NetScaler Zero-Days Exploited for Weeks Before Citrix Patch

Weeks of silent access, then a weekend scramble

Citrix's latest NetScaler emergency did not begin with its security bulletin. It began weeks earlier, inside the edge appliances that thousands of organizations use for VPN access, load balancing and authentication. On September 27, Citrix published bulletin CTX697096. The bulletin fixed eight flaws in NetScaler ADC and NetScaler Gateway and confirmed that two of them, CVE-2026-88771 and CVE-2026-88772, had already been exploited against unmitigated deployments.319 The bulletin was Citrix's first public notice of either flaw. That means attackers had them before any fix existed, and the advisory listed no workaround and no indicators of compromise.514

The sequence matters because the disclosure was not orderly. On September 26, watchTowr said publicly that credible reports described several unpatched NetScaler remote code execution flaws being exploited, and that they had been found during forensic investigations.5 Dutch authorities had already passed on a warning from a European partner CERT that exploitation was under way at multiple Citrix customers worldwide. Some administrators took their appliances offline, while others said they had received no official notice at all.7 Across Europe, governments and companies shut down or disconnected NetScalers while they waited for a patch.10 When the CVE numbers were finally assigned, some researchers had already started calling the pair "PitScaler."8

What the two flaws do

The reporting is consistent on the technical basics. CVE-2026-88771 is an improper input validation bug, scored 9.5 under CVSS 4.0. It lets an unauthenticated attacker run arbitrary commands, and it affects every NetScaler ADC and Gateway deployment, including the default configuration.316 NVD scores it 9.8 under CVSS 3.1.15 CVE-2026-88772 is a memory overflow, also scored 9.5. It can lead to code execution or denial of service when DTLS is enabled, and DTLS is on by default for VPN virtual servers.312

Researchers traced CVE-2026-88771 to a Perl script that handles crash and error data. That script builds a shell command from log content, and attackers can influence that content.28 The attack works in stages. An attacker first plants an encoded payload in the access log through a crafted User-Agent string. They then send a forged "pitboss" packet-engine failure message through a login field. When a scheduled maintenance job reads the poisoned record, it runs the attacker's command as root.3135 watchTowr pointed out a quirk: the triggering job may not run for up to 24 hours, so attackers cannot control exactly when their exploit fires.18

How long attackers had it

The headline phrase "exploited for weeks" holds up, although the start date depends on which telemetry you trust. Unit 42 saw version fingerprinting from August 21 and webshell-delivery requests from September 4.1031 ExtraHop, citing Unit 42, puts exploitation as early as August 27.26 eSentire's incident responders saw CVE-2026-88771 exploited on internet-facing gateways on September 5. Google's Threat Intelligence Group and Mandiant say CVE-2026-88772 had been in use since at least early September.10 Australia's ACSC told organizations to review for compromise going back to at least September 4.10 GreyNoise recorded an attempt on September 24, and some secondary timelines have treated that as the start of CVE-2026-88771 activity.821 The incident-response evidence from earlier in the month makes that later date look too conservative.

There is also a hint about Citrix's own timeline. watchTowr's CEO noted that the patch his team analyzed was dated September 24. That suggests the vendor knew about the activity for several days before the public bulletin.24 Citrix reportedly found the flaws while investigating incidents in customer environments.3

From espionage to spray-and-pray

The campaign has gone through two clearly different phases. In the first, Mandiant and GTIG documented two previously unseen tools. WHIPSHOT is a PHP webshell that hides Base64-encoded commands in HTTP headers. SLAPSHOT is a Python tunneler that proxies traffic into internal networks for reconnaissance and credential theft.222527 The victims identified so far are in North America and Europe, in government, financial services, education, and legal and professional services.1027 Mandiant CTO Charles Carmakal said dozens of organizations had been hit, including by suspected state-sponsored actors. Researcher Kevin Beaumont said he knew of more than 100 victims and described the activity as espionage.27 Beaumont also reported that each compromised appliance received its own unique webshell, which makes hash-based scanning almost useless.1734 No public reporting has tied the activity to a named group.13

The second phase began on September 29. watchTowr published a root-cause analysis and proof-of-concept for CVE-2026-88771, and deception-network operator Lupovis recorded exploitation attempts within minutes.2434 eSentire tracked at least four separate clusters of activity, including one that used the public proof-of-concept against four customers on the day it came out.36 LevelBlue documented payloads that created a superuser account, set the system shell to run with root privileges, and uploaded configuration archives to attacker servers.36 Zscaler saw a burst of attempts from at least 26 IP addresses within a few minutes. It also found download infrastructure shared with exploitation of an unrelated Adobe Commerce flaw, which points to opportunistic, multi-platform operators.35

The ransomware question

No confirmed ransomware deployment has yet been tied to this campaign, and that should be said plainly. CISA's catalog lists known ransomware use for CVE-2026-88771 as "Unknown." The risk, though, is obvious. Beazley Security said it expects financially motivated actors, including ransomware operators, to weaponize the flaws, as they did with earlier NetScaler bugs. Carmakal predicted broad, opportunistic exploitation by a range of actors.27

The post-exploitation activity already documented is what a ransomware affiliate or access broker would want. Rapid7's October investigation found reconnaissance of LDAP and Active Directory, DNS and VMware vCenter systems. It also found configuration and key material staged for theft, and persistence designed to survive failover between high-availability appliance pairs.3032 Beaumont reported attackers using built-in tools on the appliance to pull Active Directory credentials through the LDAP bind account.29 In practice, any organization that ran an exposed, unpatched NetScaler in September should assume that credentials taken then could be used for extortion months later.

A patch cycle that kept moving

Remediation has been a moving target. On October 3, attackers began exploiting a third flaw, CVE-2026-88779, a SAML memory overflow, against appliances that had already received the September fixes. Patched boxes started rebooting unexpectedly.16 Citrix rated it as denial of service, and watchTowr's reproduction agreed. But watchTowr suspected attackers were crashing devices on purpose so that code planted through CVE-2026-88771 would run sooner. CISA raised the same possibility.1 Rapid7 has since confirmed real intrusions that chained the two bugs this way.30 A further SAML flaw, CVE-2026-107406, followed on October 8. Citrix says it is not aware of exploitation.10 The safe target is now 14.1-73.46, 13.1-64.29, or the matching FIPS builds.19

The reporting still disagrees on a few points. Mandiant tied much of the early activity to CVE-2026-88772, while Citrix says both flaws were exploited.8 Beaumont's claim that CVE-2026-88773 was chained with the other two has not been independently confirmed.10 Exposure estimates also vary widely. Palo Alto's Cortex Xpanse counted more than 50,000 potentially vulnerable instances at disclosure.25 Shadowserver's version checks found 1,795 vulnerable IPs at the September 30 peak, falling to 1,171 by October 11. The two numbers probably measure different things, but either way more than a thousand appliances were still exposed two weeks after the fix.

Why it matters

The most important lesson is that patching does not remove an intruder. Updates replace the vulnerable code but leave webshells and modified Apache configurations in place, and they do nothing about credentials that have already been stolen.1724 CISA advised checking for compromise and preserving evidence before patching.17 Because NetScaler appliances run no EDR agent, investigators have to rely on appliance logs and network telemetry. Attackers in this campaign deleted local artifacts, so logs forwarded off the box are often the only reliable record.17

The larger pattern is hard to miss. NetScaler had six CVEs added to CISA's exploited-vulnerabilities catalog in 2026 as of October 8, compared with three in all of 2025. The appliances sit at the network perimeter, and a successful exploit gives root access. That makes them a recurring entry point for both espionage teams and the criminals who follow them. The September bulletin did not end this episode. For many defenders it marked the start of a forensic investigation reaching back to August.