Citrix NetScaler Zero-Days: Why Patching Isn’t Enough

If you patched your Citrix NetScaler the day the fix came out, you might still have an attacker on the box.

That’s the hard truth about CVE-2026-88771 and CVE-2026-88772, two critical NetScaler ADC and NetScaler Gateway zero-days that were exploited for weeks before Citrix disclosed them on 27 September 2026. Attackers used them to plant web shells — and a web shell doesn’t disappear when you install an update.

This guide covers what the vulnerabilities are, the exploitation timeline, the indicators to hunt for, and the order to do things in so you don’t destroy the evidence you need.

The two zero-days at a glance

Citrix’s bulletin CTX697096 covers CVE-2026-88771 through CVE-2026-88778. CISA has since expanded its alert to ten CVEs, adding CVE-2026-88779 (KEV-listed 4 October; a denial-of-service flaw in SAML SP/IdP configurations that, on unpatched devices, can force a reboot which may help trigger code injected via CVE-2026-88771) and CVE-2026-107406.

New to CVE identifiers and scoring? See our beginner’s guide to CVEs.

Timeline: exploited long before disclosure

• 21–22 August 2026 — Palo Alto Networks Unit 42 observed hosts fingerprinting NetScaler versions across more than 100 systems.
• 4–24 September — DTLS exploitation (CVE-2026-88772) used to drop web shells disguised as VPN client packages.
• 21 September — CVE-2026-88771 used against a U.S. target to deploy a PHP web shell.
• 27 September — Citrix publishes CTX697096; CISA adds both CVEs to KEV with a 30 September federal deadline. Mass scanning follows. Unit 42’s Cortex Xpanse counted 50,277 exposed, potentially vulnerable instances that day.
• 4–9 October — CVE-2026-88779 added to KEV; CISA’s alert updated to cover ten CVEs.

Researcher Kevin Beaumont has also reported web shell activity dating back to early September. In other words: if your NetScaler was internet-facing in September, assume it was probed.

What attackers did after getting in

Unit 42’s analysis describes two distinct post-exploitation paths:

• Via CVE-2026-88772: a PHP web shell packaged as a .deb file in the VPN client scripts folder, offering command execution, file upload and data exfiltration over RC4-encrypted traffic, and abusing a NetScaler SUID binary to escalate privileges.
• Via CVE-2026-88771: a multi-stage command injection that ends with a hidden PHP web shell in the Gateway logon directory. The attacker then modified the Apache configuration to serve the shell under a disguised path and reloaded Apache — persistence that survives an appliance update.

Other responders have reported attackers using cron jobs to remove forensic artifacts, which is why evidence preservation matters so much here.

Indicators to hunt for

From Unit 42’s published indicators:

• Files: /vpn/scripts/linux/nsgclient18.deb, /vpn/scripts/linux/nsg64.deb, /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
• Configuration: unexpected changes to /etc/httpd.conf, especially anything that enables PHP or maps unusual paths
• Privileges: SUID/SGID bits set on /bin/sh
• Logs: the string pitboss in NetScaler logs (Unit 42 provides a hunting query); requests to /logon/LogonPoint/Authentication/GetUserName from unfamiliar sources
• Network: 77.83.199[.]39, 104.248.244[.]66, 193.149.176[.]207, 104.28.215[.]137 and 78.47.24[.]217 (corroborate before blocking — infrastructure gets reused)
• Unexpected cron jobs and unexplained gaps in logging

Citrix has also made IOCs available through NetScaler Console, and CISA has published SIGMA detection rules in its SIGMA_Rules repository.

The right order: check, preserve, patch, rebuild

CISA’s guidance is clear that you should look for compromise before patching, because updates can reduce forensic visibility. A sensible sequence:

1. Confirm exposure. Identify every NetScaler ADC and Gateway, its version, and whether it meets the preconditions in Citrix’s advisory (Gateway/AAA virtual servers, DTLS, SAML).
2. Isolate if you can’t patch immediately. Restrict or remove internet exposure for vulnerable appliances.
3. Preserve evidence. Unit 42 recommends a VPX snapshot, remote syslog and NetScaler Console logs, a technical support bundle and a packet engine core dump. Forward logs to a SIEM — local logs rotate quickly.
4. Hunt for the indicators above.
5. Patch to the fixed versions listed in CTX697096 and the later CVE-2026-88779 / CVE-2026-107406 bulletins. Plan for downtime.
6. If anything looks wrong, rebuild. Restore from a known-good backup that predates the compromise and follow Citrix’s CTX694799 guidance for suspected compromise.
7. Rotate every secret the appliance held: local account passwords, key-encryption keys and SSL certificates. Assume anything stored on a compromised NetScaler is known to the attacker.
8. Look downstream. NetScaler Gateway sits in front of your users. Check for session hijacking, unusual VPN logins and lateral movement from Gateway address ranges, and run your incident response process if you find it.

Why edge devices keep getting hit

NetScaler joins a long list of edge appliances — VPNs, firewalls, load balancers — exploited as zero-days in recent years. They are internet-facing by design, run privileged code, are hard to monitor with EDR, and sit right in front of your identity systems. The same month brought FortiBleed, a credential campaign against Fortinet devices.

The lesson is the same one Log4Shell taught: patching closes the door, but it doesn’t tell you who already walked through it. For every critical edge-device bug, budget time for a compromise assessment, not just an update.

Sources

• CISA: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
• Unit 42: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
• Rapid7: Zero-Day Exploitation of Citrix NetScaler ADC and Gateway
• BleepingComputer: Citrix confirms two NetScaler RCE zero-days exploited in attacks