/
← Voltar ao feed
critical government education technology financial services legal and professional services

CISA urges Citrix NetScaler ADC/Gateway patching and compromise checks as zero-days, including new CVE-2026-107406, are exploited

2 fonte(s) · 2 atualização(ões) · publicado 27/09/2026 06:35 · coletado há 1 dia

CISA issued an alert on exploitation of critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, noting confirmed malicious activity involving at least some of them. The alert references Citrix bulletins for CVE-2026-107406, CVE-2026-88779 and CVE-2026-88771 through CVE-2026-88778. Because NetScaler updates can be complex and require downtime, CISA is helping organizations assess exposure and prioritize mitigation. It urges administrators to install the updated versions as soon as possible, but to check for indications of compromise first.

Technical Details

  • The article gives no technical detail on the individual flaws, exploitation methods, threat actors or victims. It points to Citrix Security Bulletins and Community guidance for each CVE.
  • Citrix has made indicators of compromise available through NetScaler Console.
  • CISA published a SIGMA detection rule in its SIGMA Rules GitHub repository to help identify suspicious activity in relevant log sources. The rule may be updated.
  • Local NetScaler logs can rotate quickly and overwrite forensic artifacts.

Remediation

  • Review the Citrix advisories and install the relevant updated versions as soon as possible.
  • Check for indications of compromise before patching, using the Citrix IOCs in NetScaler Console and the guidance in the Security Bulletins.
  • Forward NetScaler logs to a centralized SIEM or log retention system.
  • If compromise is suspected, preserve forensic evidence before updating, because updates may reduce forensic visibility.
  • Restore a known good backup that pre-dates any confirmed or suspected compromise, then rotate all restored secrets: local account passwords, key-encryption keys and SSL certificates.
  • Follow Citrix's "Steps to Take if NetScaler ADC is Suspected to be Compromised".

Linha do tempo

  1. cisa.gov ↗ · pub. 27/09/2026 09:00 · coletado 19/10 18:37

    CISA urges Citrix NetScaler ADC/Gateway patching and compromise checks as zero-days, including new CVE-2026-107406, are exploited

    The CISA alert references an additional Citrix bulletin, CVE-2026-107406, with immediate-guidance material, which is not among the CVEs tracked in the existing case. It also adds CISA's operational guidance: check for compromise before patching, preserve forensics, forward logs to a SIEM, restore a pre-compromise backup and rotate all secrets. It also publishes a CISA SIGMA detection rule.

    ler a análise desta fonte

    The CISA alert references an additional Citrix bulletin, CVE-2026-107406, with immediate-guidance material, which is not among the CVEs tracked in the existing case. It also adds CISA's operational guidance: check for compromise before patching, preserve forensics, forward logs to a SIEM, restore a pre-compromise backup and rotate all secrets. It also publishes a CISA SIGMA detection rule.

    CISA issued an alert on exploitation of critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, noting confirmed malicious activity involving at least some of them. The alert references Citrix bulletins for CVE-2026-107406, CVE-2026-88779 and CVE-2026-88771 through CVE-2026-88778. Because NetScaler updates can be complex and require downtime, CISA is helping organizations assess exposure and prioritize mitigation. It urges administrators to install the updated versions as soon as possible, but to check for indications of compromise first.

    Technical Details

    • The article gives no technical detail on the individual flaws, exploitation methods, threat actors or victims. It points to Citrix Security Bulletins and Community guidance for each CVE.
    • Citrix has made indicators of compromise available through NetScaler Console.
    • CISA published a SIGMA detection rule in its SIGMA Rules GitHub repository to help identify suspicious activity in relevant log sources. The rule may be updated.
    • Local NetScaler logs can rotate quickly and overwrite forensic artifacts.

    Remediation

    • Review the Citrix advisories and install the relevant updated versions as soon as possible.
    • Check for indications of compromise before patching, using the Citrix IOCs in NetScaler Console and the guidance in the Security Bulletins.
    • Forward NetScaler logs to a centralized SIEM or log retention system.
    • If compromise is suspected, preserve forensic evidence before updating, because updates may reduce forensic visibility.
    • Restore a known good backup that pre-dates any confirmed or suspected compromise, then rotate all restored secrets: local account passwords, key-encryption keys and SSL certificates.
    • Follow Citrix's "Steps to Take if NetScaler ADC is Suspected to be Compromised".
  2. tenable.com ↗ · pub. 27/09/2026 06:35 · coletado 19/10 18:00 primeiro registro

    Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 (PitScaler) exploited for RCE; SAML DoS flaw CVE-2026-88779 also exploited

    ler a análise desta fonte

    Citrix confirmed two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772 (CVSSv4 9.5 each, dubbed "PitScaler"). Both allow remote code execution and have been exploited in the wild. Patches were released on September 27, 2026. On October 3, Citrix disclosed a third exploited flaw, CVE-2026-88779 (CVSSv4 8.7), a memory overflow causing denial of service on SAML SP/IdP deployments, which requires newer builds. Mandiant and Google Threat Intelligence Group (GTIG) report that exploitation of CVE-2026-88772 began no later than early September 2026 and likely affected government, education, technology, financial services and legal/professional services organizations in North America and Europe. No threat actor has been publicly named. CISA added all three CVEs to its KEV catalog.

    Technical Details

    • CVE-2026-88771 is an improper input validation flaw affecting all deployments, including default configurations.
    • CVE-2026-88772 is a memory overflow that affects only appliances with DTLS enabled (the default on VPN virtual servers). Mandiant/GTIG assess that attackers send malformed DTLS traffic to obtain root-level access.
    • CVE-2026-88779 affects only appliances configured as a SAML SP (add authentication samlAction) or SAML IdP (add authentication samlIdPProfile). Citrix observed targeted attacks on unmitigated deployments, and ASD's ACSC confirmed Australian victims.
    • Mandiant/GTIG identified two new malware families, WHIPSHOT and SLAPSHOT, in CVE-2026-88772 attacks.
    • Citrix also patched six further flaws: CVE-2026-88773 (HTTP request smuggling, 9.3), CVE-2026-88774 (feature policy bypass, 7.0), CVE-2026-88775/88776/88777 (memory overflows, 8.8) and CVE-2026-88778 (TCP ISN prediction, 8.8).
    • watchTowr published technical analyses and tools demonstrating code execution for CVE-2026-88771 and CVE-2026-88772, which work as public PoCs. No public PoC is known for CVE-2026-88779.
    • ASD's ACSC advises hunting for compromise back to at least September 4, 2026.

    Remediation

    • Upgrade to fixed builds. For CVE-2026-88771 through CVE-2026-88778: 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 FIPS/NDcPP, or later. For CVE-2026-88779: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 FIPS/NDcPP, or later. SAML users who already installed the September 27 builds must upgrade again.
    • For CVE-2026-88778, enable Enhanced ISN Generation in the TCP settings.
    • Interim mitigations for CVE-2026-88772: block inbound UDP/443 upstream and disable DTLS where unused. These do not address CVE-2026-88771. Citrix Global Deny List signatures can help with CVE-2026-88779 on standard 14.1/13.1 appliances managed via NetScaler Console.
    • Versions 12.1 and 13.0 are end-of-life with no fixes, so migrate to a supported build.
    • Preserve evidence and hunt for compromise before patching, using Citrix IoCs (via NetScaler Console or Support) and the Mandiant/GTIG IoCs and YARA rules. After patching, revoke active sessions and rotate credentials used by the appliance.