Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: Pre-Authentication RCE Zero-Days Under Active Exploitation

1. Basic Information

• Source Article: Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778
• Publisher: Citrix
• Publication Date: September 27, 2026
• Original Source: Citrix
• Related Sources: Citrix Tech Zone: NetScaler security bulletin guidance, BleepingComputer, Google Threat Intelligence Group / Mandiant
• Related Malware, Threat Groups, CVEs, and Products: CVE-2026-88771, CVE-2026-88772, NetScaler ADC, NetScaler Gateway, NetScaler Console, Citrix Secure Private Access Hybrid
• Severity: Critical (Both vulnerabilities can permit pre-authentication remote code execution, have a CVSS v4.0 base score of 9.5, and are under active exploitation. CVE-2026-88771 requires no additional features to be enabled on affected versions. NetScaler appliances commonly serve as internet-facing gateways.)
• Update Reason: Incorporates GTIG and Mandiant findings on CVE-2026-88772 exploitation, NSPPE crashes, httpd.conf modifications, web shells disguised as .deb or .sig files, the setuid bit on /bin/sh, internal proxying through WHIPSHOT and SLAPSHOT, and observed manual internal reconnaissance and credential theft.

2. Quick Summary

Citrix has confirmed active exploitation of two pre-authentication RCE vulnerabilities in unmitigated NetScaler ADC and Gateway deployments. CVE-2026-88771 affects all deployment configurations running affected versions, including default configurations. CVE-2026-88772 requires DTLS to be enabled, including on VPN virtual servers or virtual servers of type DTLS.

3. Attack Flow

Observed CVE-2026-88772 Compromises: Root Access, Web Shells, and Internal Proxying

The following summarizes the exploitation analysis and post-exploitation variants reported by GTIG and Mandiant. GTIG does not possess the exploit code; the detailed memory-corruption mechanism is an assessment based on frontline telemetry.

1. An attacker reaches a DTLS-enabled virtual server on an affected NetScaler appliance. GTIG assesses that malformed or fragmented DTLS record headers can corrupt NSPPE heap memory.
2. Successful exploitation establishes initial root-level code execution on FreeBSD. Associated NSPPE termination was observed, but a crash alone does not establish that code execution succeeded.
3. An installer modifies httpd.conf to associate .deb or .sig files with PHP processing through AddHandler, then places a web shell in a VPN web directory. One variant also uses AliasMatch to map .ico request paths to a .sig web shell.
4. The attacker sets the setuid bit on /bin/sh to support root command execution from the otherwise unprivileged web server context. An appliance reboot or httpd restart applies the web server configuration changes; it is not required to activate the setuid permission change.
5. WHIPSHOT handles Base64-encoded command-and-control data in HTTP headers and connects over loopback to SLAPSHOT. SLAPSHOT then opens TCP connections to target hosts, enabling access to the internal network.
6. In at least one observed intrusion, the attacker used the proxy to conduct internal reconnaissance and credential theft manually.

These observations do not establish that every intrusion used every component or followed an identical sequence.

4. Attacker Position and Execution Location

• The attacker requires network access to the vulnerable NetScaler service. No prior authentication is required. Internet exposure increases reachability, but pre-authentication exploitation does not itself imply that the appliance is internet-facing.
• The exploit and post-exploitation tools run on the NetScaler appliance. GTIG and Mandiant reported initial root-level access on FreeBSD in the investigated CVE-2026-88772 compromises.
• The web server context and the initial exploit context must be distinguished: the reported setuid modification enabled root command execution from an otherwise unprivileged web service.

5. Visibility for Victims and Administrators

Victims

• VPN or public-application users may see no obvious signs of compromise. A denial-of-service outcome may appear as a connection failure.

Administrators

• Investigative leads include SSL_HANDSHAKE_FAILURE entries mentioning DTLSv1.0 and Internal Error, NSPPE orphan-ring messages, and pitboss messages indicating that NSPPE was not restarted.
• Additional leads include unauthorized handlers or mappings in httpd.conf, unexpected PHP content in .deb or .sig files, the setuid bit on /bin/sh, and HTTP 404 responses with unusually long processing times or large response bodies.
• These signals require correlation. A crash, file extension, or HTTP status code alone does not confirm exploitation.

6. Success and Failure Conditions

Success Conditions

• CVE-2026-88771: The attacker must reach the vulnerable service on an affected appliance. No additional features need to be enabled; DTLS is not a prerequisite.
• CVE-2026-88772: The attacker must reach an affected DTLS-enabled virtual server. Code execution requires successful exploitation beyond a crash or denial of service.
• Observed proxy-based follow-on activity: The attacker must establish and operate the web shell/proxy components and have a network path from the appliance to internal targets. WHIPSHOT and SLAPSHOT are components of the reported campaign, not universal prerequisites for every possible post-exploitation action.

Failure Conditions and Risk Mitigation

• Immediately update to an applicable patched release. Version 13.1-64.23 has a known upgrade-related reboot-loop issue under specific configurations; use 13.1-64.24 where applicable.
• Pending patching, restrict unnecessary external exposure. This limits reachability but does not remove the vulnerability from an unpatched appliance that remains reachable internally.
• For CVE-2026-88772, assess operational impact and temporarily disable DTLS where applicable. The -dtls OFF setting applies to VPN virtual servers; separately inspect and address virtual servers of type DTLS. Disabling DTLS does not mitigate CVE-2026-88771.
• Run the NetScaler Console Security Advisory IoC scan where its prerequisites are met, use File Integrity Monitoring, and preserve existing evidence for investigation of the pre-patch exposure period.
• Forward relevant logs to an external SIEM for continued monitoring. Newly enabled logging cannot recover historical events that were never collected.

7. What Happens Upon Success

• In the investigated CVE-2026-88772 compromises, GTIG and Mandiant reported initial root-level execution, httpd.conf modifications, setuid shell access, and disguised web shells.
• SLAPSHOT can relay TCP streams to internal hosts. Manual internal reconnaissance and credential theft were observed in at least one intrusion.
• The reviewed sources do not describe a detailed post-exploitation chain for CVE-2026-88771.

8. Observable Logs

• Email: The reviewed sources do not identify email as the initial intrusion vector.
• Proxy / SWG / DNS: Review available upstream firewall, load balancer, proxy, and DNS records for relevant sources, destinations, and unusual connections. Encrypted traffic and limited logging may prevent inspection of request contents.
• Endpoint / EDR: Use appliance logs and forensic collection, supplemented by endpoint telemetry where available. Examine /etc/httpd.conf, including unauthorized AddHandler and AliasMatch entries; suspicious files under /netscaler/gui/vpn/scripts/linux and /var/netscaler/gui/vpn/scripts/linux; /bin/sh permissions; httpd restarts; appliance reboots; suspicious Python execution; and /tmp/.uxdport and /tmp/.uxdlock. Review /var/log/messages for NSPPE and pitboss events.
• Identity / IdP: Review administrator, VPN, SAML, and related authentication records for unfamiliar sources, anomalous sessions, and activity correlated with appliance configuration changes.
• SaaS / Cloud: Review NetScaler Console Security Advisory results, telemetry, and configuration histories. A negative IoC scan does not establish that an appliance is uncompromised.
• Network: Investigate connections from the appliance to internal hosts and suspicious external communications. Correlate network records with appliance events and web access logs, including .ico requests returning 404 responses with unusual duration or response size. HTTP status codes and response details require suitable web or application-layer visibility.

9. Assessing Attack Success

• Subsequent Compromise Confirmed: GTIG and Mandiant reported post-exploitation artifacts and tooling, including web shells, setuid shells, WHIPSHOT, and SLAPSHOT, across the CVE-2026-88772 compromises they investigated. Internal reconnaissance and credential theft were confirmed in at least one intrusion. This does not establish that every compromised appliance experienced all reported activities, and the full post-exploitation scope remains undisclosed.
• For an individual appliance, distinguish evidence of contact or a crash from evidence of root execution, persistence, proxy use, and credential theft.

10. Investigation Playbook

• Investigation Starting Point: Investigate DTLS handshake failures, NSPPE crashes, Citrix/Mandiant IoC matches, or anomalous web responses. Do not require all indicators to appear together before investigating.
• Initial Verification: Preserve build information, DTLS settings, exposure periods, system and web logs, /var/log/messages, httpd.conf, VPN web directories, and reboot histories.
• Endpoint and Server Investigation: Examine suspicious .deb, .sig, and nginstaller-related files; WHIPSHOT and SLAPSHOT artifacts; /bin/sh permissions; unexpected changes to /etc/crontab; temporary files; and Python processes.
• Authentication and Cloud Investigation: Investigate VPN, SAML, LDAP, and service credentials handled by the appliance, together with subsequent authentication activity. Identify credentials requiring rotation and sessions requiring revocation.
• Tracking Subsequent Activity: Trace connections from the appliance to internal hosts, credential use, lateral movement, and data access.
• Containment: Isolate suspected or confirmed compromised appliances and preserve evidence. Apply the appropriate patched release. For confirmed compromise, restore a trusted state using verified images and configurations, and rotate exposed credentials after securing the environment.
• Categorization of Findings: Record DTLS contact, NSPPE crashes, root execution, web shell deployment, setuid shell access, internal proxying, and credential theft as separate findings.

11. Defense and Detection Ideas

• Single Events: Prioritize investigation of relevant DTLS errors, NSPPE orphan-ring messages, unexpected setuid changes to /bin/sh, and unauthorized httpd.conf handler additions.
• Temporal Correlation: Correlate DTLS failures, NSPPE termination, reboots or httpd restarts, suspicious web requests, and internal TCP connections. Treat this as an investigative sequence rather than a mandatory combination of events.
• Threat Hunting: Hunt for unauthorized .deb/.sig PHP handlers, suspicious nginstaller-related files, .uxdport/.uxdlock, and web shell code processing identifiers such as HTTP_NSC_LDAP and HTTP_NSC_CLIENTTYPE. These are PHP-side header identifiers; account for header-name normalization when comparing them with captured HTTP requests.
• Log Limitations: Some reported web shell variants return 404 responses, and filenames vary between victims. Missing IoC matches do not rule out compromise. Verify collection of FreeBSD system messages as well as NetScaler logs; standard ns.log forwarding alone does not capture every relevant appliance log.
• Priority Countermeasures: Prioritize patching, temporary DTLS mitigation for CVE-2026-88772 where applicable, off-box logging, and FIM. For compromised appliances, also prioritize trusted recovery and credential rotation.

12. Facts / Inference / Hypothesis

Facts

• Citrix confirmed exploitation of CVE-2026-88771 and CVE-2026-88772 in unmitigated deployments. Its bulletin does not provide per-victim outcomes or a detailed post-exploitation account. GTIG and Mandiant subsequently published findings on CVE-2026-88772 compromises.
• CVE-2026-88771 is a pre-authentication RCE vulnerability caused by improper input validation. On affected versions, all deployment configurations meet its feature-related precondition, including default configurations. Its CVSS v4.0 base score is 9.5.
• CVE-2026-88772 is a memory-overflow vulnerability that can lead to RCE or DoS. It requires DTLS to be enabled, including on VPN virtual servers or virtual servers of type DTLS. DTLS is enabled by default on VPN virtual servers. Its CVSS v4.0 base score is also 9.5.
• Patched releases include 14.1-73.37 and later releases in that branch, 13.1-64.23 and later releases of 13.1, 14.1-73.37 FIPS and later releases of 14.1-FIPS, and 13.1-37.279 and later releases of 13.1-FIPS/13.1-NDcPP. Citrix directs customers with configurations affected by the 13.1-64.23 reboot-loop issue to 13.1-64.24.
• The bulletin applies to customer-managed NetScaler appliances, including those used with Secure Private Access Hybrid. Cloud Software Group handles updates for Citrix-managed cloud services and Citrix-managed Adaptive Authentication.
• NetScaler Console's Security Advisory IoC scanning requires telemetry and manual initiation, together with the documented feature prerequisites. It does not detect every possible compromise.
• GTIG and Mandiant reported NSPPE termination artifacts and initial root-level access in investigated CVE-2026-88772 compromises.
• Reported post-exploitation activity included changes to httpd.conf, PHP web shells disguised as .deb or .sig files, WHIPSHOT, and the Python-based tunneler SLAPSHOT. Some web shell variants returned HTTP 404 responses while handling attacker requests.
• Attackers used chmod u+s /bin/sh to enable root command execution from the web service context. Appliance reboots or httpd restarts were used to apply web server configuration changes.
• Manual internal reconnaissance and credential theft through the proxy were observed in at least one intrusion.

Inference

• GTIG's telemetry-based analysis suggests that malformed or fragmented DTLS record headers corrupt NSPPE heap memory and divert control flow to root-level shellcode. The exploit code itself was not available to GTIG.
• Disabling DTLS across the relevant virtual servers removes the DTLS prerequisite for CVE-2026-88772, but does not mitigate CVE-2026-88771 or restore trust in an already compromised appliance.
• .ico requests returning 404 responses with unusually long processing times and large response bodies may warrant investigation for requests mapped to a .sig web shell through AliasMatch. These characteristics alone are not proof of malicious execution.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in “14. Unresolved Points and Further Investigation.”

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Active exploitation of CVE-2026-88772 against exposed NetScaler services was reported.
T1505.003	Server Software Component: Web Shell	high	PHP web shells, including WHIPSHOT, were observed; reported variants used disguised extensions and 404 responses.
T1548.001	Abuse Elevation Control Mechanism: Setuid and Setgid	high	Attackers used chmod u+s /bin/sh to enable root command execution from the web service context.
T1090.001	Proxy: Internal Proxy	high	SLAPSHOT relayed TCP traffic from the compromised appliance to internal hosts.

14. Unresolved Points and Further Investigation

• The identities of the threat actors and the total number of compromises worldwide.
• The relationship, if any, between CVE-2026-88771 exploitation and the investigated CVE-2026-88772 campaign.
• The specific credentials stolen during proxy-enabled activity and the full extent of subsequent compromise of internal systems.

15. Impact on SOCs and Organizations

Organizations in Japan use NetScaler as a gateway for VPNs and public applications. They should promptly patch affected appliances for both vulnerabilities. Because CVE-2026-88771 requires no additional features to be enabled, changing DTLS settings alone is insufficient.

The absence of visible compromise indicators does not establish that an appliance is trustworthy. Investigations should examine available configurations, files, processes, authentication records, and communications from the pre-patch exposure period, while recognizing gaps in historical evidence.

16. Summary by Target Audience

• For SOCs: Correlate appliance audit, system, web, network, and authentication records across the pre-patch exposure period. Do not infer that an appliance is uncompromised solely from a negative IoC scan.
• For Administrators: Update the affected release branch to an applicable patched build. Check whether the 13.1-64.23 reboot-loop issue applies and use 13.1-64.24 where necessary. Restrict unnecessary exposure and assess the relevant configurations and operational impact before temporarily disabling DTLS pending patching.
• For Users: These are appliance-side vulnerabilities that do not require user interaction. Administrators need to apply emergency updates and investigate possible compromise.

Comments

[MD Pabel]

A clean IOC scan is not proof that the device was never compromised. Reviewing the full pre-patch exposure period is an important step.

[Anoymask]

Exactly. A clean IOC scan should never be treated as an absolute clean bill of health. Thoroughly auditing the entire exposure window and historical telemetry is crucial for proper incident response. Thanks for pointing this out!