---
title: "NetScaler CVE-2026-88771/88772: Exploited Pre-Auth RCE"
url: https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-88771-88772-zero-days/
description: "Two NetScaler ADC/Gateway zero-days (CVSS 9.5) exploited since early Sept 2026; fixed in 14.1-73.41/13.1-64.28 incl. SAML follow-up. Patch and hunt now."
type: security-brief
section: "Security Digest"
date_published: 2026-09-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-88771", "CVE-2026-88772", "CVE-2026-88779"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# NetScaler CVE-2026-88771/88772: Exploited Pre-Auth RCE

**Verdict: Act now.** Every customer-managed NetScaler ADC or Gateway needs the latest build today, and any appliance that was unpatched in September should be investigated as compromised, because patching does not evict attackers.

- **Who must act:** All customer-managed NetScaler ADC and Gateway 14.1 and 13.1 (including FIPS/NDcPP and Secure Private Access hybrid) deployments.
- **Who can relax:** Citrix-managed cloud services and Adaptive Authentication customers, which Citrix updates itself.
- **Affected:** NetScaler ADC and Gateway 14.1 before 14.1-73.37 (before 14.1-73.41 with SAML); NetScaler ADC and Gateway 13.1 before 13.1-64.23 (before 13.1-64.28 with SAML); NetScaler ADC FIPS before 14.1-73.37 FIPS (73.41 FIPS with SAML); NetScaler ADC FIPS and NDcPP 13.1 before 13.1-37.279 (37.282 with SAML)
- **Fixed:** 14.1-73.41 or later; 13.1-64.28 or later; 14.1-73.41 FIPS or later; 13.1-37.282 FIPS/NDcPP or later
- **CVEs:** CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Preserve evidence first: VPX snapshot, tech-support bundle, packet engine core dump, remote syslog
2. Run Citrix's NetScaler Console IOC scan and Unit 42 hunting checks
3. Upgrade to 14.1-73.41 / 13.1-64.28 (or FIPS equivalents), which also cover the SAML follow-up CVE-2026-88779
4. If compromised, restore a pre-compromise backup and rotate local passwords, KEKs and SSL certificates
5. Keep management interfaces off the internet and forward logs to a SIEM
6. Plan off 13.1, which reached End of Maintenance on September 15, 2026

### How to check if you are affected

- Search ns.log for the string 'pitboss' (on unpatched devices it indicates likely execution)
- Check for /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver and .deb files under /vpn/scripts/linux/
- Review requests to /logon/LogonPoint/Authentication/GetUserName and connections to Unit 42's listed IPs
- Look for setuid /bin/sh, unexpected PHP enablement or new aliases in httpd.conf

## What happened

On September 27, 2026, Cloud Software Group published [bulletin CTX697096](https://support.citrix.com/external/article/CTX697096) covering eight NetScaler ADC and Gateway flaws and stating that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." CVE-2026-88771 is an improper input validation bug that lets an unauthenticated attacker run arbitrary commands on any deployment in default configuration. CVE-2026-88772 is a memory overflow reachable when DTLS is enabled, which is the default on VPN virtual servers, and leads to RCE or denial of service. Both are rated CVSS 4.0 9.5 ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-88771) adds a 3.1 score of 9.8 for CVE-2026-88771). CISA added both to KEV the same day and published an [alert](https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway).

[Unit 42's reconstruction](https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/) shows these were true zero-days. Fingerprinting began on August 21. From September 4, actors used the DTLS bug to drop .deb web shells. On September 21, they ran a three-stage log-poisoning chain for CVE-2026-88771 against a U.S. target, writing commands into `ns.log` that a Perl monitoring script then executed. The last observed request came hours before the bulletin. [The Hacker News](https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html) reported that watchTowr had flagged two exploited, unpatched NetScaler RCEs the day before. No actor has been publicly named as of October 21, 2026.

A follow-up came a week later. Patched SAML appliances began rebooting, and on October 3 Citrix published [CTX697174](https://support.citrix.com/external/article/CTX697174) for CVE-2026-88779 (CVSS 4.0 8.7), a memory overflow in SAML SP/IdP configurations. Citrix classifies it as denial of service, but [BleepingComputer](https://bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks) reported administrators seeing shell commands in crafted usernames. CISA notes that a forced reboot can help code injected via CVE-2026-88771 execute. It entered KEV on October 4. CISA's alert also lists a further identifier, CVE-2026-107406 (October 9), whose bulletin we could not retrieve.

## Who is affected

Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus the FIPS/NDcPP equivalents and Secure Private Access hybrid deployments. SAML users need 14.1-73.41 or 13.1-64.28. Unit 42 counted 50,277 exposed, potentially vulnerable instances on September 27. The 13.1 branch reached End of Maintenance on September 15.

## Do you really need to act?

Yes. There is no meaningful precondition: CVE-2026-88771 works in default configuration, exploitation predates disclosure by three weeks, and NetScaler bugs historically turn into mass exploitation within days of disclosure. Patching closes the hole but, as Unit 42 stresses, does not remove persistence an attacker already planted. Anyone who was exposed in September has an investigation to do, not just an upgrade.

## What to do now

1. Before upgrading, preserve evidence: a VPX snapshot, a tech-support bundle, a packet engine core dump, and remote syslog and NetScaler Console logs.
2. Run the IOC scan Citrix published in NetScaler Console, and CISA's SIGMA rules.
3. Upgrade straight to 14.1-73.41 or 13.1-64.28 (14.1-73.41 FIPS or 13.1-37.282 FIPS/NDcPP), which covers both bulletins.
4. For CVE-2026-88778 (TCP ISN prediction), enable Enhanced ISN Generation per Citrix.
5. If you find compromise, restore a known-good backup from before the compromise, then rotate local passwords, key-encryption keys and SSL certificates, per CISA.

## How to tell if you were hit

From Unit 42: search NetScaler logs for `pitboss`, which on an unpatched device means execution was likely. Check for `/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver`, `/vpn/scripts/linux/nsg64.deb` and `nsgclient18.deb`, a setuid `/bin/sh`, and unexpected PHP or alias entries in `httpd.conf`. Treat any requests to `/logon/LogonPoint/Authentication/GetUserName` as anomalous, and match traffic against the nine IP indicators Unit 42 lists. Post-disclosure attackers may use different tooling, so a clean IOC sweep is not proof of safety.

## Timeline

- Aug 21, 2026 — Version fingerprinting of NetScaler devices begins.
- Sep 4, 2026 — CVE-2026-88772 web shell drops begin.
- Sep 15, 2026 — NetScaler 13.1 reaches End of Maintenance.
- Sep 21, 2026 — CVE-2026-88771 command injection chain used against a U.S. target.
- Sep 27, 2026 — Citrix bulletin CTX697096; both CVEs added to KEV.
- Oct 3, 2026 — CTX697174 for SAML flaw CVE-2026-88779; added to KEV Oct 4.
- Oct 9, 2026 — CISA alert updated with CVE-2026-107406.

## Sources

1. [Citrix — NetScaler ADC and NetScaler Gateway Security Bulletin CTX697096](https://support.citrix.com/external/article/CTX697096)
2. [Citrix — Security Bulletin for CVE-2026-88779 (CTX697174)](https://support.citrix.com/external/article/CTX697174)
3. [CISA — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway](https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway)
4. [Unit 42 — Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772](https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/)
5. [NVD — CVE-2026-88771](https://nvd.nist.gov/vuln/detail/CVE-2026-88771)
6. [The Hacker News — Two unpatched Citrix NetScaler flaws exploited](https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html)
7. [BleepingComputer — Citrix patches NetScaler SAML zero-day exploited in attacks](https://bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks)

---
Source page: https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-88771-88772-zero-days/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt