a tech-support bundle, a packet engine core dump, and remote syslog and NetScaler Console logs.
  2. Run the IOC scan Citrix published in NetScaler Console, and CISA's SIGMA rules.
  3. Upgrade straight to 14.1-73.41 or 13.1-64.28 (14.1-73.41 FIPS or 13.1-37.282 FIPS/NDcPP), which covers both bulletins.
  4. For CVE-2026-88778 (TCP ISN prediction), enable Enhanced ISN Generation per Citrix.
  5. If you find compromise, restore a known-good backup from before the compromise, then rotate local passwords, key-encryption keys and SSL certificates, per CISA.

How to tell if you were hit#

From Unit 42: search NetScaler logs for pitboss, which on an unpatched device means execution was likely. Check for /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, /vpn/scripts/linux/nsg64.deb and nsgclient18.deb, a setuid /bin/sh, and unexpected PHP or alias entries in httpd.conf. Treat any requests to /logon/LogonPoint/Authentication/GetUserName as anomalous, and match traffic against the nine IP indicators Unit 42 lists. Post-disclosure attackers may use different tooling, so a clean IOC sweep is not proof of safety.

Timeline#

  • — Version fingerprinting of NetScaler devices begins.
  • — CVE-2026-88772 web shell drops begin.
  • — NetScaler 13.1 reaches End of Maintenance.
  • — CVE-2026-88771 command injection chain used against a U.S. target.
  • — Citrix bulletin CTX697096; both CVEs added to KEV.
  • — CTX697174 for SAML flaw CVE-2026-88779; added to KEV Oct 4.
  • — CISA alert updated with CVE-2026-107406.

Vulnerability records

  • CVE-2026-88771 · KEV 2026-09-27 · Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88772 · KEV 2026-09-27 · Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
  • CVE-2026-88779 · KEV 2026-10-04 · Vulnerability in NetScaler ADC and NetScaler Gateway.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Citrix — NetScaler ADC and NetScaler Gateway Security Bulletin CTX697096 support.citrix.com
  2. Citrix — Security Bulletin for CVE-2026-88779 (CTX697174) support.citrix.com
  3. CISA — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway cisa.gov
  4. Unit 42 — Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 unit42.paloaltonetworks.com
  5. NVD — CVE-2026-88771 nvd.nist.gov

Coverage and analysis

  1. The Hacker News — Two unpatched Citrix NetScaler flaws exploited thehackernews.com
  2. BleepingComputer — Citrix patches NetScaler SAML zero-day exploited in attacks bleepingcomputer.com