Attackers are still breaking into internet-facing Citrix NetScaler appliances with a zero-day that Citrix disclosed nearly four weeks ago. New reporting from October 23 shows the activity has moved well past a proof of concept. Intruders are planting web shells and a FreeBSD implant, and in one confirmed case they gained root, built a tunnel into the internal network and went looking for directory and virtualization servers. If your company runs NetScaler as a VPN or gateway, CVE-2026-88771 is still a live problem.
Citrix disclosed CVE-2026-88771 and a companion flaw, CVE-2026-88772, on September 27, 2026, in a bulletin covering eight NetScaler ADC and Gateway vulnerabilities. The company confirmed both critical flaws were already exploited in the wild. The Cybersecurity and Infrastructure Security Agency added both to its Known Exploited Vulnerabilities catalog the same day, which requires federal civilian agencies to patch. Rapid7's zero-day analysis lays out the timeline from there.
What CVE-2026-88771 lets an attacker do
CVE-2026-88771 is an unauthenticated command-injection flaw, so an attacker can run commands on the appliance without logging in. It affects default configurations and needs no optional feature, according to GBHackers and Rapid7. CVE-2026-88772 is a memory overflow that requires DTLS, which Bitsight says is enabled by default for VPN virtual servers.
Citrix and the National Vulnerability Database both score the pair at 9.5 under CVSS v4.0. A separate analysis from Sn1per cites NVD's CVSS 3.1 score of 9.8 for CVE-2026-88771, so the number you see depends on which version your tools use. Bitsight assigns both flaws an internal exploit-likelihood score of 10.0 out of 10. The disagreement changes little about urgency, since both versions rank the flaws as critical, but it can cause confusion in scanner reports and ticket queues.
Edge exposure is what makes this dangerous. NetScaler sits where many networks meet the internet, handling remote access and application traffic. A pre-authentication flaw there gives an attacker a strong foothold, and the device already sits on the path to internal systems.
Which NetScaler builds are fixed
Citrix's fixed releases for CVE-2026-88771 are:
- 14.1-73.37 and later
- 13.1-64.23 and later
- FIPS builds: 14.1-73.37 FIPS and later, and 13.1.37.279
Any appliance on an earlier build is exposed. Check the build string on every node, including secondary and high-availability units, because a node you forget can stay vulnerable after the primary is fixed.
Some administrators reportedly took appliances offline after researchers warned of unpatched exploitation, before Citrix's bulletin, according to Sn1per. Taking a device offline stops new traffic, but it does not tell you whether an attacker already got in. That is why the patch is the first step, not the last.
How attackers get in and what they plant
Zscaler ThreatLabz reports that attackers poison appliance logs to trigger command execution, plant web shells and attempt to deploy a Rust-based FreeBSD x64 implant. Zscaler's writeup describes that chain in detail. A compiled implant is a step beyond a web shell, and it can outlast a simple script removal.
Rapid7 investigated a confirmed compromise in early October of a NetScaler ADC running an affected 14.1 build. The attacker gained root, set up persistence, installed PHP web shells, and built command-and-control and internal tunneling. The intruder then scouted Active Directory, LDAP and VMware vCenter, and exfiltrated configuration and key material. Rapid7's intrusion analysis shows how far the attacker's reach extended past the appliance itself.
Rapid7 first logged exploitation attempts on September 20, 2026, at 14:28:43 UTC, and said it had identified two compromised organizations at the time of writing. Separately, Unit 42 reportedly tracked a DTLS exploitation campaign from September 4 to 24 that dropped web shells from infrastructure that changed daily, according to Hard2bit's analysis. Rapid7 says its case overlaps with public reporting on a campaign tracked as WHIPSHOT/SLAPSHOT, though attribution is still open.
Rapid7's intrusion report carries a title that names CVE-2026-88779, a number USA 24 could not match to Citrix's bulletin. Treat that number as unconfirmed until Citrix or Rapid7 clarifies it.
Why patching may not end a breach
This is the part administrators often miss. Hard2bit's analysis says an attacker can set the setuid bit on the shell and scrub logs, so a patched appliance can still hold a backdoor. The same analysis warns that an appliance upgraded while keeping the same keys remains exposed. Patching closes the door the attacker used, but it does not remove a shell that is already planted or make stolen keys safe again.
The pattern is familiar. USA 24 has covered an Arista VeloCloud Orchestrator zero-day under active attack and Fortinet's urgent FortiOS patches that shipped before the flaws were named. In each case the device is trusted, the attacker is outside, and the gap between disclosure and exploitation determines how much damage follows. Patch timing matters, but so does what you check after you patch.
How to tell if your NetScaler is compromised
Work through these steps in order on every internet-facing NetScaler:
- Confirm the build. Compare each appliance against Citrix's fixed releases and patch to 14.1-73.37 or later, or 13.1-64.23 or later. Use the FIPS builds where your environment requires them.
- Hunt for compromise, not just patch status. Look for web shells, unexpected PHP or Perl CGI files, and setuid changes on system shells. The Hard2bit analysis and the Sn1per detection guide both point to these checks.
- Assume a breach if you find any of those, or if the appliance was exposed while unpatched. Rotate credentials, TLS keys, and any keys stored in the configuration directory, because an archive of those files may have been taken.
- Check your DNS and proxy logs for pylrk.cc, a command-and-control domain reported in a third-party write-up at PitScaler. Citrix has not published that domain, so verify it internally before you block it.
What to watch next
Attribution is still open, and the count of affected organizations is not final. Published indicators reflect activity up to about September 30, and Rapid7 and Unit 42 are still updating their reports. Researchers also say the persistence methods described so far may not be the only ones. A clean scan today does not prove a clean appliance next month.
Two more threads need attention. Reporting describes a second flaw, CVE-2026-107406, that affects SAML service-provider configurations, but USA 24 has not verified its details. Sources also differ on which CVSS version to cite, which matters for teams whose prioritization tools rely on NVD's v3.1 score.
Watch for updates to Citrix's bulletin, changes to the CISA catalog entries, and the next revisions from Rapid7 and Unit 42. If the SAML flaw is confirmed, the campaign could reach well beyond the DTLS and command-injection paths described so far.
