The NetScaler Zero-Day Chaos Through a Security & Compliance Analyst's Lens

A security & compliance analyst's guide to the NetScaler zero-day chaos

Two critical Citrix NetScaler vulnerabilities — CVE-2026-88771 and CVE-2026-88772 — are under active exploitation in the wild. According to BleepingComputer's reporting, Citrix publicly confirmed the zero-day exploitation on a Sunday, days after national cybersecurity agencies, IT suppliers, and security teams began privately contacting customers and, in some cases, advising them to shut their NetScaler appliances down entirely (BleepingComputer).

Both flaws allow unauthenticated attackers to gain remote code execution on vulnerable appliances. The urgency is not theoretical: CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to secure vulnerable Citrix appliances by September 30 under Binding Operational Directive (BOD) 26-04 (CISA KEV Catalog).

The two vulnerabilities and why default configurations matter

The critical detail for any security & compliance analyst reviewing their estate is that one of the two flaws requires no special configuration at all:

• CVE-2026-88771 — an unauthenticated remote code execution flaw that, per Citrix's advisory as reported by BleepingComputer, affects all NetScaler ADC and NetScaler Gateway deployments with default configurations.
• CVE-2026-88772 — a memory overflow vulnerability that can lead to remote code execution or denial of service when DTLS is enabled. Citrix noted that DTLS is toggled on by default on VPN virtual servers, so many deployments are exposed without operators ever having made a deliberate DTLS decision.

Before any CVE IDs existed, the Dutch National Cyber Security Center (NCSC-NL) reportedly warned organizations in the Netherlands about two critical NetScaler zero-days that allowed threat actors to place shellcode directly into memory (BleepingComputer). Cybersecurity firm watchTowr later said it had verified reports that two NetScaler RCE zero-days were being exploited while Citrix prepared patches, and some researchers have informally dubbed the vulnerabilities "PitScaler."

In its blog post confirming exploitation, Citrix warned that the vulnerabilities "vary by deployment configuration and enabled features, and include issues that could allow remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions."

Attack telemetry: what GreyNoise and Mandiant observed

GreyNoise observed a threat actor attempting to exploit a Citrix NetScaler Gateway on September 24 — three days before Citrix publicly disclosed the CVEs, with the attack originating from IP address 149.104.78.141, which GreyNoise's platform detected before CVE detections were available. According to GreyNoise, the attacker attempted to modify /bin/sh to obtain a root shell and install a password-protected PHP web shell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver. The attacker also modified /etc/httpd.conf so that requests for apparently ordinary CSS files, including receiver.min.css, would instead open the hidden PHP web shell. GreyNoise recommends hunting for the .ctxs.receiver file, related Alias or AliasMatch entries in httpd.conf, changes to the permissions of /bin/sh, and connections from the observed source IP (BleepingComputer).

Mandiant's reporting confirms overlapping patterns and adds mechanism. Mandiant says the exploits bypass authentication and cause the NetScaler Packet Processing Engine (NSPPE) to terminate unexpectedly, granting attackers root-level access. As Google Threat Intelligence Group (GTIG) explained in the report: "While Google Threat Intelligence Group does not possess exploit code, analysis of frontline telemetry suggests that transmitting specially malformed or fragmented record headers induces heap memory boundary corruption within the packet engine, diverting control flow to execute arbitrary shellcode with root-level operating system privileges on the underlying FreeBSD platform."

Mandiant says the attacks began in at least early September and are believed to have impacted organizations in North America and Europe across the government, financial services, education, legal, and professional services sectors. Note that neither Mandiant/GTIG nor GreyNoise has published an attribution of this activity to a named threat actor, and the reporting does not disclose one, treat any identity claim circulating elsewhere as unverified.

Post-exploitation tradecraft: disguising web shells in plain sight

Google and Mandiant observed consistent post-exploitation activity designed to hide in ordinary HTTP traffic:

• Attackers installed PHP web shells and modified the NetScaler web server configuration so non-executable file extensions would be processed as PHP. In one intrusion, /etc/httpd.conf was changed so .deb files executed as PHP, letting web shells live in directories normally holding NetScaler client software.
• In other attacks, threat actors used .sig files and mapped requests for .ico images under /vpn/media/ to malicious PHP files, so web shell requests appeared to be image or CSS requests while executing commands via the PHP shell_exec() or eval() functions.
• Some web shells returned fake HTTP 404 responses when executing commands, further disguising malicious activity.
• To keep root access after the initial exploit, the threat actor used lightweight installer web shells to set the setuid bit on /bin/sh, per Mandiant, so commands from the lower-privileged web server context would run elevated. Attackers also rebooted appliances or restarted the web server to apply configuration changes.

WHIPSHOT and SLAPSHOT: two new malware families

Mandiant says the threat actors deployed two previously undocumented malware families:

• WHIPSHOT, a PHP web shell disguised as a Debian package and stored in the NetScaler VPN scripts directory. It acts as an HTTP proxy for SLAPSHOT, extracting Base64-encoded data from HTTP request headers and forwarding it to the tunneling malware, checking whether SLAPSHOT is running, and able to extract and launch embedded Python payloads in the background.
• SLAPSHOT, a Python-based TCP tunneling tool that bridges the compromised NetScaler appliance and internal devices, letting attackers pivot further into the network. It accepts commands from WHIPSHOT, opens connections to internal hosts, sends and receives data, and closes sessions when finished. Google says attackers used the proxy in at least one intrusion to manually conduct reconnaissance and steal credentials, and the malware can terminate itself after periods of inactivity to evade detection.

Exposure, deadlines, and compromise-assessment mandates

Shadowserver tracks over 23,000 IP addresses with NetScaler fingerprints exposed on the internet, nearly 22,000 NetScaler ADC appliances and just over 1,500 Gateway instances, though there is no public information on how many are honeypots, already patched, or in vulnerable configurations (BleepingComputer).

CERT-EU, the cybersecurity service for EU institutions, bodies, offices, and agencies, "strongly" advised EU organizations to run a compromise assessment on any internet-facing appliance running an affected build. CISA echoed the forensics-first posture: "If possible, users are encouraged to check for indication of compromise prior to patching... Should your organization suspect compromise, it is important to preserve forensic evidence prior to applying updates, as updates may result in loss of forensic visibility."

Citrix has shared what it calls "generic Indicators of Compromise" through NetScaler Console, but explicitly warned that these IoCs "might be of limited forensic value and might fail to identify actual compromises," advising customers to retain experienced forensic investigators.

Patch the right versions, and plan EOL migrations

Citrix's fixed NetScaler ADC and NetScaler Gateway releases are:

• NetScaler ADC and Citrix NetScaler Gateway 14.1-73.37 and later
• NetScaler ADC and Citrix NetScaler Gateway 13.1-64.23 and later releases of 13.1
• NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP

Versions 12.1 and 13.0 have reached end of life and no longer receive security updates; Citrix advised customers running them to migrate to a supported release.

What a security & compliance analyst should do this week

Drawing on the guidance published by Citrix, CISA, CERT-EU, GreyNoise, and Mandiant in the cited coverage:

1. Inventory against defaults. Confirm which appliances are on vulnerable builds and which have DTLS enabled (remembering it is on by default for VPN virtual servers).
2. Preserve forensics before patching where possible. Capture logs, process listings, and filesystem state from internet-facing appliances before applying updates, per CISA's warning that updates can destroy forensic visibility.
3. Hunt the documented artifacts. Look for .ctxs.receiver under the LogonPoint custom directory; Alias/AliasMatch entries and PHP handlers in /etc/httpd.conf; suspicious .deb or .sig files containing PHP code; setuid changes to /bin/sh; and traffic to or from 149.104.78.141.
4. Treat Citrix's generic IoCs as a floor, not a ceiling, and consider engaging forensic specialists for any positive hit.
5. Check lateral movement, not just the edge: SLAPSHOT exists precisely to bridge the appliance into internal networks, so credential theft and internal reconnaissance should be assumed in any confirmed compromise.
6. Paper the response for compliance. For federal and regulated entities, document KEV/BOD 26-04 timelines, compromise-assessment evidence, and EOL migration plans for 12.1/13.0 appliances.

A recurring pattern for edge devices

These two flaws are part of a steady drumbeat of exploited Citrix vulnerabilities. In March, Citrix urged admins to patch CVE-2026-3055 and CVE-2026-4368 days before attackers began abusing them; in early September, attackers began exploiting a NetScaler authentication bypass, CVE-2026-19490, that had been patched in mid-August. Since November 2021, CISA has flagged 26 actively exploited Citrix vulnerabilities, including six abused by ransomware gangs. NetScaler appliances remain attractive precisely because they face the internet at the edge of internal networks without the EDR coverage typical of servers behind them, a structural exposure that any cloud security incident response posture has to treat as permanent, not exceptional.

Key takeaways

• CVE-2026-88771 hits default configurations of all NetScaler ADC and Gateway deployments; CVE-2026-88772 hits DTLS, which is on by default for VPN virtual servers.
• Exploitation predates disclosure: GreyNoise saw attacks on September 24, and Mandiant says activity began no later than early September.
• Post-exploitation activity features PHP web shells hidden behind CSS, image, and Debian-package filenames, plus the new WHIPSHOT and SLAPSHOT malware for tunneling into internal networks.
• Patch to the fixed builds, run compromise assessments before patching where feasible, and migrate EOL 12.1/13.0 appliances now, no verified attribution to a named threat actor exists, so response should be driven by artifacts, not actor names.