Citrix NetScaler zero-days: detect, patch and shield your servers

Two critical zero-days in Citrix NetScaler, exploited in the wildIf your organisation exposes Citrix NetScaler ADC or NetScaler Gateway to the interne...

Two critical zero-days in Citrix NetScaler, exploited in the wild

If your organisation exposes Citrix NetScaler ADC or NetScaler Gateway to the internet, this is one of those weeks where patching is not a routine task but an urgent one. Two zero-day vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being actively exploited to achieve unauthenticated remote code execution (RCE) on internet-facing appliances. Both carry a critical severity rating, with CVSS v4.0 scores around 9.5, and they are already part of real intrusion campaigns, not just proof-of-concept research.

The first flaw, CVE-2026-88771, stems from improper input validation and affects NetScaler ADC and Gateway deployments with default configurations. The second, CVE-2026-88772, is a memory overflow that can lead to RCE or denial of service, and it requires DTLS to be enabled. That detail matters: DTLS is often enabled by default on VPN vServers, so the practical attack surface may be wider than many administrators assume.

What attackers are doing after the initial breach

The post-exploitation phase is where things get uncomfortable. Investigators have observed password-protected PHP web shells being dropped on compromised appliances, along with deliberate attempts to hide them. In some cases, attackers modify the web server configuration so that files with supposedly harmless extensions, such as CSS or even images, are processed as PHP. This makes manual hunting much harder and allows malicious payloads to blend in with legitimate resources.

Persistence techniques are also notable. There have been attempts to elevate privileges by setting the setuid bit on /bin/sh, so commands launched from the web shell run with root permissions. If your team detects unusual permissions on that binary, treat it as a strong indicator of compromise rather than a system quirk.

Other artefacts linked to these intrusions include the file /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, suspicious Alias or AliasMatch entries in httpd.conf, and unusual handlers forcing PHP execution where it should not happen. Later stages involve known tooling such as WHIPSHOT, a disguised PHP web shell, and SLAPSHOT, a Python TCP tunnelling tool designed to open paths to internal hosts and facilitate lateral movement. Signs of this include Python processes launched with nohup and files such as /tmp/.uxdport or /tmp/.uxdlock.

Patch now, but check for compromise first

Citrix has released updates to break the attack chain. Affected products include Citrix NetScaler ADC 13.1 before 13.1-64.23, Citrix NetScaler ADC 14.1 before 14.1-73.37, and their NetScaler Gateway equivalents, plus FIPS and NDcPP builds. The practical recommendation is to apply 14.1-73.37 or later, or 13.1-64.23 or later, using the branch that fits your environment.

However, patching blindly can be costly from a forensic perspective. On exposed appliances, the priority should combine two steps: assess whether the system is already compromised before updating, so you do not lose useful traces, and then deploy the patch. If there is reasonable suspicion, preserve evidence and logs before touching the system, and bring in forensic support when the scope is unclear.

Adding pressure, CISA has added both flaws to its Known Exploited Vulnerabilities (KEV) catalogue and set 30 September 2026 as the deadline for US federal agencies to mitigate or patch. That decision often sets the pace for the wider industry, because many security teams outside the US use the KEV as a real-world exploitation thermometer.

The end-of-life problem and partial mitigations

There is also a structural issue. NetScaler versions 12.1 and 13.0 are already end-of-life and no longer receive security fixes, so waiting for a patch is not an option. The way out is to migrate to supported branches.

For those who cannot patch immediately, a partial mitigation exists: disable DTLS where feasible and block incoming UDP to port 443 if DTLS is not used. This measure does not cover CVE-2026-88771, so it is not a substitute for updating. In parallel, review concrete indicators: look for web shells, audit httpd.conf, check permissions on /bin/sh, and monitor for tunnelling signals from the appliance.

In 2026, remote access appliances remain a direct motorway into the internal network, and this campaign is a fast reminder of that reality. For system administrators, hosting companies and SMEs with their own servers in Barcelona, Lleida, Tarragona or Girona, the lesson is clear: exposure management and rapid response are not optional.

Centralised protection with Abuse Shield

Beyond emergency patching, reducing the attack surface is essential. At ALMC we offer Abuse Shield, a service that centralises server protection: automatic blocking of malicious IPs, managed fail2ban across multiple machines, and a shared reputation feed between all your servers. This means that when one of your servers detects an attack, the others learn from it and block the same source automatically. For hosting providers and SMEs managing several servers, this coordinated defence saves time and strengthens security without adding complexity.

Combined with timely patching and forensic readiness, Abuse Shield helps you keep your infrastructure resilient against campaigns like the one targeting Citrix NetScaler. If you need advice on how to implement it in your environment, our team in Lleida can help you assess your current exposure and design a tailored protection strategy.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.