Citrix NetScaler Under Attack: CVE-2026-88771, the SAML Flaws, and PHP2Shell in One Month

NetScaler ADC and NetScaler Gateway, the Citrix appliances many organisations put in front of their VPN, virtual desktops, and internal web applications, have had a hard month. Since 27 September 2026 Citrix has published four security bulletins. Two of the flaws were exploited as zero-days for weeks before anyone outside the attackers knew about them, and a third was used to crash appliances configured for SAML single sign-on. On 27 October Citrix released builds that also fix the PHP2Shell flaws in the management interface. If you run NetScaler, the question is no longer only which build you are on, but whether someone got in before you upgraded.

Four Bulletins in One Month

The Two Zero-Days

CVE-2026-88771 is the more dangerous of the two. Citrix describes it as improper input validation that lets an unauthenticated attacker run commands on the appliance, and it works on default configurations. CVE-2026-88772 is a memory overflow in DTLS handling that can lead to code execution or denial of service. It needs DTLS to be enabled, which is the default for VPN virtual servers. Both carry a CVSS 4.0 score of 9.5, and each can be exploited on its own.

The attacks started well before the bulletin. Google Threat Intelligence and Mandiant believe CVE-2026-88772 was exploited from early September, and Palo Alto Networks Unit 42 traced version fingerprinting back to late August. On the day of disclosure, Unit 42 counted more than 50,000 NetScaler instances exposed to the internet that were potentially vulnerable. CISA added both CVEs to its catalogue of exploited vulnerabilities the same day.

The way CVE-2026-88771 was exploited shows how much effort went into it. According to Unit 42, the attacker first placed a Base64-encoded payload in the User-Agent header so that it landed in a VPN access log, then sent a login request that wrote further text into the system log. A Perl script on the appliance that processes error log entries then executed the planted command. The result was a password-protected PHP web shell hidden in the Gateway login portal, with the web server configuration changed so the shell looked like an ordinary stylesheet request. Through CVE-2026-88772, attackers dropped a web shell disguised as a Linux VPN client package, along with tunnelling malware that Mandiant tracks as WHIPSHOT and SLAPSHOT.

The Other Six Flaws in the First Bulletin

Citrix has not reported exploitation of the rest, but they are serious enough to fix at the same time, and one of them needs more than an upgrade.

CVE-2026-88778 is the exception. Upgrading installs the fix, but Enhanced ISN Generation has to be switched on afterwards for it to take effect.

SAML Single Sign-On Became a Target

A week after the first bulletin, Citrix disclosed CVE-2026-88779, a memory overflow with a score of 8.7 that affects appliances configured as a SAML service provider or identity provider. Attackers used it to crash gateways, and CISA added it to the exploited list on 4 October. CISA also pointed out a nasty interaction: on an appliance where code had already been planted through CVE-2026-88771, a forced reboot could cause that code to run.

On 8 October came CVE-2026-107406, another SAML memory overflow, this time rated 9.5 because it can lead to remote code execution. There is no workaround. Builds that had already been patched for the first two bulletins remain vulnerable when the appliance acts as a SAML identity provider, so organisations that patched in early October have to patch again.

PHP2Shell Reaches the Management Interface

The NetScaler management GUI and its API are built on PHP, so the PHP2Shell flaws disclosed on 21 October, CVE-2026-109618 and CVE-2026-109619, also apply to the appliance. Citrix published bulletin CTX697263 on 22 October and released fixed builds on 27 October. The exposure is the management interface, meaning the NSIP, any SNIP with management access enabled, and the cluster IP. The Gateway and AAA login pages are not affected, and neither are NetScaler Console and SVM. Until you upgrade, restrict access to the GUI and API to a small set of administrator hosts with ACLs, as Citrix describes in CTX228148. A management interface reachable from the internet is a problem even without this CVE.

Which Build to Install

Each bulletin raised the minimum build. The builds released on 27 October are the first that address all four bulletins, so there is little reason to aim for anything older.

Check the build the appliance is actually running with show version in the CLI. The saved ns.conf can still show the old build until the configuration is saved again. Secure Private Access hybrid deployments that use customer-managed NetScaler instances are also affected. Citrix-managed cloud services are updated by Citrix.

Patching Does Not Remove an Intruder

Citrix says it plainly: an update does not clean an appliance that has already been compromised. Web shells, modified configuration, and tunnelling tools survive the upgrade. Because exploitation started weeks before the bulletin, every NetScaler that faced the internet in September should be treated as possibly compromised until checked.

1. 1Preserve evidence before you change anything. CISA notes that updates can reduce forensic visibility. Collect logs from remote syslog and NetScaler Console, a technical support bundle, and for virtual appliances a VM snapshot. The Dutch NCSC advised keeping at least a month of logs and memory.
2. 2Run the indicator of compromise scan in NetScaler Console under Security Advisory, using version 3 of the indicators released on 29 September. It needs product telemetry and does not support NetScaler BLX.
3. 3Look for the known artefacts: the file /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, unexpected .deb files under /vpn/scripts/linux/, files such as /tmp/.uxdport, /tmp/.uxdlock, or /tmp/.nsagent, and changes to httpd.conf.
4. 4Search logs forwarded to a SIEM for Base64 strings in the User-Agent field and for the string pitboss combined with IFS or b64decode, which researchers linked to the log poisoning used against CVE-2026-88771.
5. 5Upgrade to the build in the table above, enable Enhanced ISN Generation, and keep monitoring for unusual administrative sessions and outbound connections.

A clean scan is not proof. Citrix itself warns that its indicators may miss real compromises, web shells were unique to each device, and attackers deleted artefacts. Local logs on NetScaler also rotate quickly, which is why forwarding them to a SIEM matters.

If You Find Signs of Compromise

Isolate the appliance and do not rely on cleaning it in place. Citrix recommends deploying a new instance on a fixed build, and CISA recommends restoring from a known good backup taken before the compromise. Either way, rotate everything the appliance held: local account passwords, key encryption keys, and the private keys and SSL certificates installed on it. Then look beyond the appliance. NetScaler sits at the edge of the network and handles user logins, so investigate the systems it connects to and the credentials that passed through it, including LDAP and Active Directory service accounts.

What This Month Teaches

Edge appliances such as VPN gateways and load balancers are attractive because they face the internet, run privileged code, and are often patched less regularly than servers. The organisations that handled this month best had their NetScaler logs in a SIEM before the attack, kept the management interface off the internet, and had a tested way to replace an appliance quickly rather than repair it. If you need help assessing a NetScaler deployment or the systems behind it, our managed service team can take it on.