Citrix NetScaler: 5 Exploited Flaws, CVE-2026-88771 RCE

While going through CISA KEV, I kept seeing NetScaler appear from late Aug. to early Oct. 2026, totaling 5 CVEs, so I read through the Citrix bulletins one by one. These are different types of vulnerabilities: unauthenticated RCE, authentication bypass, and DoS caused by memory overflow. This post breaks them down by group.

What happened

One common misunderstanding is that the memory overflow vulnerabilities read memory to steal sessions, but the bulletins for 8452 and 88779 list only DoS as the impact. Only 88772 is described as potentially leading to RCE, and 19490 is an actual authentication bypass. Citrix does not mention session theft in any of the four bulletins I read.

For 88771, Palo Alto Networks Unit 42 describes an observed attack chain in 3 stages: embed a Base64 command in the User-Agent header so it gets recorded in the access log, then send a login request that causes a specially crafted error message to be written to ns.log, after which the Perl script ns_monuploadd_err.pl reads the injected line and executes it as a command. The result is a web shell installed in the login page directory. For the 88772 attack path through DTLS, Unit 42 found a .deb file containing a PHP web shell.

Severity

All scores are CVSS v4.0 scores assigned by Citrix, which cannot be compared directly with v3.1 scores for other products. More important than the scores is the exploitation status.

• 88771 and 88772 The Citrix bulletin (CTX697096, published 27 Sep. 2026) states, "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed". Both entered KEV the same day, with a federal deadline of 30 Sep. Unit 42 reports seeing requests consistent with version scanning from 21 Aug., repeated requests for .deb files from /vpn/scripts/linux/ between 4 and 24 Sep., corresponding to the DTLS attack path for 88772, and the three-stage attack chain for 88771 on 21 Sep., all before disclosure.
• 8452, 19490, 88779 The Citrix bulletins do not state that these were exploited. That status comes from CISA KEV (and SSVC data in the CVE records marking exploitation as active), so I can only say that they are in KEV, with no details of the attack methods from the vendor.
• The gap between patch release and KEV inclusion is interesting: 8452 was disclosed on 30 Jun. and entered KEV on 26 Aug., 57 days later, while 19490 was disclosed on 19 Aug. and entered KEV on 9 Sep., 21 days later. Appliances patched on a normal schedule shortly after disclosure therefore avoided these two, while 88771/88772 offered no such window.

CISA lists the ransomware status of all five as "Unknown".

Who is affected, and fixed builds

All bulletins have the same scope: NetScaler ADC and Gateway branches 14.1 and 13.1, including FIPS and NDcPP, as well as Secure Private Access Hybrid using NetScaler. Cloud Software Group handles updates for Citrix-managed cloud service and Citrix-managed Adaptive Authentication.

Every bulletin says "and later", so installing the build in the bottom row once covers everything above it. The bulletins alternate between dots and hyphens when writing FIPS 13.1 build numbers (13.1.37.279 and 13.1-37.279); I use the hyphen to match the branch name, but check it again against the actual version you download. The bulletin for 88771/88772 also fixes another 6 vulnerabilities (CVE-2026-88773 through 88778) in the same releases, for a total of 8.

How to fix it

1. Check whether the conditions apply Check the version and search the config using the commands below. If it is a Gateway or AAA vserver, assume that the conditions for several of these apply.
2. Preserve evidence before updating If there is reason to suspect a compromise, follow Unit 42's recommendations: a VPX snapshot, logs exported off the appliance, a technical support bundle, and a packet engine core dump.
3. Install the target build 14.1-73.41 or 13.1-64.28 or later (see the table for FIPS).
4. Look for signs of compromise After updating, follow the next section.

# NetScaler CLI ดูรุ่น และค้น config ตามที่ Citrix ระบุในบูลเลติน
show ns version
show ns runningConfig | grep "add authentication samlAction"
show ns runningConfig | grep "add authentication vserver"
show ns runningConfig | grep "add vpn vserver"
show ns tcpparam | grep "Enhanced ISN Generation"

The last line concerns CVE-2026-88778, for which Citrix provides enabling Enhanced ISN Generation as a workaround if it shows DISABLED and a TCP-based vserver is in use. This is unrelated to KEV, but it is the only vulnerability in that bulletin that can be addressed through configuration.

On sessions, I found no recommendation in the Citrix bulletins to kill sessions or change user passwords; neither CTX697096 nor the other bulletins mention it. I therefore will not state that it is required. Personally, if there is evidence that an appliance was compromised, I would consider password changes and the handling of sessions that passed through it a decision based on each organization's investigation findings.

Checking for compromise

The Unit 42 report identifies the following things to look for:

• The file /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver (the PHP web shell used in the 88771 attack path)
• .deb files under /vpn/scripts/linux/. Unit 42 lists two filenames as indicators: nsgclient18.deb and nsg64.deb. The names nsgser18.deb, nsgsupport.deb, nsgpackage64.deb, and nsgbuild.deb are filenames requested by the attackers, which the report does not include in its indicator list. If you find files with these names, preserve evidence and compare their hashes with the report before drawing a conclusion, because this directory normally stores Citrix client installers.
• pitboss entries in /var/log/ns.log, which Unit 42 uses as a search condition for command injection
• Requests to /logon/LogonPoint/Authentication/GetUserName between 10 and 27 Sep., which Unit 42 describes as highly unusual
• A caution: Unit 42 itself warns that scanning after disclosure may not match the indicators from the initial incident, and finding pitboss on an unpatched appliance means a command was injected, but does not confirm execution on a patched appliance.

# หลังเข้า shell ของ appliance (คำสั่ง shell จาก CLI) อ่านอย่างเดียว
ls -la /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver
# /vpn/scripts/linux/ ในรายงานมาจากฝั่ง request บนเว็บ ตำแหน่งจริงบนดิสก์ผมไม่ยืนยัน เลยค้นตามชื่อไฟล์
find /var/netscaler /netscaler \( -name 'nsgclient18.deb' -o -name 'nsg64.deb' \) -print 2>/dev/null
grep -c pitboss /var/log/ns.log

# access log ที่ export ไว้ในเครื่องวิเคราะห์ นับ request ต่อไฟล์ (พาธเป็นตัวอย่าง)
for f in /srv/logs/netscaler/httpaccess-vpn.log*; do
  printf '%s ' "$f"; zgrep -c '/logon/LogonPoint/Authentication/GetUserName' "$f"
done

If you find anything matching the list, treat the appliance as compromised, isolate it from the network, preserve evidence, and then investigate. Do not reboot or update it yet.

Personally, for an internet-facing NetScaler serving as a Gateway or AAA, I would not wait for the maintenance window, because 88771 requires no authentication and affects default configurations, and Unit 42 observed exploitation weeks before disclosure. If a new build cannot be installed immediately, reduce internet exposure or restrict source addresses as far as operations allow, according to each organization's needs. Anyone using a vendor-managed cloud service does not need to take action.

P.S. The bulletin for 8452 (CTX696604) also fixes another 5 vulnerabilities I have not covered, such as CVE-2026-10816, which allows unauthenticated file reads if the management-enabled NSIP or SNIP is reachable. CVE-2026-13474 also requires setting http2SmallWndTimeout. If you have already installed build 72.61/63.18 or later, those are covered, but you need to read the bulletin yourself for the HTTP/2 requirement.

Sources: Citrix NetScaler Security Bulletin CTX696604 (https://support.citrix.com/external/article/696604), CTX696939 (https://support.citrix.com/external/article/696939), CTX697096 (https://support.citrix.com/external/article/697096), CTX697174 (https://support.citrix.com/external/article/697174), the CVE record for CVE-2026-8452 (https://www.cve.org/CVERecord?id=CVE-2026-8452), CVE-2026-19490, CVE-2026-88771, CVE-2026-88772 and CVE-2026-88779 in the same database, CISA KEV (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), Palo Alto Networks Unit 42 "NetScaler zero-days exploited" (https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited). Information current as of 5 Nov. 2026. If more details emerge or Citrix revises the bulletins later, I will come back and update this post.