Back
Two Citrix NetScaler zero-days exploited for weeks
On 27 September 2026, Citrix disclosed two critical flaws in NetScaler ADC and NetScaler Gateway, and CISA added them to its KEV catalog the same day. According to Unit 42, attackers had been exploiting them for weeks before disclosure.
The first reconnaissance requests started in late August. That is why patching alone is not enough: it does not remove an attacker who is already inside.
The vulnerabilities
| CVE | Type | Condition | CVSS v4.0 |
|---|---|---|---|
| CVE-2026-88771 | Unauthenticated remote code execution (insufficient input validation) | Default configuration | 9.5 |
| CVE-2026-88772 | Memory overflow in the DTLS configuration; RCE or denial of service | DTLS must be enabled (on by default for VPN virtual servers) | 9.5 |
Affected versions (customer-managed deployments): 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS before 14.1-73.37-FIPS and FIPS/NDcPP before 13.1-37.279. Secure Private Access Hybrid deployments that use NetScaler are also affected. See Citrix article CTX697096 for the exact conditions.
What did the attackers do?
Unit 42 found that the attackers wrote commands into the appliance logs (log poisoning) and got a Perl script on the device to execute them. They then:
- made
/bin/shexecutable with root privileges, - dropped a hidden PHP web shell disguised as a CSS file in the login page directory,
- changed the web server configuration so that the shell would run.
Through the DTLS flaw they planted a second web shell, disguised as a .deb package, that receives encrypted commands. Citrix notes that the shell differs from device to device and that the attackers used commands to cover their tracks, so the absence of known indicators does not mean a device is clean.
What should you do?
- Preserve evidence, then patch. Before patching, take a virtual appliance snapshot, syslog and a technical support bundle.
- Upgrade to a fixed version: 14.1-73.37 or 13.1-64.23 and later (see above for FIPS builds).
- Hunt for exploitation: unusual entries containing "pitboss" in
ns.log, odd User-Agent values inhttpaccess-vpn.log, unexpected files under/var/netscaler/logon/LogonPoint/custom/, and.debpackages you don't recognise under/vpn/scripts/linux/. - If you suspect compromise, rebuild the appliance from a clean image and reset every credential and session that passed through it.
How Nokta Guard can help
In our external network penetration tests we check the versions and externally visible attack surface of your VPN and remote access appliances. On a suspicious device, a forensic examination reveals the attacker's access path and persistence mechanisms.
Related services: External Network Penetration Testing, Server and Enterprise System Forensics
Sources: Unit 42 · Help Net Security