Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 (PitScaler) exploited since Aug 2026; SAML flaws CVE-2026-88779 and CVE-2026-107406 follow

Linha do tempo

1. securityweek.com ↗ · pub. 27/10/2026 07:02 · coletado 27/10 09:00

   Opinion: Citrix NetScaler zero-days CVE-2026-88771–88778 show faster detection, disclosure and KEV response at the edge

   This opinion piece adds that Dutch government analysts and private incident responders first noticed the attack traffic, that Citrix's NetScaler CNA cut CVE disclosure time from nearly 40 days to 17 days, and that CISA's KEV additions for the NetScaler flaws came on a Sunday. It dates the start of exploitation to mid-September, later than Unit 42's findings, and its CVE-gap remark treats CVE-2026-88779 as still unpublished.

   ler a análise desta fonte ocultar

   This opinion piece adds that Dutch government analysts and private incident responders first noticed the attack traffic, that Citrix's NetScaler CNA cut CVE disclosure time from nearly 40 days to 17 days, and that CISA's KEV additions for the NetScaler flaws came on a Sunday. It dates the start of exploitation to mid-September, later than Unit 42's findings, and its CVE-gap remark treats CVE-2026-88779 as still unpublished.

   An opinion piece by Tod Beardsley (runZero, formerly CISA) argues that the September 2026 Citrix NetScaler ADC and Gateway zero-day response shows edge defense working as intended. Unidentified actors began exploiting undisclosed flaws around mid-September. Dutch government threat analysts and private incident responders spotted suspicious traffic, and resellers and advisories urged admins to restrict or disconnect edge deployments over the weekend of September 26. Citrix shipped patches that Sunday for unauthenticated RCE flaws tracked CVE-2026-88771 through CVE-2026-88778. The author says Citrix cut its bug-to-CVE disclosure time from nearly 40 days (2024-2025) to 17 days in 2026 after creating a dedicated NetScaler CNA. He also notes that CISA added two NetScaler CVEs to the KEV catalog on a Sunday, only the second Sunday KEV addition after SharePoint in 2025. He warns that consolidated edge devices will stay prime targets.

   Technical Details

   • Flaws are described as unauthenticated remote code execution in NetScaler ADC and Gateway, tracked CVE-2026-88771 to CVE-2026-88778.
   • The author notes a gap in published CVE IDs (CVE-2026-88779 to CVE-2026-88787) as of writing and suggests secondary advisories may follow.
   • No actor, IOCs or exploitation chain are given in the article.

   Remediation

   • Apply the Citrix emergency patches and keep patch pipelines ready for further NetScaler releases.
   • Keep the perimeter asset inventory accurate and rehearse emergency patch drills.
   • Restrict or disconnect exposed edge deployments when exploitation is reported.
2. gbhackers.com ↗ · pub. 23/10/2026 04:56 · coletado 23/10 05:00

   Citrix NetScaler ADC/Gateway CVE-2026-88771 unauthenticated RCE exploited via log poisoning to drop web shells and FreeBSD implant

   ler a análise desta fonte ocultar

   Attackers are actively exploiting CVE-2026-88771, a critical (CVSS v4.0 9.5) unauthenticated remote code execution flaw in Citrix NetScaler ADC and Gateway. The bug is an improper input-validation issue that needs no optional features enabled. Citrix disclosed it on September 27, 2026, and CISA added it to the Known Exploited Vulnerabilities catalog. ThreatLabz observed log poisoning to trigger command execution, web shell deployment and attempts to run a Rust-based FreeBSD x64 implant. The payload was served from infrastructure that ThreatLabz had also linked to exploitation of CVE-2026-75650 (StyleSmuggler) in Adobe Commerce and Magento. The article says this overlap does not by itself prove the same actor ran both campaigns.

   Technical Details

   • A NetScaler diagnostic Perl script searches system logs for PPE failure messages such as "PPE missed too many heartbeats" or "PPE unexpectedly died". It inserts the selected record into a shell command without adequately escaping attacker-controlled content. CERT-EU reports that the script picks the last matching entry, which explains the repeated trigger attempts.
   • Payload delivery and execution are separate steps. Attackers first send GET requests to common NetScaler paths with a User-Agent beginning INDEX: followed by Base64-encoded commands, which land in the HTTP access logs. They then submit crafted login requests containing forged PPE failure messages. Appended commands search the HTTP logs for the INDEX: marker, decode the payload and pass it to a shell.
   • Decoded staged commands tried to create files in several appliance web directories, enable PHP or Perl CGI and install web-accessible scripts. An inline command downloaded and ran a Rust-based FreeBSD 64-bit binary.
   • Observed attempts do not prove that every targeted appliance was compromised.
   • CERT-EU independently documented the same general technique.
   • CVE-2026-107406 is a separate Citrix issue affecting NetScaler appliances configured as SAML SP or IdP (RCE or DoS). It has its own fixed builds (14.1-73.46, 13.1-64.29) and is not part of this attack chain.

   Remediation

   • Upgrade to the fixed releases for CVE-2026-88771: 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1.37.279 for FIPS and NDcPP. Verify the product branch first.
   • Before updating a potentially compromised appliance, preserve logs, support bundles and core dumps.
   • Isolate suspect systems and hunt for INDEX: User-Agent values, forged PPE failure messages, unexpected web files, HTTP configuration changes, suspicious processes and unfamiliar outbound connections.
   • If compromise is confirmed, rotate credentials and other secrets accessible through the appliance.
3. cisa.gov ↗ · pub. 27/09/2026 09:00 · coletado 19/10 18:37

   CISA urges Citrix NetScaler ADC/Gateway patching and compromise checks as zero-days, including new CVE-2026-107406, are exploited

   The CISA alert references an additional Citrix bulletin, CVE-2026-107406, with immediate-guidance material, which is not among the CVEs tracked in the existing case. It also adds CISA's operational guidance: check for compromise before patching, preserve forensics, forward logs to a SIEM, restore a pre-compromise backup and rotate all secrets. It also publishes a CISA SIGMA detection rule.

   ler a análise desta fonte ocultar

   The CISA alert references an additional Citrix bulletin, CVE-2026-107406, with immediate-guidance material, which is not among the CVEs tracked in the existing case. It also adds CISA's operational guidance: check for compromise before patching, preserve forensics, forward logs to a SIEM, restore a pre-compromise backup and rotate all secrets. It also publishes a CISA SIGMA detection rule.

   CISA issued an alert on exploitation of critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, noting confirmed malicious activity involving at least some of them. The alert references Citrix bulletins for CVE-2026-107406, CVE-2026-88779 and CVE-2026-88771 through CVE-2026-88778. Because NetScaler updates can be complex and require downtime, CISA is helping organizations assess exposure and prioritize mitigation. It urges administrators to install the updated versions as soon as possible, but to check for indications of compromise first.

   Technical Details

   • The article gives no technical detail on the individual flaws, exploitation methods, threat actors or victims. It points to Citrix Security Bulletins and Community guidance for each CVE.
   • Citrix has made indicators of compromise available through NetScaler Console.
   • CISA published a SIGMA detection rule in its SIGMA Rules GitHub repository to help identify suspicious activity in relevant log sources. The rule may be updated.
   • Local NetScaler logs can rotate quickly and overwrite forensic artifacts.

   Remediation

   • Review the Citrix advisories and install the relevant updated versions as soon as possible.
   • Check for indications of compromise before patching, using the Citrix IOCs in NetScaler Console and the guidance in the Security Bulletins.
   • Forward NetScaler logs to a centralized SIEM or log retention system.
   • If compromise is suspected, preserve forensic evidence before updating, because updates may reduce forensic visibility.
   • Restore a known good backup that pre-dates any confirmed or suspected compromise, then rotate all restored secrets: local account passwords, key-encryption keys and SSL certificates.
   • Follow Citrix's "Steps to Take if NetScaler ADC is Suspected to be Compromised".
4. blog.cloudflare.com ↗ · pub. 19/10/2026 10:00 · coletado 19/10 18:00

   Cloudflare outlines pre-patch defenses for Citrix NetScaler Gateway after exploited CVE-2026-88771 and CVE-2026-88772

   Adds Cloudflare's response: an emergency WAF rule released on October 1 for CVE-2026-88771, and defense-in-depth guidance (Access policies, origin lockdown via Tunnel or mTLS, WAF Attack Score, Zero Trust for ICA traffic). It also notes Citrix advisories on October 3 and October 8 for SAML-related flaws, and that web-path protection does not cover DTLS listeners.

   ler a análise desta fonte ocultar

   Adds Cloudflare's response: an emergency WAF rule released on October 1 for CVE-2026-88771, and defense-in-depth guidance (Access policies, origin lockdown via Tunnel or mTLS, WAF Attack Score, Zero Trust for ICA traffic). It also notes Citrix advisories on October 3 and October 8 for SAML-related flaws, and that web-path protection does not cover DTLS listeners.

   Cloudflare published defensive guidance following the disclosure of actively exploited Citrix NetScaler vulnerabilities. CVE-2026-88771 allows unauthenticated command execution on affected appliances, including in the default configuration. CVE-2026-88772 affects configurations using DTLS. Citrix's September 27, 2026 bulletin reported observed exploitation, and Cloudflare shipped an emergency WAF rule on October 1. The article stresses that patching comes first and that a publicly reachable gateway login page is an attack surface that needs layered controls.

   Technical Details

   • Citrix bulletin of Sept. 27, 2026 covers CVE-2026-88771 (unauthenticated command execution) and CVE-2026-88772 (DTLS configurations). Further advisories on Oct. 3 and Oct. 8 addressed additional SAML-related vulnerabilities that allow arbitrary script execution and denial of service.
   • A WAF is reactive. Cloudflare notes that AI is speeding up attackers' discovery of new variants.
   • Protecting the web authentication path does not cover other gateway services such as DTLS-enabled listeners, which need their own exposure review and updates.
   • The article cites CISA's alert and Mandiant's technical investigation for details on exploitation and response.
   • No IOCs or attribution are given in this article.

   Remediation

   • Patch all NetScaler instances first, then follow Citrix's suspected-compromise guidance: preserve evidence, revoke credentials and certificates, investigate connected systems, and rebuild or restore from a known-good state.
   • Put the gateway behind single sign-on / Zero Trust (Cloudflare Access) so attackers only reach the login page, not the gateway itself.
   • Make sure the origin cannot be reached directly or via alternate hostnames. Options are Cloudflare Tunnel (closing inbound traffic), Dedicated CDN Egress IPs, Authenticated Origin Pulls (mTLS), and origin validation of the Access JWT.
   • Use WAF managed CVE signatures, WAF Attack Score and geo/ASN/IP blocking.
   • Extend Zero Trust to ICA desktop traffic, or replace virtual desktops with browser-based remote desktop or Browser Isolation where possible.
   • Validate the boundary: test unauthenticated requests, unauthorized accounts, direct-origin addresses and alternate hostnames, and check logs after config changes.
5. tenable.com ↗ · pub. 27/09/2026 06:35 · coletado 19/10 18:00

   Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 (PitScaler) exploited for RCE; SAML DoS flaw CVE-2026-88779 also exploited

   ler a análise desta fonte ocultar

   Citrix confirmed two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772 (CVSSv4 9.5 each, dubbed "PitScaler"). Both allow remote code execution and have been exploited in the wild. Patches were released on September 27, 2026. On October 3, Citrix disclosed a third exploited flaw, CVE-2026-88779 (CVSSv4 8.7), a memory overflow causing denial of service on SAML SP/IdP deployments, which requires newer builds. Mandiant and Google Threat Intelligence Group (GTIG) report that exploitation of CVE-2026-88772 began no later than early September 2026 and likely affected government, education, technology, financial services and legal/professional services organizations in North America and Europe. No threat actor has been publicly named. CISA added all three CVEs to its KEV catalog.

   Technical Details

   • CVE-2026-88771 is an improper input validation flaw affecting all deployments, including default configurations.
   • CVE-2026-88772 is a memory overflow that affects only appliances with DTLS enabled (the default on VPN virtual servers). Mandiant/GTIG assess that attackers send malformed DTLS traffic to obtain root-level access.
   • CVE-2026-88779 affects only appliances configured as a SAML SP (add authentication samlAction) or SAML IdP (add authentication samlIdPProfile). Citrix observed targeted attacks on unmitigated deployments, and ASD's ACSC confirmed Australian victims.
   • Mandiant/GTIG identified two new malware families, WHIPSHOT and SLAPSHOT, in CVE-2026-88772 attacks.
   • Citrix also patched six further flaws: CVE-2026-88773 (HTTP request smuggling, 9.3), CVE-2026-88774 (feature policy bypass, 7.0), CVE-2026-88775/88776/88777 (memory overflows, 8.8) and CVE-2026-88778 (TCP ISN prediction, 8.8).
   • watchTowr published technical analyses and tools demonstrating code execution for CVE-2026-88771 and CVE-2026-88772, which work as public PoCs. No public PoC is known for CVE-2026-88779.
   • ASD's ACSC advises hunting for compromise back to at least September 4, 2026.

   Remediation

   • Upgrade to fixed builds. For CVE-2026-88771 through CVE-2026-88778: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 FIPS/NDcPP, or later. For CVE-2026-88779: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 FIPS/NDcPP, or later. SAML users who already installed the September 27 builds must upgrade again.
   • For CVE-2026-88778, enable Enhanced ISN Generation in the TCP settings.
   • Interim mitigations for CVE-2026-88772: block inbound UDP/443 upstream and disable DTLS where unused. These do not address CVE-2026-88771. Citrix Global Deny List signatures can help with CVE-2026-88779 on standard 14.1/13.1 appliances managed via NetScaler Console.
   • Versions 12.1 and 13.0 are end-of-life with no fixes, so migrate to a supported build.
   • Preserve evidence and hunt for compromise before patching, using Citrix IoCs (via NetScaler Console or Support) and the Mandiant/GTIG IoCs and YARA rules. After patching, revoke active sessions and rotate credentials used by the appliance.
6. unit42.paloaltonetworks.com ↗ · pub. 30/09/2026 17:00 · coletado 19/10 17:56 primeiro registro

   NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 exploited since Aug 2026 to drop PHP web shells; 50,277 exposed instances

   ler a análise desta fonte ocultar

   Unit 42 reports that two critical Citrix NetScaler ADC and Gateway zero-days, CVE-2026-88771 (unauthenticated command injection RCE) and CVE-2026-88772 (DTLS memory overflow leading to RCE or DoS), were exploited in the wild to deploy web shells for initial access and persistence. Both carry a CVSS v4.0 score of 9.5. Reconnaissance and fingerprinting began on Aug. 21, 2026, and web shell activity ran from early September until Citrix published its bulletin on Sept. 27, 2026, after which mass scanning followed. Cortex Xpanse identified 50,277 potentially vulnerable exposed instances as of Sept. 27. The article does not attribute the activity to a named actor, and post-compromise activity is still under analysis.

   Technical Details

   • Fingerprinting (from Aug. 21): hosts 104.248.244[.]66, 77.83.199[.]39 and 78.47.24[.]217 requested /admin_ui/common/css/ns/ui.css and /vpn/js/rdx/core/lang/rdx_en.json.gz against more than 100 systems.
   • CVE-2026-88772 (DTLS): crafted DTLS traffic causes memory corruption. Between Sept. 4 and 24 the actor rotated VPS and Cloudflare WARP addresses and requested .deb files (nsgclient18.deb, nsgser18.deb, nsgsupport.deb, nsgpackage64.deb, nsgbuild.deb) in /vpn/scripts/linux/, which it also used to host its web shells. From Sept. 10 to 27 it sent continuous requests to /logon/LogonPoint/Authentication/GetUserName, a path Unit 42 considers anomalous.
   • nsg64.deb web shell: a PHP web shell offering command execution (cmd), file size (size), exfiltration (dl, capped at 1,048,576 bytes per request), upload (up) and info commands. C2 traffic is RC4-encrypted with the key 7489a0f93c67fa5cdaeb4b921d90594d (MD5 of the passphrase Rhfajaf1H992). The shell escalates privileges through the NetScaler SUID binary /var/netscaler/.ns_suidcmd.
   • CVE-2026-88771 (three-stage chain, Sept. 21):
     • Stage 1: a Base64 dropper is placed in the User-Agent and logged to /var/log/httpaccess-vpn.log.
     • Stage 2: a login request injects text after pitboss PPE missed too many heartbeatsNSPPE; into /var/log/ns.log.
     • Stage 3: the vulnerable Perl script /netscaler/ns_monuploadd_err.pl executes the injected text, which greps and decodes the Base64 and pipes it to sh or php.
   • Persistence: the payload runs chmod 6555 /bin/sh and writes the web shell /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, which is gated by a CsrfToken cookie (e826d7ddf3c85920) and runs commands from the NSC_TASS cookie via passthru. It edits /etc/httpd.conf to alias the shell as receiver.min.css and receiver.min.<hex>.css, sets php_flag engine on, and reloads Apache with SIGHUP.
   • Detection: Unit 42 provides a Managed Threat Hunting query for CVE-2026-88771 log poisoning. Palo Alto Threat Prevention signature 97562 blocks CVE-2026-88771 exploitation.

   Remediation

   • Update Citrix NetScaler to the latest versions and confirm exposure using the preconditions section of the Citrix Security Advisory. Patching does not remove persistence already established.
   • Isolate vulnerable systems and preserve evidence: VPX snapshot, remote syslog and NetScaler Console logs, a technical support bundle and a packet engine core dump.
   • Hunt for the listed web shell files and anomalous GetUserName requests, as well as suspicious administrative sessions, unexpected outbound connections and logging gaps.