NetScaler CVE-2026-88771 Exploited: Patch, Check, Clean Up

Last updated: 26 October 2026. Sources are listed at the end.

A critical NetScaler vulnerability, CVE-2026-88771, lets an attacker run commands on Citrix NetScaler ADC and NetScaler Gateway appliances without logging in. Citrix (Cloud Software Group) published fixes on 27 September 2026, alongside a second exploited flaw, CVE-2026-88772. Both carry a CVSS v4.0 score of 9.5, and both were used in attacks before a patch existed.

The story did not end there. In early October, administrators reported crashes on appliances they had patched only days earlier. That turned into a new SAML zero-day, CVE-2026-88779, and then a further SAML fix for CVE-2026-107406. As a result, an appliance patched in late September may still need one more upgrade.

If your company runs a NetScaler box for remote access, Citrix Virtual Apps, single sign-on or load balancing, this guide is for you. It covers versions, checks, clean-up and what is still unclear.

The short answer

• Upgrade to 14.1-73.46 or later, or 13.1-64.29 or later. FIPS/NDcPP builds have their own numbers (table below). These builds include all three September and October fixes.
• Before upgrading, save logs and a support bundle. Patching can wipe the evidence you need later.
• After upgrading, hunt for web shells, rogue admin accounts and edited web server config. A patch does not remove a backdoor that is already there.
• If you find signs of compromise, rebuild the appliance and rotate every password, secret and certificate it held.
• NetScaler 12.1 and 13.0 are end of life and get no fix. Plan a move to a supported branch.

What is the NetScaler vulnerability?

Citrix describes CVE-2026-88771 as improper input validation (CWE-20) that allows unauthenticated remote code execution. Importantly, the bulletin says it affects all deployments, including the default configuration. So it is not limited to boxes set up as a Gateway or AAA virtual server.

Zscaler ThreatLabz later explained the mechanism. In short, a maintenance script on the appliance reads NetScaler log files for packet engine failure messages. It then copies part of a matching line into a shell command without escaping it. Meanwhile, attackers can write text into those logs through the public login pages. Therefore, a fake “pitboss PPE” failure line placed in a login request ends up running as a shell command.

CVE-2026-88772 is a different bug. It is a memory overflow (CWE-119) that can lead to code execution or denial of service when DTLS is enabled. According to Citrix, DTLS is on by default for VPN virtual servers.

The same bulletin, CTX697096, also fixes six lower-rated issues, CVE-2026-88773 to CVE-2026-88778. These include HTTP request smuggling, a policy bypass, memory overflows and TCP sequence number prediction. Citrix credits Michael Tucker and Chew Keong Tan of the JPMorgan Chase XOR Team, and Maxim Suhanov, without saying who found which bug.

Timeline: confirmed and reported

So the “24 hours” figure in some roundups refers to the wave after disclosure. In fact, the flaws were being abused weeks earlier as true zero-days.

The second zero-day on patched appliances

From Friday 2 October, administrators reported unexpected reboots on appliances already running the September fix, 14.1-73.37. Citrix then confirmed a “newly observed issue” affecting SAML deployments. The fix arrived as CVE-2026-88779 (CVSS 8.7) in bulletin CTX697174, with builds 14.1-73.41 and 13.1-64.28. CISA added it to the KEV catalogue on 4 October, according to BleepingComputer.

Citrix describes CVE-2026-88779 as a denial-of-service issue. However, researcher Kevin Beaumont reported that one of his patched honeypots was running a downloaded malware binary. In addition, one administrator shared logs showing shell commands hidden in crafted usernames. That admin said the logs show attempts and crashes, but do not prove the commands ran.

Then, on 8 October, Citrix fixed CVE-2026-107406. This is a separate SAML memory overflow that Citrix says can lead to code execution. The bulletin does not say whether it was exploited. It is also not confirmed whether CVE-2026-107406 explains the code execution Beaumont reported. Treat that link as unproven.

Am I affected?

These are the minimum fixed builds for each NetScaler vulnerability bulletin. For SAML users, the last column is what you need.

Note that Citrix writes the 13.1-FIPS build as both “13.1-37.279” and “13.1.37.279” in different places. Confirm the exact string with Citrix before you download.

First, check your build from the NetScaler CLI (command from vendor docs, not tested here):

show ns version

Next, check which features are switched on. Run these from the NetScaler shell (type shell at the CLI first). They only read the saved config.

# Gateway or AAA virtual servers (CVE-2026-88775, and DTLS for 88772 on VPN vservers)
grep -E '^add (vpn|authentication) vserver' /nsconfig/ns.conf

# SAML service provider or identity provider (CVE-2026-88779, CVE-2026-107406)
grep -E 'add authentication saml(Action|IdPProfile)' /nsconfig/ns.conf

Remember that CVE-2026-88771 needs no special feature. If the build is older than 14.1-73.37 or 13.1-64.23, assume the appliance is exposed.

How to fix the NetScaler vulnerability, step by step

1. Preserve evidence first. Citrix’s compromise guide (CTX694799) asks for a VPX snapshot, remote syslog and NetScaler Console logs, a technical support bundle and a packet engine core dump. Also, note the system time and NTP settings.
2. Upgrade every node. Upgrade both members of an HA pair, or every cluster node, to the builds in the last column above. Going straight to the newest build saves a second outage later.
3. Fix the ISN setting if needed. For CVE-2026-88778, Citrix gives a check command, shown below. If it prints DISABLED and you use TCP-based virtual servers, enable Enhanced ISN Generation using the NetScaler documentation linked from the bulletin.
4. End old sessions. Citrix’s CTX697096 does not list session-kill commands. However, Citrix asked for them after earlier Gateway fixes (CTX693420), and they are a sensible precaution here too.
5. Run the IOC scan. Use the NetScaler Console security advisory page, then do the manual checks in the next section.

The ISN check below is taken from Citrix’s bulletin and was not tested here.

show ns tcpparam | grep "Enhanced ISN Generation"

These session commands come from Citrix bulletin CTX693420. Run them only after all nodes are on the fixed build.

kill icaconnection -all
kill pcoipConnection -all

If you suspect compromise, also change the passwords of users who signed in through the Gateway, as CTX694799 advises.

There is no workaround for this NetScaler vulnerability. If you cannot upgrade quickly, the safer option is to take the Gateway off the internet until you can.

Was my NetScaler already compromised?

Patching a NetScaler vulnerability closes the door, but it does not evict anyone already inside. eSentire, LevelBlue and Zscaler published artifacts from real intrusions. The checks below are read-only and use paths they named. We tested the syntax and output against a mock directory tree in a Linux sandbox. The appliance runs FreeBSD, so we avoided GNU-only options.

# 1. Hidden or recently changed files in the login pages
find /var/netscaler/logon -type f \( -name '.*' -o -mtime -60 \) -exec ls -l {} \;

# 2. Unexpected .deb files in the VPN client folder
find /var/netscaler/gui/vpn/scripts/linux -type f -mtime -60 -exec ls -l {} \;

# 3. Log poisoning attempts (current and rotated logs)
grep 'pitboss' /var/log/ns.log
zcat /var/log/ns.log.*.gz | grep 'pitboss'
grep 'INDEX:' /var/log/httpaccess*.log

# 4. Web server config changes that serve a shell as a .css file
grep -nE 'Alias|SetHandler|AddHandler|php' /etc/httpd.conf

# 5. Rogue admin accounts
grep -E '^(add|bind) system user' /nsconfig/ns.conf

# 6. setuid shell (should print nothing)
find /bin/sh -perm -4000

Legitimate files will show up in steps 1 and 2 after an upgrade. So compare results against a clean appliance on the same build. A “pitboss” match on a patched device shows an attempt, not proof of success.

Specific indicators published by named researchers include:

• Web shell: /var/netscaler/logon/LogonPoint/.local_journal, served through an alias such as /logon/LogonPoint/css/LogonUISimple.html.style.min.css (eSentire, LevelBlue).
• Rogue account: a superuser named sec_monitor added to ns.conf (LevelBlue).
• Staged config copies: /var/netscaler/logon/insight-new.js and /var/netscaler/logon/LogonPoint/xua.html (LevelBlue).
• Fake package: /var/netscaler/gui/vpn/scripts/linux/nsgtrust.deb (eSentire).
• Tampered binary: /var/python/bin/customsnmpd rewritten as a reverse shell (eSentire, LevelBlue).
• IP addresses: 64.94.85[.]67, 31.56.197[.]72, 23.27.143[.]20, 62.133.62[.]80 and 45.141.21[.]130 (LevelBlue, eSentire).
• SAML zero-day attempt: payload download from 213.209.159[.]55, saved as /v, reported by one administrator (BleepingComputer).

If anything matches, follow CTX694799. In practice, that means isolating the device, rebuilding rather than cleaning it, and restoring a backup from before the compromise. Then rotate LDAP and RADIUS secrets, API keys, KEKs and certificates. Finally, monitor the rebuilt box for at least 90 days.

What this means for Indian organisations

Many Indian banks, hospitals, IT services firms and manufacturers use NetScaler Gateway for remote access. We could not find a CERT-In advisory for this NetScaler vulnerability at the time of writing. Even so, the CERT-In Directions of April 2022 still apply. If your organisation is covered, report a compromised remote-access gateway to CERT-In within six hours of noticing it.

Also, plan ahead for the DPDP Rules. Rule 7, which requires breach notices and a detailed report to the Data Protection Board within 72 hours, applies from May 2027. It is not in force yet. Still, the logs you keep today are what will support those reports later.

Finally, check where your management interface is reachable from. Citrix’s own compromise guide says NetScaler management services should never face the public internet. Restrict them to an admin network or VPN.

Quick checklist

• ☐ Saved logs, a support bundle and a snapshot before patching
• ☐ Checked the build with show ns version
• ☐ Upgraded all nodes to 14.1-73.46, 13.1-64.29 or the matching FIPS/NDcPP build
• ☐ Enabled Enhanced ISN Generation in every partition that needs it
• ☐ Ended old ICA and PCoIP sessions
• ☐ Ran the NetScaler Console IOC scan
• ☐ Searched for .local_journal, sec_monitor, unknown .deb files and httpd.conf aliases
• ☐ Rotated secrets and certificates if anything looked wrong
• ☐ Planned a migration for any 12.1 or 13.0 appliances
• ☐ Decided whether the incident needs a CERT-In report

Edge devices such as NetScaler are now a favourite first step for attackers, as the k0t firewall and VPN campaign also showed. If you want an outside team to test your remote-access gateways and internet-facing systems, see our VAPT services. For a quick look at your public website, try the free website safety check.

Sources

• Citrix bulletin CTX697096: CVE-2026-88771 to CVE-2026-88778
• Citrix bulletin CTX697191: CVE-2026-107406
• Citrix CTX694799: steps if NetScaler is suspected to be compromised
• Citrix bulletin CTX693420 (session termination commands)
• BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks
• eSentire: tracking Citrix NetScaler exploitation of CVE-2026-88771
• Zscaler ThreatLabz: inside the exploitation of CVE-2026-88771
• LevelBlue SpiderLabs: CVE-2026-88771 artifacts and hunt indicators

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.