NetScaler Zero-Days Exploited in the Wild to Deploy Persistent Web Shells

Unauthenticated threat actors have been actively exploiting two zero-day vulnerabilities in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway appliances to gain initial access and maintain persistent foot-holds in enterprise networks. The primary NetScaler zero-day vulnerability CVE-2026-88771 enables unauthenticated remote code execution (RCE) via improper input validation. Tracked alongside CVE-2026-88772—a memory overflow flaw affecting the Datagram Transport Layer Security (DTLS) service—these vulnerabilities allow attackers to bypass authentication controls and establish root-level access. Cortex Xpanse telemetry identified 50,277 internet-exposed NetScaler instances potentially vulnerable to these flaws as Citrix issued advisory CTX697096 on September 27, 2026.

Pre-Disclosure Reconnaissance and Campaign Timeline

Threat actor activity targeting NetScaler devices began over a month prior to public disclosure. Initial target fingerprinting was detected on August 21, 2026, when host 104.248.244[.]66 requested /admin_ui/common/css/ns/ui.css from a U.S.-based organization’s NetScaler Gateway. Two hours later, a second host at 77.83.199[.]39 issued identical requests before probing /vpn/js/rdx/core/lang/rdx_en.json.gz to confirm software builds. Across August 21 and 22, these hosts—joined by 78.47.24[.]217—scanned over 100 enterprise environments.

Exploitation intensified between September 4 and September 24. Adversaries rotated infrastructure across daily DigitalOcean VPS instances (66.135.19[.]18, 167.99.111[.]203, 142.93.85[.]227, 104.248.74[.]206), Cloudflare WARP VPN IPs (104.28.247[.]136, 104.28.215[.]136, 104.28.215[.]137), and host 193.149.176[.]207. Throughout this period, actors repeatedly retrieved and altered .deb software packages within /vpn/scripts/linux/, a directory reserved for legitimate Citrix client installation files. From September 10 through September 27, traffic logs showed a continuous stream of automated requests to /logon/LogonPoint/Authentication/GetUserName, terminating just hours before public patches were released.

Anatomy of NetScaler Zero-Day Vulnerability CVE-2026-88771

The RCE vulnerability in CVE-2026-88771 stems from improper input validation (CWE-20) in command processing components. Adversaries operationalized this vulnerability using a distinct three-stage command injection chain:

1. Log Staging: The attacker issues an HTTP request containing a Base64-encoded command payload inside the User-Agent HTTP header. While the server returns a 404 response, the full string is logged to /var/log/httpaccess-vpn.log.
2. Trigger Injection: The attacker submits a crafted authentication attempt that generates a failure message in /var/log/ns.log formatted as pitboss PPE missed too many heartbeatsNSPPE;<additional text>.
3. Log Processing Execution: The vulnerable system Perl script at /netscaler/ns_monuploadd_err.pl -WR parses /var/log/ns.log. When processing the injected text, it executes a grep command that extracts the Base64 payload from /var/log/httpaccess-vpn.log, decodes it, and pipes the output directly into /bin/sh or php.

To cement persistent administrative access, the executed payload runs chmod 6555 /bin/sh, setting SUID and SGID permissions so any subsequent execution of /bin/sh inherits full root authority. The attacker then writes a PHP web shell to /var/netscaler/logon/LogonPoint/custom/, a web-accessible directory intended for UI customization that typically bypasses standard monitoring. Access to this shell requires the client to supply a specific HTTP cookie (CsrfToken=e826d7ddf3c85920).

DTLS Memory Overflow (CVE-2026-88772) and Custom Web Shells

Simultaneously, attackers exploited CVE-2026-88772 by sending malformed packets to the DTLS service on NetScaler ADC and Gateway devices. Processing these crafted packets triggers memory corruption or service crashes, granting remote execution rights.

Analysis of recovered web shells deployed via this vector—such as nsg64.deb (SHA256: ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec)—reveals sophisticated operational features:

• C2 Encryption: Command and control traffic is encrypted with RC4 using key 7489a0f93c67fa5cdaeb4b921d90594d (the MD5 hash of Rhfajaf1H992).
• Privilege Escalation: Operates via the SUID binary located at /var/netscaler/.ns_suidcmd.
• Command Set: Includes built-in handlers for shell execution (cmd), file size inspection (size using wc -c), chunked file exfiltration (dl capped at 1 MB per request), file writing (up), and environment reporting (info).

Risk Assessment and Practical Impact

NetScaler appliances act as primary edge gateways for enterprise networks, managing authentication, SSL termination, and remote access. A compromised NetScaler system gives an unauthenticated attacker elevated access past the perimeter, making these devices high-value targets.

CVE-2026-88771 carries a CVSS v3.1 base score of 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This reflects zero privilege requirements, low attack complexity, and network accessibility. While the FIRST EPSS probability score sits at 1.1% (63.3rd percentile) due to pre-disclosure baseline models, real-world activity confirms full weaponization in the wild.

The vulnerabilities affect NetScaler ADC and NetScaler Gateway versions:

• 13.1 prior to 13.1-64.23 and 13.1.37.279
• 14.1 prior to 14.1-73.37

Technical Remediation and Threat Hunting

Organizations operating affected NetScaler instances must immediately apply patches provided in Citrix advisory CTX697096, updating NetScaler ADC and Gateway systems to build 13.1-64.23, 13.1.37.279, 14.1-73.37, or later.

Incident response and hunting teams should execute the following host and network verification checks:

1. Permission Audits: Inspect /bin/sh file permissions for unexpected SUID/SGID bits (chmod 6555).
2. Web Directory Inspection: Examine /var/netscaler/logon/LogonPoint/custom/ for unauthorized PHP scripts, specifically checking for references to CsrfToken value e826d7ddf3c85920.
3. Package Directory Audits: Audit /vpn/scripts/linux/ for unexpected or recently modified .deb files, such as nsg64.deb, nsgbuild.deb, nsgclient18.deb, or nsgser18.deb.
4. Log Analysis: Search /var/log/httpaccess-vpn.log for anomalous Base64 strings in User-Agent headers and check /var/log/ns.log for pitboss PPE missed too many heartbeatsNSPPE entries. Monitor network logs for sustained request volume to /logon/LogonPoint/Authentication/GetUserName.