Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772: three weeks of exploitation before the patch

Executive Summary

On September 27, 2026, Cloud Software Group published security bulletin CTX697096 for eight vulnerabilities in customer-managed Citrix NetScaler ADC and NetScaler Gateway, and stated that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed."¹ CISA added both to its Known Exploited Vulnerabilities catalog the same day, said they "can independently enable remote code execution," and reported that "threat actors are actively exploiting these vulnerabilities globally."²³ Both carry a CVSS v4.0 base score of 9.5. CVE-2026-88771 affects every NetScaler ADC and Gateway deployment in its default configuration; CVE-2026-88772 requires DTLS, which Citrix notes is enabled by default on VPN virtual servers.¹

The bulletin was not the start of the campaign. Mandiant told CyberScoop the earliest known CVE-2026-88772 exploitation occurred September 3, and Google Threat Intelligence Group (GTIG) describes the campaign as "ongoing since at least early September."⁴⁵ eSentire observed CVE-2026-88771 exploitation from September 5, with a web shell installed and operated that day.⁶ Palo Alto Networks Unit 42 traced version fingerprinting of NetScaler appliances back to August 21.⁷ By the time a patch existed, attackers had had roughly three weeks of unannounced access to internet-facing gateways.

No government body or vendor has attributed the activity to a named actor as of October 2, 2026. Mandiant Consulting CTO Charles Carmakal described "advanced and suspected state-sponsored threat actors" and "dozens of impacted organizations across North America and Europe" in government, financial services, education, telecommunications, and legal and professional services.⁸ GTIG's own published report names the sectors as "likely impacted" and makes no attribution.⁴ Researcher Kevin Beaumont wrote on September 28 that he was "tracking over 100 victim orgs" and that "it's espionage."⁹

The finding that matters for defenders is the one every primary source repeats: patching closes the hole, not the intrusion. CISA told organizations to check for compromise before patching and to preserve forensic evidence, because "updates may result in loss of forensic visibility."² Mandiant's Carmakal wrote that "upgrading alone will not eradicate post-exploitation access or address stolen credentials."⁸ The web shells recovered by Mandiant, Unit 42, eSentire and LevelBlue live in the appliance's own web-server configuration and file system, and survive an upgrade.⁴⁷⁶¹⁰

Verification of Claims

1. Claim: CVE-2026-88771 and CVE-2026-88772 were exploited as zero-days before Citrix's September 27 bulletin. → Verified → Citrix states exploitation "has been observed"; CISA added both to KEV citing active exploitation; Mandiant, Unit 42, eSentire, Rapid7 and GreyNoise each describe pre-disclosure activity in their own telemetry.^134761112

2. Claim: Exploitation began in early September 2026. → Verified → Mandiant gives September 3 as the earliest known CVE-2026-88772 exploitation; Unit 42 records .deb web shell requests from September 4; eSentire records CVE-2026-88771 exploitation and an operated web shell from September 5.⁵⁷⁶ Unit 42's August 21 date is version fingerprinting, not exploitation.⁷

3. Claim: The two vulnerabilities are a chain. → Unverified, and contradicted → CISA says each can "independently enable remote code execution."² Mandiant's report concerns CVE-2026-88772; CERT-EU's and eSentire's concern CVE-2026-88771. CyberScoop reports it is "unclear to what extent the pair of zero-days are linked."⁴¹³⁶⁵

4. Claim: Applying the update does not remove an existing compromise. → Verified → CISA advises checking for compromise and preserving evidence before patching; eSentire states that patching "does not remove any deployed payloads or persistence mechanisms"; Citrix publishes separate steps for a suspected compromise.²⁶¹⁴

5. Claim: The activity is state-sponsored espionage. → Partially verified → This is Mandiant's stated suspicion ("suspected state-sponsored") and Beaumont's assessment, not an attribution. GTIG's published report and CISA's alert make no attribution.⁸⁹⁴²

6. Claim: About 50,000 NetScaler appliances were compromised. → Unverified, and a misreading → Unit 42's 50,277 is a count of "exposed instances that could potentially be vulnerable," from Cortex Xpanse telemetry as of September 27. It is not a count of compromised appliances.⁷ Decryption Digest's headline nonetheless reads "WHIPSHOT Webshell Found on 50,277 Appliances."¹⁵

7. Claim: Dozens of organizations were compromised. → Partially verified → Mandiant says it is "aware of dozens of impacted organizations"; Rapid7 confirms two compromised organizations among its customers; Unit 42 describes compromises at US-based targets. No named organization has disclosed a compromise.⁸¹²⁷ Tech Times's "more than 100 organizations already confirmed compromised" restates Beaumont's "tracking over 100," for which no method has been published.¹⁶⁹

Timeline

Attack Anatomy

Reconnaissance

Unit 42's earliest observation is not exploitation. On August 21, two hosts requested a stylesheet and a language file from a NetScaler Gateway at a US organization, requests consistent with version fingerprinting; on August 21 and 22 the same two hosts and a third sent identical requests to more than 100 other systems (T1595.002).⁷

Initial access: two independent bugs

CVE-2026-88772 is a memory overflow in the NetScaler Packet Processing Engine (NSPPE), reachable when DTLS is enabled.¹ GTIG states it "does not possess exploit code"; from frontline telemetry, it assesses that malformed DTLS record headers sent over UDP/443 during the pre-authentication handshake corrupt heap memory and give root-level code execution on the underlying FreeBSD system (T1190).⁴ Successful exploitation left two artifacts: an SSL handshake failure from a DTLSv1.0 client with the reason "Handshake failure-Internal Error", and an NSPPE process termination that the appliance watchdog declined to restart.⁴

CVE-2026-88771 is, in Citrix's words, an improper-input-validation flaw letting "an unauthenticated attacker to execute arbitrary commands," affecting every deployment by default.¹ CERT-EU, eSentire and Unit 42 independently reconstructed it as log injection. The attacker gets two things written into appliance logs: an encoded payload in an HTTP request field, and a crafted login username that imitates an internal packet-engine failure message. A built-in maintenance script that later scans those logs for such failure messages interpolates the matching text into a shell command and runs it as root (T1059.004).¹³⁶⁷ Because only the most recent matching line is processed, attackers sent the trigger repeatedly; CERT-EU says this explains the "hammering" its partners saw.¹³ Login success is not required.⁶ watchTowr Labs published an independent root-cause analysis.²³ This paper does not reproduce the request formats.

Persistence: the web server becomes the backdoor

Every write-up describes the same pattern. The attacker edits /etc/httpd.conf so the appliance's Apache server will execute PHP from files that do not look like scripts, then drops a web shell in a web-reachable path (T1505.003, T1036.008).⁴⁷⁶

• GTIG recovered installer shells named on variants of nginstaller and two configuration hooks: one registering .deb files as PHP in /netscaler/gui/vpn/scripts/linux/, a folder that legitimately hosts VPN client packages; and a stealthier one mapping requests for /vpn/media/*.ico to .sig files executed as PHP.⁴
• Unit 42's CVE-2026-88771 case placed a hidden file .ctxs.receiver in /var/netscaler/logon/LogonPoint/custom/ and aliased it to receiver.min.css, so command traffic resembles a versioned stylesheet load (T1036.005).⁷
• To keep root after the initial exploit, the shells set the setuid bit on /bin/sh and reboot the appliance or restart Apache (T1548.001).⁴⁷
• The shells return HTTP 404 to every request, scrub their install path from /etc/crontab, and take commands from Base64-encoded HTTP headers or cookies named to resemble native NetScaler traffic (NSC_*) (T1140).⁴⁶⁷ Beaumont reports each victim's shell is unique.⁹

Command and control, lateral movement and collection

GTIG documented WHIPSHOT, a PHP web shell that tunnels traffic, and SLAPSHOT, a Python TCP tunneler it talks to over loopback, writing its port to /tmp/.uxdport and its lock to /tmp/.uxdlock (T1059.006, T1572, T1090.001).⁴ In at least one intrusion the actor routed traffic through SLAPSHOT "to manually conduct internal reconnaissance and credential theft."⁴ eSentire saw the actor open sessions on internal virtual desktops and connect back to the appliance over SSH (T1021.004), with web shell responses indicating data exfiltration (T1041).⁶ Unit 42's recovered nsg64.deb supports command execution, file upload, and chunked file download, with RC4-encrypted traffic.⁷

Post-disclosure activity is a different population

Unit 42 explicitly separates pre-disclosure activity from what followed, warning that activity after September 27 "might not match the same" indicators because other actors, researchers and scanners joined in.⁷ LevelBlue's payload, which creates a local sec_monitor account with the superuser role, archives /flash/nsconfig, and attempts to upload it, carries no observation date in its write-up (T1136.001, T1005).¹⁰ It should not be assumed to be the original actor's tooling.

Threat Actor Profile

Name: Unattributed Aliases: None published Attribution confidence: None formal. Mandiant's CTO describes "advanced and suspected state-sponsored threat actors"; GTIG's report, CISA, CCCS, NCSC UK and NCSC-NL make no attribution as of October 2, 2026.^842202221 Motivation: Assessed as espionage by Kevin Beaumont; Mandiant's sector list (government, financial services, legal and professional services) is consistent with that, but neither establishes it.⁹⁸

Whether one actor exploited both bugs is not established. Unit 42 groups pre-disclosure activity into two clusters by exploit and tooling, and names neither.⁷ The infrastructure was rented and rotated: one VPS a day from September 4 to 8, Cloudflare WARP exit addresses from September 9 to 11, then a single server making most of the requests from September 15 to 24.⁷ The tradecraft matches the class GTIG describes in its report: edge devices outside endpoint detection, used as a first hop into the network.⁴

MITRE ATT&CK techniques (IDs verified live on attack.mitre.org):

OPSEC: Fake 404 responses, per-victim shells, shell paths scrubbed from crontab, command channels disguised as native headers and cookies, and file names that pass for client packages, icons and stylesheets.⁴⁷⁹ Beaumont reports the attackers set up cron jobs to delete artifacts, and that the console checks rely on logs that have often rotated away.²⁴

Technical Indicators

# All indicators as published by the named vendor. Defanged.
fingerprinting_aug_21_22:          # Unit 42
  - 104.248.244[.]66
  - 77.83.199[.]39
  - 78.47.24[.]217
deb_web_shell_requests_sept_4_24:  # Unit 42, attributed by Unit 42 to CVE-2026-88772 activity
  - 66.135.19[.]18
  - 167.99.111[.]203
  - 142.93.85[.]227
  - 104.248.74[.]206
  - 137.184.91[.]207
  - 104.28.247[.]136      # Cloudflare WARP
  - 104.28.215[.]136      # Cloudflare WARP
  - 104.28.215[.]137      # Cloudflare WARP
  - 104.28.247[.]137      # Cloudflare WARP
  - 162.33.178[.]9
  - 193.149.176[.]207
cve_2026_88771_chain_sept_21:      # Unit 42
  - 77.83.199[.]39
  - 78.47.24[.]217
  - 139.180.152[.]138
gtig_infrastructure:               # GTIG
  - 143.198.7[.]94         # scanning and staging
  - 157.254.167[.]12       # exploitation and basic web shell install
exploitation_attempts:
  - 149.104.78[.]208       # Rapid7, Sept 20
  - 149.104.78[.]141       # GreyNoise, Sept 24
post_disclosure_exfil_target:
  - 64.94.85[.]67:443      # LevelBlue, sec_monitor payload
file_hashes:
  - sha256: ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec  # nsg64.deb web shell, Unit 42
host_artifacts:
  - /etc/httpd.conf modified to register .deb, .sig or other non-PHP extensions as PHP, or AliasMatch from /vpn/media/ or /logon/LogonPoint/custom/   # GTIG, Unit 42
  - /var/netscaler/gui/vpn/scripts/linux/*.deb or *.sig containing PHP   # GTIG, eSentire
  - /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver   # Unit 42
  - /bin/sh with setuid bit set   # GTIG, Unit 42
  - /tmp/.uxdport and /tmp/.uxdlock   # SLAPSHOT, GTIG
  - local account sec_monitor with superuser role in /flash/nsconfig/ns.conf   # LevelBlue
log_artifacts:
  - SSL_HANDSHAKE_FAILURE, ClientVersion DTLSv1.0, Reason "Handshake failure-Internal Error"   # GTIG, CVE-2026-88772
  - NSPPE termination followed by pitboss "NOT restarting NSPPE" in /var/log/messages   # GTIG
  - requests to /logon/LogonPoint/Authentication/GetUserName (Unit 42 treats any as anomalous)
domains: none published
note: >
  Citrix distributes its own indicator set through the NetScaler Console IOC scanner;
  GTIG's full set is in a GTI Collection for registered users. Neither is reproduced here.

Legal and Regulatory Response

CISA added both CVEs to the KEV catalog on September 27, 2026, with a due date of September 30 for federal civilian agencies and a "forensic triage" requirement under Binding Operational Directive 26-04.¹⁹ The KEV entry for CVE-2026-88771 lists CWE-119 and links the NVD page for CVE-2026-88772; Citrix classifies CVE-2026-88771 as CWE-20, improper input validation.¹⁹¹ CISA's alert was updated on October 2 with a SIGMA rule.²

The Canadian Centre for Cyber Security issued alert AL26-024 on September 27.²⁰ NCSC-NL issued a public alert the same day, updated September 30, after warning critical infrastructure providers on September 25.²¹¹⁷ NCSC UK said on September 28 it was "working to understand the impact" on UK organizations.²² CERT-EU published its own technical analysis.¹³

No law enforcement action, indictment, sanction or attribution statement tied to this campaign had been published as of October 2, 2026.

Impact Assessment

• Confirmed: Exploitation of both CVEs before a patch existed, per Citrix and CISA.¹²
• Confirmed: Two compromised organizations among Rapid7's customers; compromises at US-based targets in Unit 42 data; web shell installation, data exfiltration and lateral movement in at least one eSentire case.¹²⁷⁶
• Confirmed: Exploitation attempts against NetScaler appliances at the European Court of Auditors and the European Central Bank, which led to CERT-EU's analysis. CERT-EU does not say either was compromised.¹³
• Reported: "Dozens of impacted organizations" across North America and Europe (Mandiant); at least 78 targeted organizations (Arctic Wolf, as reported by Cybersecurity Dive); "over 100 victim orgs" tracked (Beaumont, method not published).⁸¹⁷⁹
• Reported: Dutch hospitals including Frisius MC and Amphia suspended patient-portal access after taking NetScaler-based systems offline, per Cybersecurity Dive.¹⁷
• Estimated: 50,277 exposed and potentially vulnerable instances (Unit 42, as of September 27); more than 20,000 per Shadowserver data cited by Cybersecurity Dive. These are exposure counts, not victim counts.⁷²⁵
• Unknown: The actor; whether one actor used both bugs; the true number of compromised organizations; what data was taken from any named victim.

Lessons and Defensive Recommendations

For SOC/defenders:

• Hunt before you patch, and image virtual appliances with memory before rebooting. CISA and Mandiant both warn that the update can destroy forensic evidence.²⁴
• Check /etc/httpd.conf for any directive that makes non-PHP extensions executable or aliases public web paths into script folders; check /bin/sh for the setuid bit; look for /tmp/.uxdport.⁴
• Forward /var/log/messages and the web server logs to your SIEM. GTIG notes several of these detections depend on logs NetScaler does not forward by default.⁴ Beaumont warns console checks miss activity whose logs have already rotated.²⁴
• Treat any appliance unpatched in early September as compromised until proven otherwise, as eSentire advises.⁶

For platform and network teams:

• If patching is delayed, disable DTLS and block inbound UDP/443 upstream. GTIG is explicit that this addresses CVE-2026-88772 only and does nothing for CVE-2026-88771.⁴
• Default-deny outbound traffic from NetScaler appliances, and keep management interfaces off the internet.⁴
• After patching, rotate everything the appliance held: admin and local accounts, SSH keys, TLS certificates and private keys, LDAP bind accounts, RADIUS secrets, and API credentials.⁴

For leadership:

• The disclosure was not the start of the incident. Budget the response as an investigation of three weeks of possible access, not a patch cycle.⁴⁶
• Edge appliances sit outside endpoint detection. GTIG notes such devices made up about half of enterprise-related zero-days in 2025; decide whether your remote-access gateway gets the same logging and integrity monitoring as a server.⁴

Sources