Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

What it is

Unit 42's threat brief on two NetScaler ADC and Gateway zero-days exploited from August 2026: CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow, leading to RCE or DoS). Both score CVSS v4.0 9.5. Citrix published its bulletin on 27 September 2026. The page gives no fixed version numbers, so take them from the Citrix advisory.

How it works

Pre-disclosure activity fell into two chains.

CVE-2026-88772 (DTLS to .deb web shell). Crafted DTLS traffic corrupts memory. The actor then repeatedly requested files in /vpn/scripts/linux/, a folder that normally holds Citrix client packages, and used it to host web shells (nsgclient18.deb, nsgsupport.deb, nsgpackage64.deb, nsgbuild.deb). The analysed sample, nsg64.deb, is a PHP web shell with RC4-encrypted C2. It has five commands (cmd, size, dl, up, info) and escalates through the SUID binary /var/netscaler/.ns_suidcmd.

CVE-2026-88771 (log poisoning). Seen on 21 September 2026:

1. A Base64 dropper goes in the User-Agent. The 404 response still writes it to /var/log/httpaccess-vpn.log.
2. A login request injects text after pitboss PPE missed too many heartbeatsNSPPE; in /var/log/ns.log.
3. The vulnerable /netscaler/ns_monuploadd_err.pl runs that text in a shell. It greps the staged Base64 from the access log, decodes it and pipes it to sh or php.

The payload runs chmod 6555 /bin/sh and writes the shell to /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver. The shell requires a CsrfToken cookie (e826d7ddf3c85920 in this case, likely per-intrusion) and runs the NSC_TASS cookie through passthru. It then patches /etc/httpd.conf with a <Files ".ctxs.receiver"> block and Alias/AliasMatch rules that serve the shell as /logon/LogonPoint/custom/receiver.min.css (or receiver.min.<hex>.css). It flips php_flag engine off to on, then reloads Apache with kill -HUP and no restart log entry.

Preconditions / Affected

NetScaler ADC and NetScaler Gateway. Palo Alto Cortex Xpanse counted 50,277 potentially vulnerable exposed instances on 27 September 2026. Citrix's advisory has a "Steps to determine if an appliance meets the CVE preconditions" section for confirming exposure.

What to do

• Update to the latest Citrix release. Patching does not remove persistence already in place.
• Isolate vulnerable systems, then preserve evidence: VPX snapshot, remote syslog and NetScaler Console logs, a technical support bundle and a packet engine core dump.
• Hunt for:
• Any request to /logon/LogonPoint/Authentication/GetUserName, which Unit 42 calls anomalous.
• Fingerprinting requests to /admin_ui/common/css/ns/ui.css and /vpn/js/rdx/core/lang/rdx_en.json.gz.
• Unexpected files in /vpn/scripts/linux/.
• .ctxs.receiver and receiver.min*.css aliases in /etc/httpd.conf.
• php_flag engine on in /etc/httpd.conf.
• /bin/sh with SUID/SGID bits set.
• NSPPE; followed by shell text in ns.log.
• Unexplained logging gaps and unexpected outbound connections.
• IOCs: IPs 77.83.199[.]39, 104.248.244[.]66, 193.149.176[.]207, 162.33.178[.]9, 104.28.215[.]137, 104.28.247[.]136, 45.61.136[.]143, 66.227.183[.]84 and 216.245.184[.]164. Hashes: nsg64.deb is ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec, the Base64 payload is 1bd314b661396c7086f6367fbbb48025e03ca2de69c073d53a8b0a38aa5fbb7d and the decoded script is 79c65fa04541032e251fa4796b97800374b63c7982593dd1a2e0db605d429186.
• Palo Alto NGFW Threat Prevention signature 97562 covers CVE-2026-88771. The page's Unit 42 hunting query for log poisoning is not reproduced in the fetched text.

Caveats

Unit 42 says activity after 27 September 2026 may not match these IoCs or TTPs, since other actors and scanners now use the exploits. Post-compromise activity is still under analysis. The generic hunting list is not tied to observed TTPs for these CVEs. The log-poisoning query does not show successful exploitation on patched devices. The earliest observed activity was 21 August 2026, and the last DTLS-related request arrived at 01:54 UTC on 27 September 2026.