Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772

What it is

Rapid7's writeup of CVE-2026-88771, an unauthenticated command-injection RCE in Citrix NetScaler ADC/Gateway, with the specific exploitation mechanics observed by Rapid7 MDR in the wild.

How it works

The exploit abuses the WFR (Witness Failure Recovery) authentication path. The injected payload is executed as part of a failed-login event:

tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig

This creates a gzipped archive named c inside /var/netscaler/gui/vpn/, containing the entire /flash/nsconfig directory. Because NetScaler Gateway publicly serves that directory at https://<gateway>/vpn/, the attacker then simply fetches the archive unauthenticated:

GET https://<gateway>/vpn/c

No login is needed for either step — the injection rides in through a bad-login audit log entry, and the exfiltration rides out through a public static-file path.

flowchart LR
    A[Unauthenticated login attempt] --> B[Command injection via WFR/nsppe field]
    B --> C[tar archives /flash/nsconfig into /var/netscaler/gui/vpn/c]
    C --> D[Public /vpn/ path serves archive]
    D --> E[Attacker GETs /vpn/c unauthenticated]
    E --> F[ns.conf creds, SSL keys, SSH host keys exposed]

Preconditions / Affected

CVE-2026-88771 works against vulnerable NetScaler appliances in their default configuration — no extra features need to be enabled, and attack complexity is rated low by the vendor, meaning reliable exploitation is likely across all unpatched appliances. (This differs from the companion CVE-2026-88772, which requires DTLS to be enabled and has high attack complexity.)

What to do

• Rapid7 observed the earliest exploitation attempt at 2026-09-20T14:28:43 UTC, from source IP 149.104.78.208, roughly a week before Citrix's public disclosure on September 27.
• Check for the archive artifact /var/netscaler/gui/vpn/c and for unexpected content under /flash/nsconfig.
• Check for a webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver (SHA256: ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1), which Rapid7 found on one compromised appliance on September 24.
• Because /flash/nsconfig contains ns.conf (nsroot and admin account credentials, LDAP/RADIUS/TACACS bind passwords), SSL private keys, and SSH host keys, treat any appliance with evidence of this exploitation as fully compromised — rotate all of these secrets, not just patch the CVE.
• Rapid7 has confirmed two organizations compromised via this exact technique as of publication.

Caveats

Rapid7 states only two exploitation attempts were seen on September 20, which it explicitly notes "does not indicate widespread exploitation at that time" — the full scale of in-the-wild abuse before the September 27 disclosure is not established by the page.