Threat reportVulnerabilityTL-2026-2711

CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog

criticalACTIVE

CISA Adds Two Citrix NetScaler Vulnerabilities (TL-2026-2711) is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-09-27 and last reviewed 2026-10-09. It has no confirmed attribution, affects Citrix (Cloud Software Group) NetScaler ADC, references 5 CVEs (CVE-2026-88771, CVE-2026-88772, CVE-2025-5777), maps to 48 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 123 indicators of compromise.

CVSS
9.5/10Critical
CVEs
5Referenced vulnerabilities
Techniques
48MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
123Indicators of compromise

Key facts for TL-2026-2711

Threat ID
TL-2026-2711
Severity
CRITICAL
CVSS
9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, financial services, health, technology, telecoms
Target regions
Global
Detection rules
9
Indicators of compromise
123
Updates
2026-10-09 · 9 updates · revalidated 9× · latest source

Malware and tooling in CISA Adds Two Citrix NetScaler Vulnerabilities

Malware and tooling: NetScaler Console Security Advisory workflow (v14.1-73.36+)

How CISA Adds Two Citrix NetScaler Vulnerabilities works

CISA added CVE-2026-88771 (unauthenticated arbitrary command execution via improper input validation) and CVE-2026-88772 (memory-overflow RCE/DoS on DTLS-enabled VPN virtual servers) to its Known Exploited Vulnerabilities catalog on 2026-09-27, both CVSS v4.0 9.5, after Citrix confirmed active exploitation on unmitigated NetScaler ADC and Gateway appliances. This is the third round of emergency NetScaler patches since June 2026, and the fixed builds for August's CVE-2026-19490 remain vulnerable to both new flaws.

On 2026-09-26, security research firm watchTowr disclosed that it had identified two previously unknown NetScaler ADC and NetScaler Gateway remote-code-execution zero-days during forensic investigations, and several managed-service providers privately advised customers to take NetScaler appliances offline before any public advisory existed. On 2026-09-27, Citrix (Cloud Software Group) confirmed the findings, publishing security bulletin CTX697096 and stating plainly that 'exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.' CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog the same day and invoked Binding Operational Directive (BOD) 26-04, requiring Federal Civilian Executive Branch agencies to prioritize rapid remediation on publicly exposed assets.

CVE-2026-88771 (CWE-20, Improper Input Validation) is an unauthenticated, network-exploitable flaw (CVSS v4.0 9.5, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) that lets a remote, unauthenticated attacker execute arbitrary commands on the appliance. Citrix and multiple outlets emphasize that every NetScaler ADC and NetScaler Gateway deployment is affected, including default configurations with no optional feature enabled -- meaning configuration hardening cannot substitute for patching, and no workaround exists.

CVE-2026-88772 (CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer) is a memory-overflow flaw (CVSS v4.0 9.5, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reachable only when DTLS is enabled on a virtual server -- a setting on by default for VPN virtual servers on NetScaler Gateway -- and capable of producing remote code execution (described by reporting as able to 'inject shellcode directly into memory') or denial of service.

Both flaws affect NetScaler ADC and NetScaler Gateway builds before 14.1-73.37 and before 13.1-64.23, plus the FIPS/NDcPP variants before 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP. Citrix's CTX697096 bulletin patches six additional, non-exploited CVEs in the same release (CVE-2026-88773 HTTP request smuggling CVSS 9.3, CVE-2026-88774 policy-expression bypass CVSS 7.0, CVE-2026-88775/88776/88777 memory-overflow variants CVSS 8.8 each, and CVE-2026-88778 TCP ISN prediction CVSS 8.8), none of which Citrix has stated are under active exploitation. Notably, the builds that fixed August 2026's CVE-2026-19490 authentication bypass (14.1-73.32 and 13.1-63.21) remain fully vulnerable to both CVE-2026-88771 and CVE-2026-88772, meaning organizations that patched for the prior incident are still exposed.

No file hashes, IP addresses, domains, or other network indicators of compromise for this specific exploitation campaign have been publicly released by Citrix, watchTowr, or any reporting outlet as of this writing; Citrix states only that generic (non-specific) indicator checks are available through the NetScaler Console Security Advisory workflow (available from Console version 14.1-73.36 with Cloud Connect), explicitly cautioning that these checks 'cannot cover every attacker technique and may miss compromises.' No threat actor or campaign has been attributed to the exploitation.

This marks the third wave of actively exploited NetScaler zero-days disclosed in roughly three months: CTX696604 (2026-06-30) fixed six CVEs including CVE-2026-8451, a pre-authentication SAML-IdP memory overread described as 'CitrixBleed-style' because it can leak live session cookies (MITRE ATT&CK T1539, Steal Web Session Cookie), which was exploited within roughly two days of disclosure; CTX696939 (2026-08-19) fixed CVE-2026-19490 (authentication bypass, CVSS v4.0 9.3, letting an unauthenticated attacker circumvent authentication on NetScaler appliances configured as an SSL VPN/ICA Proxy/CVPN/RDP Proxy Gateway or an AAA virtual server) and CVE-2026-19489 (memory overflow, CVSS v4.0 8.8, reachable only when SIP ALG is enabled on a Large Scale NAT group), with CVE-2026-19490 added to the CISA KEV catalog on 2026-09-09; and now CTX697096 (2026-09-27) fixes CVE-2026-88771 and CVE-2026-88772. Citrix NetScaler ADC and Gateway appliances function as internet-facing VPN gateways, ICA proxies, AAA authentication servers, and application delivery controllers across enterprise and government networks, making each disclosure a high-value, broadly exposed target for opportunistic internet-scale exploitation.

Security-vendor technical breakdowns of CTX697096 (strix.ai) specify the exact configuration heuristic for CVE-2026-88772 exposure: any `add vpn vserver` or `add lb vserver` built with the DTLS service type, or a VPN vserver where the `-dtls` parameter is not explicitly set to `OFF`, is vulnerable -- and because DTLS defaults to enabled on VPN vservers, the large majority of Gateway deployments meet this condition with no explicit administrator action. Separately, Citrix's own CTX697096 remediation guidance is explicit that patching alone is insufficient for hosts exploited before the fix shipped: upgrading 'does not remove persistence or other artifacts left by attackers,' and Citrix directs defenders to review authentication and network-activity logs, hunt for unexpected files, processes, and configuration changes, monitor for unauthorized outbound connections, and deploy File Integrity Monitoring. That guidance -- consistent with watchTowr's own framing that exploitation of an internet-facing NetScaler appliance 'can create a strong foothold for lateral movement and credential theft' -- indicates attackers who exploited CVE-2026-88771/CVE-2026-88772 pre-patch are expected to have gone beyond initial command execution to drop tooling on the appliance (T1105, Ingress Tool Transfer) and establish outbound command-and-control channels (T1071, Application Layer Protocol) rather than exploiting and immediately withdrawing.

MITRE ATT&CK techniques used in TL-2026-2711

Collection

T1005 Data from Local System; T1560.001 Archive Collected Data: Archive via Utility

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Name or Location; T1036.008 Masquerading: Masquerade File Type; T1070 Indicator Removal; T1070.002 Indicator Removal: Clear Linux or Mac System Logs; T1070.003 Indicator Removal: Clear Command History; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1562.001 Impair Defenses: Disable or Modify Tools; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery

Persistence

T1053.003 Scheduled Task/Job: Cron; T1078 Valid Accounts; T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1071.004 Application Layer Protocol: DNS; T1090 Proxy; T1090.001 Proxy: Internal Proxy; T1105 Ingress Tool Transfer; T1132.001 Data Encoding: Standard Encoding; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Stealth

T1211 Exploitation for Stealth

Credential Access

T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files

Impact

T1499 Endpoint Denial of Service; T1499.004 Endpoint Denial of Service: Application or System Exploitation; T1529 System Shutdown/Reboot

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.005 Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in CISA Adds Two Citrix NetScaler Vulnerabilities

  • Citrix (Cloud Software Group) — NetScaler ADC
    Vulnerable versions: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; 14.1 FIPS before 14.1-73.37 FIPS; 13.1 FIPS and NDcPP before 13.1.37.279
    Fixed in: 14.1-73.37; 13.1-64.23; 14.1-73.37 FIPS; 13.1.37.279 FIPS and NDcPP
  • Citrix (Cloud Software Group) — NetScaler Gateway
    Vulnerable versions: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23
    Fixed in: 14.1-73.37; 13.1-64.23

Remediation for CISA Adds Two Citrix NetScaler Vulnerabilities

Patches

  • NetScaler ADC 14.1-73.37 or later
  • NetScaler ADC 13.1-64.23 or later
  • NetScaler Gateway 14.1-73.37 or later
  • NetScaler Gateway 13.1-64.23 or later
  • NetScaler ADC/Gateway 14.1-73.37 FIPS or later
  • NetScaler ADC 13.1.37.279 FIPS and NDcPP or later

Immediate actions

  • Upgrade all NetScaler ADC and NetScaler Gateway appliances to 14.1-73.37 or later, or 13.1-64.23 or later (FIPS/NDcPP builds: 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP), regardless of current build -- including instances already patched for August 2026's CVE-2026-19490, since builds 14.1-73.32 and 13.1-63.21 remain vulnerable to CVE-2026-88771 and CVE-2026-88772
  • Treat every internet-facing NetScaler ADC/Gateway appliance as potentially compromised pending forensic verification, since watchTowr identified these flaws during forensic investigation of real-world exploitation rather than as theoretical research
  • Run Citrix's NetScaler Console Security Advisory workflow (Console v14.1-73.36 or later with Cloud Connect) for generic indicator-of-compromise checks, while recognizing Citrix's own caveat that these checks cannot cover every attacker technique
  • Where immediate patching is not possible, disable DTLS on VPN virtual servers as an interim compensating control for CVE-2026-88772 (note: DTLS is enabled by default on VPN virtual servers)

Workarounds

  • Disable DTLS on VPN virtual servers to mitigate CVE-2026-88772 pending patch deployment
  • No workaround exists for CVE-2026-88771: it affects every default configuration with no optional feature to disable, so patching is the only effective mitigation

Longer-term hardening

  • Adopt continuous, rapid version tracking for NetScaler ADC/Gateway given the demonstrated pattern of actively exploited zero-days in this product line in June/July, August, and September 2026
  • Forward NetScaler logs and NetScaler Console telemetry to an external SIEM to support forensic detection independent of the appliance's own security state
  • Segment NetScaler Gateway/AAA/VPN management and administration interfaces away from unrestricted internet exposure where operationally feasible
  • Establish an emergency-patch SLA for internet-facing edge and VPN appliances given the sub-monthly cadence of exploited NetScaler CVE disclosures observed in 2026

CVEs associated with CISA Adds Two Citrix NetScaler Vulnerabilities

CVE-2026-88771, CVE-2026-88772, CVE-2025-5777, CVE-2026-88779, CVE-2026-19490

Weaknesses (CWE) in CISA Adds Two Citrix NetScaler Vulnerabilities

CWE-20, CWE-119, CWE-78, CWE-120, CWE-94

Timeline of CISA Adds Two Citrix NetScaler Vulnerabilities

Showing the 20 most recent tracked events.

  • CISA adds CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities catalog, invoking Binding Operational Directive 26-04 for Federal Civilian Executive Branch remediation.
  • Citrix (Cloud Software Group) publishes security bulletin CTX697096, confirming active exploitation of CVE-2026-88771 and CVE-2026-88772 and releasing fixed builds 14.1-73.37 and 13.1-64.23; the bulletin notes the prior CVE-2026-19490 patch builds (14.1-73.32, 13.1-63.21) remain vulnerable to both new flaws.
  • eSentire publishes its initial advisory on the ongoing exploitation, later updated on 2026-09-29 with payload-host and web-shell indicators.
  • GreyNoise sees mass reconnaissance from about 8:30 a.m. EDT escalate to mass exploitation by many independent actors around 10:30 p.m. EDT; later compromises may not share one operator. 42,735 exposed hosts counted (US 32%, Germany 13%).
  • Unit 42 publishes a threat brief on in-the-wild exploitation of CVE-2026-88771 and CVE-2026-88772.
  • watchTowr Labs publishes the CVE-2026-88771 root-cause analysis (log poisoning via ns_monuploadd_err.pl) and a working PoC; Lupovis deception sensors record live exploitation within minutes, marking a shift to opportunistic mass scanning.
  • Independent researchers, including Kevin Beaumont, report exploitation activity against NetScaler appliances 'unfolding this entire month' of September 2026, indicating a broader pre-disclosure campaign beyond the single Sept. 24 session GreyNoise captured, and assess the operator as likely nation-state-aligned (unconfirmed).
  • GreyNoise publishes 'Swarming Against Citrix 0-Day Exploitation,' documenting the pre-disclosure detection timeline and the .ctxs.receiver webshell IOCs.
  • eSentire Clusters C and D use the public PoC within a day of release; four post-exploitation clusters observed across 2026-09-28/29.
  • Sophos publishes analysis of the WHIPSHOT PHP web shell and SLAPSHOT Python tunneler, noting appliances patched weeks earlier remain backdoored.
  • watchTowr publishes the CVE-2026-88772 root-cause analysis (DTLS handshake reassembly overflow of a fixed 35,840-byte scratch buffer by ~120 crafted records, triggered pre-authentication, yielding root shellcode execution in NSPPE) and a Detection Artifact Generator.
  • Help Net Security reports mass exploitation: about 42,000 exposed hosts per Censys, under 10% patched per Kevin Beaumont, and 100+ victim organizations each with a unique webshell; CERT-EU publishes hunting guidance.
  • Mandiant Consulting and GTIG publish analysis of the exploitation, the WHIPSHOT/SLAPSHOT implants, IOCs and five YARA rules; victims span government, financial services, education, legal and professional services in North America and Europe; no actor named.
  • LevelBlue SpiderLabs publishes artifacts and hunt indicators, including main.py (Python reverse shell) and update_c08937.pl (sec_monitor superuser, web shell, /flash/nsconfig exfiltration) payload analysis.
  • Mandiant's CTO attributes the intrusions to advanced, suspected state-sponsored actors, with dozens of organizations affected; no specific actor or nation is named and wider mass exploitation is expected.
  • CISA KEV remediation due date for federal agencies for CVE-2026-88771 and CVE-2026-88772.
  • Related CVE-2026-88779 (SAML memory overflow, CVSS 8.7) disclosed with newer fixed builds 14.1-73.41 and 13.1-64.28.
  • CISA adds CVE-2026-88779 to the Known Exploited Vulnerabilities catalog.
  • eSentire releases supplementary analysis of four post-exploitation clusters, including Platypus remote management tool deployment and Python reverse shells.
  • SOCRadar publishes 'NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation'; indexed by Malpedia.

Update history for TL-2026-2711

Sources cited for CISA Adds Two Citrix NetScaler Vulnerabilities

Detection coverage for TL-2026-2711

As of 2026-10-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2711 across Splunk SPL, Microsoft KQL and Sigma, covering 123 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
123 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats