Critical Vulnerability in Citrix Netscaler Zero-day Prompts Emergency Shutdowns (cve-2026-88771 & cve-2026-88772)

Executive summary

Update 3 (September 29, 2026): Added how CVE-2026-88771 is exploited, public indicators of compromise, and hunting guidance. Security researcher Kevin Beaumont reports that attackers have been using these flaws to drop webshells since early September 2026, weeks before Citrix disclosed them. Exploitation is now widespread, with multiple threat actors scanning for and attacking unpatched appliances. Attackers are deploying PHP webshells, modifying the Apache configuration and using cron jobs to remove forensic artifacts.

Update: September 27th, 2026: Citrix has privately confirmed exploitation and has made a patch publicly available to organizations. Links to the patch are available below in the "patches" section of this advisory.

On September 26th, 2026, security researchers and threat intelligence publicly warned that it had verified reports of multiple unpatched remote code execution vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway, as organizations began taking the appliances offline on the advice of national authorities. NetScaler ADC and NetScaler Gateway are internet-facing application delivery and VPN appliances that serve as the remote-access entry points for enterprise environments. While reports have not been confirmed by Citrix and NCSC-NL, the potential impact is severe, and the affected product sits at the network perimeter.

Public reporting indicates both vulnerabilities were exploited as zero-days for weeks before disclosure. Multiple Security Researchers and Threat Intelligence organizations have shared reports that attackers have been using them to drop webshells since early September 2026. Early exploitation activity appears to be related to Nation State espionage campaings. At the time of writing, no public reporting has attributed the activity to a named threat actor.

Exploitation has since broadened. Since September 28th, 2026, Lupovis Defense has reportedly observed several distinct actors attempting exploitation against its honeypots following the release of a public proof-of-concept (PoC). Beazley Security expects financially motivated threat actors, including ransomware operators, to weaponize these vulnerabilities in the coming days, as they did with previous NetScaler vulnerabilities, if they have not already done so.

It's important to note that patching closes the vulnerabilities but does not remove backdoors attackers may have already installed. Beazley Security strongly recommends affected organizations apply the fixed versions listed in this advisory immediately, after gathering forensically relevant artifacts from internet exposed NetScaler appliances.

‍

Affected systems or products

Update September 27th, 2026: Citrix has released an advisory that confirms that the default configuration of Citrix NetScaler is vulnerable to these Remote Code Execution (RCE) vulnerabilities. In order to be impacted, an appliance must be running a build earlier than the fixed versions listed below.

CVE-2026-88771 affects all NetScaler ADC and NetScaler Gateway deployments with no additional features required. CVE-2026-88772 additionally requires DTLS to be enabled, which is the default on NetScaler Gateway (VPN) virtual servers unless it has been explicitly disabled.

Citrix NetScaler ADC and NetScaler Gateway are the products named in the current reports. No specific affected firmware builds or configurations have been confirmed, so the full scope is not yet established. Any internet-facing NetScaler ADC or Gateway deployment should be treated as potentially in scope until Citrix publishes details.

‍

Product	Affected Versions	Fixed Versions
NetScaler ADC and NetScaler Gateway 14.1	< 14.1-73.37	>= 14.1-73.37
NetScaler ADC and NetScaler Gateway 13.1	< 13.1-64.23	>= 13.1-64.23
NetScaler ADC 14.1-FIPS	< 14.1-73.37 FIPS	>= 14.1-73.37 FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP	< 13.1-37.279	>= 13.1-37.279

‍

Mitigations / workarounds

Update: September 27th, 2026: Citrix has now made patches available. Please review the "patches" section of this advisory for more details and a link to download and apply the patch.

~~With no patch available and the reports unconfirmed,~~ remediation is not yet possible, and the priority is to reduce exposure and preserve the ability to investigate. Beazley Security suggests the following interim steps:

Consider taking internet-facing NetScaler ADC and Gateway appliances offline, or restricting their access to trusted and administrative networks, until Citrix confirms the issue and releases a fix.
Increase monitoring and retention of authentication and administrative logs to support later investigation.

‍

Patches

Update September 27th, 2026: Citrix has made a patch available to confirmed clients. Organizations with active Citrix subscriptions should download and apply the latest patches available via the link below:

https://www.citrix.com/downloads/citrix-adc/virtual-appliances/vpx-release-14-1-73-37.html

~~At the time of writing, no patch is available for the vulnerabilities described in these reports,~~ and Citrix has not published an advisory addressing them. Organizations should watch for an official Citrix advisory and apply any fix as soon as it is released.

It's critical to note that patching closes the vulnerabilities and MAY remove forensic artifacts of exploitation, but it does not remove backdoors that already exist. Check any NetScaler appliances for the IOCS listed in this advisory before patching if possible. If the Citrix appliances are deployed on virtualized infrastructure, Beazley Security recommends generating a snapshot of the VMs prior to patching to ensure forensic data is available for review.

‍

Indicators of compromise

IP Addresses:

149.104.78[.]141	IPv4	Exploitation attempts, beginning September 24	GreyNoise
138.28.234[.]38	IPv4	Exploitation with attempted DNS exfiltration	Lupovis
82.167.14[.]7	IPv4	Exploitation check (writes a test marker)	Lupovis
85.203.46[.]191	IPv4	Reconnaissance	Lupovis
154.217.251[.]226	IPv4	CVE-2026-88772 scanning	Lupovis
httpworkbench[.]com	Domain	Out-of-band callback for exfiltrated output	Lupovis

HOST (NetScaler Appliance) Indicators

6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7	SHA-256	PHP webshell	GreyNoise
/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver	File path	Webshell location	GreyNoise
Alias `/logon/LogonPoint/custom/receiver.min.css` or `AliasMatch ^/logon/LogonPoint/custom/receiver\.min\.[0-9a-f]+\.css$` in `httpd.conf`	Configuration Modifications	Webshell routing	GreyNoise
php_flag engine on (changed from off) and a `SetHandler` block for the webshell file in `httpd.conf`	Config	PHP enabled for the webshell	GreyNoise; CERT-EU
Cookies `CsrfToken` and `NSC_TASS`	HTTP	Webshell access	GreyNoise

Log Indicators to Look for in SIEM solutions

pitboss logs with `IFS` or `b64decode`	ns.log, messages, SIEM	Kevin Beaumont
“missed too many heartbeats” or “unexpectedly died” in authentication log lines	ns.log	watchTowr, CERT-EU
User-Agent starting with `INDEX:` followed by base64	Apache access logs	CERT-EU
User-Agent "`ns-88771-poc"`	Apache access logs	Lupovis
Test marker text "`NX-CVE-OK"` in web folders	Filesystem	Lupovis

Before patching

These locations are rebuilt when the appliance reboots so Beazley Security strongly recommends that you check them first. Where possible, also compare /etc/httpd.conf with the same file on a clean appliance of the same build.

# Apache config: webshell routes or PHP enabled: grep -nE 'ctxs\.receiver|receiver\.min|SetHandler.*php|php_flag +engine +on' /etc/httpd.conf /nsconfig/httpd.conf 2>/dev/null # /bin/sh should not be setuid (expected: -r-xr-xr-x) ls -l /bin/sh # Test markers from exploitation checks in the firmware web folder grep -rl 'NX-CVE-OK' /netscaler/ns_gui 2>/dev/null

Before or after patching

These locations persist across reboots and upgrades.

# Hidden or unexpected files in the Gateway logon folders ls -la /var/netscaler/logon/LogonPoint/custom/ find /var/netscaler/logon -name '.*' -type f # Test markers from exploitation checks grep -rl 'NX-CVE-OK' /var/netscaler 2>/dev/null # Log injection attempts zgrep -E 'pitboss.*(IFS|b64decode|[;`|$])|authenticate user :pitboss' /var/log/ns.log* /var/log/messages* # Staged payloads in the User-Agent zgrep 'INDEX:' /var/log/httpaccess*.log* # Scheduled jobs and startup scripts ls -la /var/cron/tabs/; crontab -l -u root; crontab -l -u nsroot cat /nsconfig/rc.netscaler /nsconfig/nsafter.sh 2>/dev/null

Genuine watchdog events can also log “missed too many heartbeats”. Defenders should look for that text in an authentication log line, or next to shell characters such as ;, backticks or ${IFS}.

‍

Threat Intelligence

Beazley Security is aware that attackers have been using these flaws to drop webshells since early September 2026, weeks before Citrix disclosed them. Exploitation is now widespread, with multiple threat actors scanning for and attacking unpatched appliances.

CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026.

Since September 28, Lupovis has reported several distinct actors hitting its Citrix decoys, from scanners to attackers running commands and exfiltrating the output over DNS.

Attackers are deploying PHP webshells, modifying the Apache configuration and using cron jobs to remove forensic artifacts.

Beazley Security is aware of a likely attack campaign targeting Citrix Netscaler systems which begun on September 20th, 2026. Beazley Security recommends that organizations retain HTTP access logs (including the "VPN" error and access logs) and crash dumps from internet exposed Citrix NetScaler systems if possible.

Technical Details

On September 27th, 2026, Citrix published security bulletin CTX697096, which addresses eight vulnerabilities in NetScaler ADC and NetScaler Gateway. The bulletin included confirmation that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed in the wild.

CVE-2026-88771 (CVSS score 9.5) is an improper input validation flaw that allows an unauthenticated attacker to execute arbitrary commands. Citrix states that all NetScaler ADC and NetScaler Gateway deployments are affected, including the default configuration, and no additional features need to be enabled.

CVE-2026-88772 (CVSS 9.5) is a memory overflow that can lead to remote code execution or denial of service. It requires DTLS to be enabled, which is the default on NetScaler Gateway (VPN) virtual servers. Administrators can check their configuration (/nsconfig/ns.conf or show ns runningConfig) for the following:

- add vpn vserver <name> SSL <ip> 443 with no -dtls OFF flag means DTLS is enabled by default, and the precondition is met. - add vpn vserver <name> SSL <ip> 443 -dtls OFF means DTLS is explicitly disabled, and the precondition is not met. - add vpn vserver <name> DTLS ... or add lb vserver <name> DTLS ... means DTLS is enabled.

Citrix has not released root-cause details or proof-of-concept code for either vulnerability. Beazley Security will continue to update this advisory as additional details are available.

‍

How is Beazley Security responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found. Beazley Security has also searched for known Indicators of Compromise (IOCs) across our MXDR client base. Organizations that may have been impacted have already received notifications. If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team