Patches Required – Citrix NetScaler vulns exploited in the wild: CVE-2026-88771 and CVE-2026-88772

The CISA, CERT-EU, and the NCSC are warning that two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5/10), are being actively exploited in the wild. Citrix released patches yesterday (September 27, 2026) for eight vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products.

• CVE-2026-88771 is an unauthenticated remote code execution vulnerability caused by improper input validation and affects all NetScaler ADC and Gateway deployments, including default configurations.
• CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial-of-service attacks when DTLS is enabled, which is the default on NetScaler Gateway deployments.

IOCs

Early reports indicate webshells observed in:

“/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver”

Weblogs containing base64 encoded commands to the following files are also likely indicators:

“/vpn/scripts/linux/nsgclient18.deb” and “/vpn/scripts/linux/nsgclient18_32.deb”

Additionally look for web requests containing the string:

“login=pitboss%20PPE%20unexpectedly%20died%20NSPPE%3Bfetch%24%7BIFS%7D-q%24%7BIFS%7D-T0%24%7BIFS%7D20%24%7BIFS%7D–no-verify-peer:24%7BIFS:7D–no-ver”

(decoded: “login=pitboss PPE unexpectedly died NSPPE;fetch${IFS}-q${IFS}-T0${IFS}20${IFS}–no-verify-peer:24{IFS:7D–no-ver”)

[Updates: 9/29 ]

Additional IOCs:
149.104.78.141 (May indicate exploitation)

143.198.7.94 (Adversary Infrastructure)

157.254.167.12 (Adversary Infrastructure)

receiver.min.css (Additional observed Webshells) [receiver\\.min\\.[0-9a-f]+\\.css]

6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7 (Weshell Sha256)

Post Exploitation:

“whoami” or “id” commands

“nx_verify.html” “Marker” Files left after seeding

“chmod u+s /bin/sh”

“system(‘/bin/httpd -k restart -f /etc/httpd.conf && chmod u+s /bin/sh’);”

WhipShot webshell Initial Access:
“nohup <python> -c ‘import base64;exec(base64.b64decode(“<payload>”))’ /tmp/.uxdport /tmp/.uxdlock > /dev/null 2>&1 </dev/null &”

Suggested Action

CyberMaxx strongly urges applying patches immediately. Please reference the Citrix disclosure: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

Also see the accompanying blog (https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/#Indicators_of_Compromise__cabcb4) for additional details.

Affected Versions and Fixed Builds