U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Citrix NetScaler flaw tracked as CVE-2026-88779 (CVSS score of 8.7), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that can cause denial-of-service under specific conditions. It affects certain customer-managed deployments running vulnerable versions.

“CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to denial-of-service under specific deployment conditions,” reads the advisory. “The issue affects customer-managed NetScaler deployments running affected supported versions when the required preconditions are met.”

Successful exploitation requires NetScaler ADC or Gateway to be configured as a SAML service provider (SP) or identity provider (IdP). Customers can check their configuration for the relevant SAML settings.

Below are the impacted versions:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.41 
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.28 
• NetScaler ADC FIPS before 14.1-73.41 FIPS 
• NetScaler ADC FIPS and NDcPP before 13.1-37.282 

Citrix says it has observed targeted attacks against unpatched deployments that can cause denial of service. Repeated exploitation may keep the affected service unavailable, but Citrix has not identified any impact on customer data integrity.

“Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service. If the condition is triggered repeatedly, the service may remain unavailable.” continues the advisory. “Our analysis indicates that this issue affects service availability, and we have not identified an impact on the integrity of customer data. Citrix strongly urges all customers to install the latest versions as soon as possible.”

The company urges customers to install the latest versions as soon as possible. Exposure depends on the deployment configuration, particularly whether NetScaler uses SAML with Gateway or AAA functionality. Customers should check their configurations for SAML authentication settings, including add authentication samlAction for a SAML service provider or add authentication samlIdPProfile for a SAML identity provider. The bulletin applies only to customer-managed NetScaler ADC and Gateway deployments; Citrix-managed cloud services have already been updated.

The following versions fix the issue:

• NetScaler ADC and NetScaler Gateway 14.1-73.41 and later releases
• NetScaler ADC and NetScaler Gateway 13.1-64.28 and later releases of 13.1
• NetScaler ADC 14.1-FIPS 14.1-73.41 FIPS and later releases of 14.1-FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.282 and later releases of 13.1-FIPS and 13.1-NDcPP

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaw by October 7, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access.

Mandiant and Google Threat Intelligence Group caught active exploitation of a zero-day in Citrix NetScaler ADC and Gateway appliances in late September 2026. The bug, tracked as CVE-2026-88772 (CVSS score of 9.5), has been exploited in attacks in the wild since at least early September, hitting government, financial services, education, and legal services organizations across North America and Europe. Citrix disclosed a second zero-day being exploited alongside it, CVE-2026-88771.

CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service, and it affects appliances with DTLS enabled. That’s particularly relevant for NetScaler Gateway because DTLS is enabled by default for VPN virtual servers unless an administrator has explicitly disabled it.

The bug is triggered during the appliance’s first handshake, before any login is required. NetScaler’s packet engine processes incoming DTLS traffic to set up the encrypted connection. A specially crafted or fragmented header can corrupt its memory, allowing an attacker to run arbitrary code with root privileges on the underlying FreeBSD system, without needing any credentials.

There are also signs of a successful attack in the logs. You may see an SSL handshake failure using DTLSv1.0 with the message “Handshake failure-Internal Error.” At the same time, the packet engine process crashes and the appliance’s watchdog fails to restart it. If these events happen close together, they could indicate that the exploit was successfully triggered.

“While Google Threat Intelligence Group does not possess exploit code, analysis of frontline telemetry suggests that transmitting specially malformed or fragmented record headers induces heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform.” reads Google’s report. “Successful exploitation attempts generated two log artifacts:

0-PPE-0 : default SSLLOG SSL_HANDSHAKE_FAILURE 0 : SPCBId - ClientIP - ClientPort - VserverServiceIP - VserverServicePort 443 - ClientVersion DTLSv1.0 - CipherSuite "TLS1-AES-256-CBC-SHA" - Session New - Reason "Handshake failure-Internal Error""

Once inside, the attacker’s first move is installing a web shell, and the installation trick itself is worth appreciating for its pettiness. In some intrusions, the attacker edited the appliance’s Apache config to treat .deb files as executable PHP scripts, then dropped a web shell wearing that fake extension. Nobody expects a Debian package to run code, which is exactly the point.

A stealthier version does the same trick with .sig files instead, and adds a redirect so that a request for a harmless looking .ico icon file actually gets served by the hidden PHP shell. Someone requesting /vpn/media/e6ee7c85.ico unknowingly triggers e6ee7c85.sig. Mandiant even noticed some of these requests returning a normal-looking 404 error while taking unusually long to process, which is the kind of detail that only stands out once you know to look for it.

Getting root access the first time is easy because the exploit already runs with root privileges. To keep that access for future web requests, the installer makes /bin/sh setuid, so commands run through the shell continue to run as root.

It then forces a full reboot of the appliance to make sure the changes stay in place. Simple, effective, and a pretty clever way to make the compromised system keep giving the attacker root access.

The two custom tools doing the real work are called WHIPSHOT and SLAPSHOT, and Mandiant hadn’t seen either before.

“Following successful exploitation, the initial web shell payload self-installs by modifying target httpd.conf files, configuring the system to treat specified non-script file types as executable PHP scripts, setting the stage for the deployment of additional custom malware including WHIPSHOT (a PHP web shell) and SLAPSHOT (a Python proxy/tunneler).” states the report.

WHIPSHOT is the PHP web shell, disguised as a Debian package, that reads commands hidden inside sequential HTTP header fields, decodes them from Base64, and forwards them over a local loopback connection. It also quietly kills its own error reporting and always answers with a 404, so a scan of the web server logs shows nothing unusual on the surface.

SLAPSHOT is what lets the attacker move beyond the compromised appliance. It creates a simple Python proxy that opens a local port and forwards TCP traffic into the internal network.

In one confirmed attack, the attacker used it to explore the network and look for credentials. The connection started from an internet-facing gateway, giving the attacker a tunnel into the internal network.

SLAPSHOT even cleans up after itself if nobody’s using it, closing idle sessions after 15 minutes and shutting itself down entirely after 10 minutes with no activity, deleting its own port and lock files on the way out. That’s not laziness, that’s someone who’s thought about what a forensic analyst would go looking for and decided not to leave it lying around.

This is not a new problem. Edge devices such as VPN gateways, load balancers and firewalls are often targeted because they are exposed to the internet, are usually outside standard endpoint security tools, and may contain credentials that provide access to the internal network.

Mandiant recommends patching to the fixed versions first. Isolating a remote-access gateway can cause major disruption. If patching is not immediately possible, disabling DTLS and blocking inbound UDP/443 can stop this specific attack path, but it does not protect against the second zero-day.

If an appliance may have been compromised, assume that all credentials it handled are exposed. This includes admin accounts, SSH keys, TLS certificates, LDAP and RADIUS credentials, and other secrets used to access internal systems. Rotate them after the appliance has been patched, not before.

“This campaign underscores the continued targeting of edge devices to gain initial access to victim networks, a trend that GTIG has tracked across a range of threat actors. Notably, these vulnerabilities made up about half of the enterprise-related zero-days in 2025.” contludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Citrix NetScaler)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-88771 (CVSS score: 9.5) Citrix NetScaler Improper Input Validation Vulnerability
• CVE-2026-88772 (CVSS score: 9.5) Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88771 (CVSS score: 9.5) is a remote code execution vulnerability caused by improper input validation that could allow an unauthenticated remote attacker to execute arbitrary commands. The flaw affects all NetScaler ADC and NetScaler Gateway deployments in their default configuration and does not require any additional features to be enabled.

CVE-2026-88772 (CVSS score: 9.5) is a memory buffer overflow vulnerability that could allow remote code execution or cause a denial-of-service condition. The flaw affects NetScaler ADC and NetScaler Gateway deployments with DTLS enabled, which is enabled by default on VPN vServers. The vulnerability is classified as CWE-119.

This week, Citrix confirmed that the two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances. The first warnings did not come from Citrix. On September 26, administrators said IT providers and security teams were privately advising them to take NetScaler systems offline, sometimes without explaining why.

The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.

The reports show how the attacks were already underway while defenders were still waiting for official details and fixes.

Security researchers at watchTowr then confirmed that the reports were credible. The company said it was investigating reports of multiple unpatched NetScaler remote code execution flaws being exploited in the wild and later said the vulnerabilities had been found during forensic investigations.

“We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible,” watchTowr wrote on X.

The Dutch National Cyber Security Centre also sent a pre-notification to organizations in the Netherlands. According to a notice seen by BleepingComputer, a European partner CERT had shared information about two critical NetScaler zero-days that could allow remote code execution. One of the flaws could even let an attacker inject shellcode directly into memory.

Both vulnerabilities have been fixed in the following NetScaler releases:

• Citrix NetScaler ADC and NetScaler Gateway 14.1-73.37 and later
• Citrix NetScaler ADC and NetScaler Gateway 13.1-64.23 and later
• Citrix NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later
• Citrix NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later

CISA said it has received reports and threat intelligence confirming that attackers are actively exploiting the vulnerabilities worldwide.

“CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally. Because updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.” reads the advisory published by CISA. “Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories.”

CISA also noted that updating NetScaler appliances can be complex and may require downtime. The alert is intended to help organizations assess their exposure, prioritize mitigation and include the vulnerabilities in their risk management plans.

Citrix has also released generic indicators of compromise (IoCs) through NetScaler Console. These can help customers check whether their systems may have been compromised.

If a compromise is suspected, Citrix recommends taking the following steps:

• Preserve evidence from the NetScaler ADC VPX instance.
• Isolate the device.
• Revoke credentials and access.
• Check connected servers and systems for signs of further compromise.
• Rebuild the device and update it to the latest firmware.
• Rotate local account passwords and Key Encryption Keys (KEK), and replace restored SSL certificates when recovering from a known-good backup.
• Harden the device according to Citrix security best practices.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by September 30, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Citrix confirmed two critical NetScaler zero-days were exploited before patches were available, with attackers able to remotely execute code.

Citrix confirmed that two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances. The first warnings did not come from Citrix. On September 26, administrators said IT providers and security teams were privately advising them to take NetScaler systems offline, sometimes without explaining why.

The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.

The reports show how the attacks were already underway while defenders were still waiting for official details and fixes.

Security researchers at watchTowr then confirmed that the reports were credible. The company said it was investigating reports of multiple unpatched NetScaler remote code execution flaws being exploited in the wild and later said the vulnerabilities had been found during forensic investigations.

“We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible,” watchTowr wrote on X.

The Dutch National Cyber Security Centre also sent a pre-notification to organizations in the Netherlands. According to a notice seen by BleepingComputer, a European partner CERT had shared information about two critical NetScaler zero-days that could allow remote code execution. One of the flaws could even let an attacker inject shellcode directly into memory.

That warning has now become a confirmed security incident.

Citrix published fixes for the two exploited vulnerabilities on September 27, along with patches for six other security issues. The company confirmed that both NetScaler flaws had been exploited against systems that had not been mitigated, although it hasn’t said how many organizations were affected, who was behind the attacks or when exploitation started.

“Citrix has released updates for NetScaler ADC and NetScaler Gateway to address multiple security vulnerabilities. These vulnerabilities vary by deployment configuration and enabled features, and include issues that could allow remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions.” reads the advisory. “Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. “

Citrix confirmed active exploitation of CVE-2026-88771 (CVSS score of 9.5) and CVE-2026-88772 (CVSS score of 9.5) on unpatched systems and urged customers to install the relevant updates as soon as possible.

“Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible.” Continue the advisory.

The first vulnerability, CVE-2026-88771, involves improper input validation and allows an unauthenticated attacker to execute arbitrary commands, and Citrix says it affects all NetScaler ADC and NetScaler Gateway deployments in the affected versions without requiring an additional feature to be enabled.

The second flaw, CVE-2026-88772, is a memory overflow that can lead to remote code execution or denial of service, and it affects appliances with DTLS enabled. That’s particularly relevant for NetScaler Gateway because DTLS is enabled by default for VPN virtual servers unless an administrator has explicitly disabled it.

NetScaler sits at a particularly sensitive point in many corporate networks. These appliances provide VPN and remote access, load balancing and authentication, so compromising one can give an attacker a useful position at the edge of an organization.

Citrix’s fixes are available in NetScaler ADC and Gateway 14.1-73.37 and later, and in the 13.1-64.23 and later releases. Fixes are also available for the 14.1-FIPS, 13.1-FIPS and 13.1-NDcPP branches.

There’s an important detail for organizations that patched NetScaler last month. The builds 14.1-73.32 and 13.1-63.21, which fixed the previously disclosed authentication-bypass vulnerability CVE-2026-19490, are still within the affected range for these new flaws. Installing those earlier builds doesn’t address the two newly disclosed vulnerabilities.

The 13.1 branch also deserves attention because that release line reached End of Maintenance on September 15. The new security fix still covers it, but organizations running that branch should factor its maintenance status into their upgrade planning.

But patching the two zero-days is only half the job.

Citrix is providing generic Indicators of Compromise (IoCs) through NetScaler Console to help customers quickly assess whether their NetScaler deployments may have been compromised.

The feature is available in NetScaler Console service and on-premises deployments with Cloud Connect, starting with version 14.1-73.36, and requires the telemetry channel to be enabled. Customers can launch scans from the Security Advisory page once the IoC detection logic is released. Those without NetScaler Console can contact Citrix Support for access and assistance. Citrix warns that the IoCs do not cover all attacker techniques and may miss compromises, so experienced forensic investigators should be involved when needed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)