About PitScaler and its methodology

PitScaler is an independent, non-commercial technical briefing on the September 2026 Citrix NetScaler ADC and Gateway zero-day incident (CVE-2026-88771, CVE-2026-88772 and the six other CVEs in bulletin CTX697096). It is maintained by an independent security practitioner. It is not affiliated with, endorsed by or sponsored by Cloud Software Group, Citrix or NetScaler.

Quick answers

Who maintains PitScaler?

An independent security practitioner, writing as the PitScaler editorial identity. Contact and corrections: pitscaler@v1.dk.

Is PitScaler affiliated with Citrix?

No. It is not affiliated with, endorsed by or sponsored by Cloud Software Group, Citrix or NetScaler. For official guidance, use Citrix bulletin CTX697096.

What kind of source is PitScaler?

A secondary, independent compilation. It does not produce original telemetry or incident-response findings; every fact is attributed to the primary source that published it.

How are claims verified?

Each source page is read before it is cited, and quotes are checked word for word. Where a claim rests on one researcher, a press report or a community post, it is labelled as reported and not independently verified.

What counts as independently verified?

A claim marked "Validated" has been confirmed by a second, independent check, for example against the CVE record, the CISA KEV feed, a primary advisory or a first-hand observation. Claims confirmed only through non-public sources say so, and those sources are not named.

How are corrections handled?

Corrections sent to pitscaler@v1.dk are checked against the primary source and fixed in the next update. The page date changes only when the content changes.

When was this last verified?

The whole site is a snapshot as of 30 September 2026. Individual timeline entries marked "Validated" carry their own check date.

Methodology

Every statement is tied to a numbered reference. Sources are classified as:

1. Official: the vendor bulletin and government or national CERT advisories. These take precedence.
2. Research: technical analysis and first-hand incident response by named security firms.
3. Telemetry: sensor and honeypot data (for example GreyNoise, Lupovis, Defused).
4. Reported: claims by individual researchers, community posts and press. These are attributed by name and labelled as not independently verified unless corroborated.

Where a claim has been checked against a second source, it is marked Validated. Exposure counts are never presented as victim counts.

IoC policy

Only indicators that have been published openly (TLP:CLEAR or public pages without a TLP marking) are listed, each with its source, sharing marking and a caveat. Indicators received under restricted TLP are not published unless the same value later appears in a public source, which is then cited. IoCs are hunting leads, not universal indicators for every victim.

Updates and corrections

This is a dated historical snapshot, not a live feed. The as-of date and last-updated date appear at the top of every page. Send corrections to pitscaler@v1.dk.

Formats

• Interactive briefing
• Static HTML without JavaScript
• Markdown and llms.txt
• IoCs as CSV

Related pages

• PitScaler overview: Citrix NetScaler zero-days
• NetScaler zero-day timeline
• NetScaler zero-day IoCs
• NetScaler zero-day detection
• NetScaler zero-day remediation
• NetScaler zero-day FAQ
• CVE-2026-88771: unauthenticated remote code execution
• CVE-2026-88772: DTLS memory overflow leading to RCE
• CVE-2026-88773: HTTP request smuggling
• CVE-2026-88774: feature policy bypass
• CVE-2026-88775: Gateway/AAA memory overflow (DoS)
• CVE-2026-88776: Oracle load-balancer memory overflow (DoS)
• CVE-2026-88777: non-HTTP L7 memory overflow (DoS)
• CVE-2026-88778: TCP initial sequence number prediction

References