Citrix has patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway, and two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited in zero-day attacks to plant webshells on unmitigated devices before fixes shipped. The exploitation ran for roughly a month before public disclosure, and the activity has since been confirmed by the Dutch National Cyber Security Center (NCSC-NL), the US Cybersecurity and Infrastructure Security Agency (CISA), and outside researchers.<\/p>\n
CVE-2026-88771 is an improper input validation bug that allows remote, unauthenticated attackers to execute arbitrary commands on devices running a default configuration, with no user interaction required. NCSC-NL warned that the flaw gives attackers full control of the gateway, opening a direct path to the internal corporate network behind it.<\/p>\n
CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service. It is remotely exploitable without user interaction, but only when DTLS is enabled, which is on by default for virtual VPN servers. The two bugs can be exploited independently.<\/p>\n
The vulnerabilities hit customer-managed installations of:<\/p>\n
Citrix has urged customers to upgrade to a fixed version, then check for evidence of compromise and run incident response if anything is found.<\/p>\n
Rumors about the bugs and their in-the-wild exploitation surfaced on Reddit on Friday, after IT suppliers circulated warnings they had received from NCSC-NL. European government sources have been alerting organizations about active attacks all week, and the activity itself has been running this entire month, which lines up with the note from outside researchers that exploitation pre-dated the patch by several weeks.<\/p>\n
The profile of the attacker activity points away from opportunistic cybercrime. Public reporting has described the operators as well resourced and likely nation-state aligned, with an espionage motive rather than ransomware. About two-thirds of threat actor activity against Citrix NetScaler over the last seven years has involved APT groups, with the remaining one-third tied to ransomware affiliates, according to published research from Tenable. No threat actor has been publicly named.<\/p>\n
Detection is harder than usual here because the attacks started weeks ago. The detection script Citrix ships through the NetScaler Console only works if logs on the affected devices have not rotated since the attack, and they probably have. Outside researchers have suggested digging through SIEM logs for base64 strings placed directly after the User-Agent field, and for log lines containing the string pitboss followed by IFS (written as pitboss*IFS) or by b64decode (pitboss*b64decode). The webshells planted on each device are unique, and the attackers ran anti-forensics commands to delete artefacts, which is why a deeper review is often needed.<\/p>\n
Citrix has acknowledged that its published indicators of compromise may fail to catch real compromises because threat actors shift tactics, techniques, and infrastructure frequently, and it recommends bringing in experienced forensic investigators for a full environment assessment. NCSC-NL has separately advised backing up device memory and log files going back at least a month before installing the updates, and watching for suspicious traffic or anomalous actions even after upgrade.<\/p>\n
CISA added both actively exploited flaws to its Known Exploited Vulnerabilities catalog on Sunday and ordered US federal civilian agencies to remediate by Wednesday, September 30, 2026, with forensic triage to confirm or rule out compromise. CISA said it had received reports and partner threat intelligence confirming that threat actors are actively exploiting the vulnerabilities globally.<\/p>\n
For any organization running affected NetScaler versions, the priority is to patch to a fixed build immediately, then treat every previously unpatched appliance as potentially compromised. Memory and log captures taken before patching give investigators something to work with if logs have already rotated, and post-upgrade monitoring matters because the same access paths that made exploitation possible are still present in any unpatched spare or standby device left on the network.<\/p>\n
They are two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. CVE-2026-88771 is an improper input validation flaw that lets unauthenticated remote attackers run arbitrary commands on default-configured devices. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled, which is the default on virtual VPN servers.<\/p>\n
Based on public reporting, exploitation had been underway for roughly a month before Citrix released fixes on Sunday, September 27, 2026. Warnings from European government sources and IT suppliers had been circulating through the week before disclosure.<\/p>\n
Upgrade to a fixed NetScaler version, then check every previously unpatched device for evidence of compromise. Back up memory and log files going back at least a month before installing updates, review SIEM logs for indicators like base64 strings after the User-Agent field and pitboss*IFS or pitboss*b64decode log lines, and engage forensic investigators if any signs of compromise appear.<\/p>\n