PitScaler - Citrix NetScaler Zero-Day Crisis

Overview: exploited NetScaler zero-day vulnerabilities

The eight NetScaler vulnerabilities (CVEs) in CTX697096

Citrix's bulletin lists all eight CVEs with CVSS 4.0 scores and preconditions, and NCSC-NL's advisory NCSC-2026-0394 gives the same figures. Only CVE-2026-88771 and CVE-2026-88772 are confirmed exploited. ^[6][1][5]

Timeline

Times are UTC unless marked otherwise. Events without a time show only their date. Expand an event to see its sources.

1. Sep 5 Research

   eSentire: CVE-2026-88771 exploited as early as 5 September

   eSentire TRU incident response saw exploitation of Internet-facing NetScaler Gateways from 5 Sep, more than three weeks before disclosure: base64 PHP staged in the access log via fake /vpn/media/*.ico requests, then executed through a crafted login username. In one intrusion a .deb-variant webshell was installed and operated from 5 Sep, with signs of data exfiltration and lateral movement to internal virtual desktops and back to the appliance over SSH.

   Sources: ^[32]

2. Sep 10, 07:14 UTC Official advisory Validated

   CVE IDs reserved

   NetScaler reserves CVE-2026-88771 and CVE-2026-88772 at 07:14 UTC. The records were published on 27 Sep at 16:02 and 16:09 UTC.

   Validated against the CVE record on 29 Sep.

   Sources: ^[18][37]

3. Sep 23 Reported observation

   Danish NetScalers start going offline

   Ingeniøren's review of Shodan data shows several Danish NetScaler systems switched off from 23 Sep, four days before Citrix's public disclosure.

   Sources: ^[66]

4. Sep 24, 07:32 UTC Telemetry

   GreyNoise sensors see exploitation from a single IP

   149.104.78.141: 3 sessions 07:32:19-07:32:20 UTC. IP flagged "suspicious" (Citrix ADC Gateway Login Panel Crawler), then "malicious" (Generic ${IFS} Use in RCE Attempt; CitrixBleed 2 attempt). Later retro-tagged as CVE-2026-88771. GreyNoise's retro-hunt found no other exploitation sessions before disclosure - this covers GreyNoise sensors only.

   Sources: ^[36][37][38]

5. Sep 25 Reported observation Validated

   Danish government agencies shut down their NetScalers

   Danish agencies, among them PET, the Armed Forces and the police, took their Citrix NetScaler environments offline from Friday 25 Sep, two days before Citrix disclosed the vulnerabilities. Ingeniøren later reported the shutdowns from Shodan data; none of the agencies would explain why.

   The Friday 25 Sep shutdown was validated independently on 30 Sep.

   Sources: ^[66]

6. Sep 25 Official advisory

   NCSC-NL confidentially warns Dutch organisations

   On the afternoon of Friday 25 Sep, after a tip from a European partner, NCSC-NL confidentially informed companies and organisations, including central government, about two NetScaler zero-days being exploited outside the Netherlands, before any patch existed. Dark Reading reports that a copy of the pre-notification, marked TLP:AMBER+STRICT, was briefly posted on Reddit and then deleted. According to BleepingComputer, the notice said Citrix found the vulnerabilities while investigating incidents at customers and filed a notification under the EU Cyber Resilience Act.

   Sources: ^[17][70][55]

7. Sep 26, 06:43 UTC Reported observation Validated

   r/Citrix "Netscaler leak?" thread

   User FastFredNL opens the thread at 06:43:22 UTC (08:43 CEST), reporting that an IT provider advised shutting NetScalers down immediately. It becomes the first public gathering point, with admins reporting similar unofficial advice over the weekend. Dark Reading dates the first reports to 25 Sep, but the thread itself was posted on 26 Sep.

   Post timestamp checked on the thread itself (30 Sep). The shutdown advice is consistent with the Dutch government letter to parliament.

   Sources: ^{[73][40][70][17]}

8. Sep 26, 22:19 UTC Research

   watchTowr: two unpatched RCE zero-days, found during forensics

   Two vulnerabilities - both RCE. Unpatched, 0days. Exploited in-the-wild - discovered during forensics.

   watchTowr adds that Citrix comms and patches are expected early the following week.

   Sources: ^[34]

9. Sep 26, 23:39 UTC Reported observation

   IFIN opens a public tracking thread

   IFIN starts compiling public reporting and observables for the NetScaler zero-days; it later states that all observables it shares were shared without restriction.

   Sources: ^[40]

10. Sep 26 Reported observation

    watchTowr: pull NetScaler appliances offline immediately

    Please, take this seriously and pull NetScaler appliances offline immediately.

    watchTowr publicly warns that credible rumours of unpatched NetScaler RCEs are circulating; later that day CEO Benjamin Harris says the rumours are confirmed and urges admins to pull NetScaler appliances offline immediately.

    Sources: ^[70]

11. Sep 27, 10:05 UTC Reported observation

    Dutch hospitals Amphia and ETZ close patient portals

    Patients of Amphia (Breda) and Elisabeth-TweeSteden Ziekenhuis (Tilburg) cannot log in to their portals; other Dutch hospitals report problems too. That evening Z-CERT, the Dutch healthcare CERT, says it warned the sector about critical vulnerabilities in Citrix NetScaler and advised temporarily switching the system off.

    Sources: ^[71]

12. Sep 27, 15:51 UTC Official advisory

    Public disclosure; Citrix publishes CTX697096 with fixes

    Disclosure time per GreyNoise. The bulletin covers 8 CVEs. watchTowr notes the patch it analysed was dated 24 Sep, suggesting Citrix knew of the exploitation the week before.

    Sources: ^[1][37][70]

13. Sep 27, 16:06 UTC Official advisory

    Citrix announces the bulletin on r/Citrix

    A Citrix staff account (CTX-Michael) posts a CRITICAL UPDATE in r/Citrix linking the CTX697096 bulletin and the Citrix community blog post with its IoC section, and quoting that exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments has been observed.

    Sources: ^[3][2]

14. Sep 27, 20:28 UTC Telemetry

    GreyNoise deploys CVE-specific tag

    Tag deployed 20:28:39 UTC; the 24 Sep sessions are retro-tagged as CVE-2026-88771.

    Sources: ^[37][39]

15. Sep 27, 21:30 UTC Official advisory Validated

    CISA adds CVE-2026-88771 and CVE-2026-88772 to KEV

    Both were added on 27 Sep with a federal remediation deadline of 30 Sep. The 21:30 UTC release time comes from the compiled dataset and was not found in the sources checked.

    Dates validated against the KEV catalog feed on 29 Sep.

    Sources: ^[5][12]

16. Sep 27, 23:15 UTC Telemetry

    Unit 42: 50,277 exposed instances

    Palo Alto Networks Cortex Xpanse identifies 50,277 exposed NetScaler instances that could potentially be vulnerable (update posted 4:15 p.m. PT). Exposure, not confirmed compromise.

    Sources: ^[63]

17. Sep 27 Official advisory

    Danish Defence Intelligence (FE) and CERT-EU warn NetScaler users

    The Danish Defence Intelligence Service sent a warning urging NetScaler users to update, per Ingeniøren. CERT-EU published Security Advisory 2026-014 recommending an immediate update of all customer-managed appliances and enabling Enhanced ISN Generation where TCP is configured.

    Sources: ^[66][13]

18. Sep 27 Reported observation

    Beaumont: three CVEs chained, webshells all September

    The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained. It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September. Probably nation state aligned

    Beaumont's claim; attribution not independently verified.

    Sources: ^[44]

19. Sep 27 Reported observation

    Beaumont: patches live, detection script behind NDA

    patching alone doesn't remove the backdoors being placed

    Patches are live on the main support site; Citrix's detection script is locked behind NDA/support.

    Sources: ^[45]

20. Sep 27 Reported observation Validated

    Beaumont: Console check misses earlier attempts

    The NetScaler Console check misses earlier semi-successful attempts because it relies on logs not having rotated; he adds that the activity is weeks old because of slow disclosure.

    Validated independently on 29 Sep.

    Sources: ^[46]

21. Sep 28, 09:40 UTC Official advisory

    NHS England alert CC-4858

    NHS England's National CSOC rates the threat High and assesses further exploitation as almost certain. It strongly recommends a compromise assessment before patching, since patching first may delete evidence, and warns that end-of-life 12.1 and 13.0 releases are likely vulnerable and receive no fix. Published 10:40 UK time.

    Sources: ^[15]

22. Sep 28, 22:49 UTC Reported observation

    Beaumont names it "PitScaler"

    I'm tracking over 100 victim orgs now. Each one has a unique webshell which can't be scanned for remotely unless you're the attacker. It's espionage.

    Victim count is Beaumont's claim, not independently verified.

    Sources: ^[47]

23. Sep 28, 23:02 UTC Reported observation Validated

    Beaumont: Citrix checker incomplete

    Some really big orgs are backdoored after patching still

    The checker does not check for suid on /bin/sh; Beaumont calls on NCSCs to publish a detection script.

    The missing suid /bin/sh check was validated independently on 29 Sep. The claim about big organisations still being backdoored is not independently verified.

    Sources: ^[48]

24. Sep 28 Reported observation

    Press covers the weekend shutdown warnings

    BleepingComputer, SecurityWeek, The Record and CyberScoop cover the story.

    Sources: ^{[55][56][57][58]}

25. Sep 28 Research

    CERT-EU technical writeup on CVE-2026-88771

    "Taking 'execute logging' a bit too literally" - root cause, attack chain and hunting guidance.

    Sources: ^[19]

26. Sep 28 Official advisory

    Government advisories worldwide

    NCSC-NL NCSC-2026-0394 [H/H], NCSC-UK, CSA Singapore AL-2026-129, plus Canada, HKCERT, ACSC, and CIRCL TR-100 with per-CVE config-check CLI commands.

    Sources: ^{[6][7][8][9][10][11][16]}

27. Sep 28 Telemetry

    GreyNoise publishes TLP:CLEAR IoC set

    "Swarming Against Citrix 0-Day Exploitation" - the first public IoC set in this compiled dataset as of 29 Sep, with a companion Chronicle timeline.

    Sources: ^[36][37]

28. Sep 28 Research

    watchTowr Labs part 1 (CVE-2026-88771)

    "Oh Look, the Foot Gun Went Off Again", published with a Detection Artefact Generator (PoC-class tool).

    Sources: ^[20][21]

29. Sep 28 Telemetry

    Censys and Shadowserver count exposed NetScalers

    Censys detects NetScaler ADC or Gateway on 42,735 hosts and 323,527 web properties; these are exposed instances, not confirmed-vulnerable counts. Shadowserver reports more than 20,000 instances exposed and potentially at risk.

    Sources: ^[41][64]

30. Sep 28 Telemetry

    Lupovis honeypots see exploitation minutes after the public PoC

    Lupovis says its sensors recorded live CVE-2026-88771 exploitation attempts within minutes of watchTowr releasing its PoC; the attempts were opportunistic, from several distinct actors.

    Sources: ^[65][27]

31. Sep 28 Research

    First public detection rules

    Elastic merges a rule for NetScaler log-poisoning command injection; Corelight publishes Zeek hunting queries. Sigma and Nuclei pull requests follow (28-29 Sep, still unmerged at snapshot time).

    Sources: ^{[29][28][30][31]}

32. Sep 28 Research

    Truesec publishes potential C2 IPs

    Truesec lists 104.248.244.66, 139.180.152.138 and 77.83.199.39 as potential C2 IPs it has observed.

    Sources: ^[24]

33. Sep 28 Official advisory

    ACSC alert; Australian organisations later confirm exploitation

    Australia's ACSC publishes an alert on 28 Sep. In an update it says Australian organisations have since confirmed exploitation, and recommends reviewing for evidence of compromise since at least 4 Sep 2026.

    Sources: ^[11]

34. Sep 28 Reported observation

    Dutch ministry and hospitals take systems offline

    The Dutch Ministry of the Interior took all Citrix environments offline over the weekend; patients of two major hospitals (Amphia and ETZ) could not view their records, and Frisius MC in Leeuwarden shut down some digital systems as a precaution (SDxCentral, citing Techzine).

    Sources: ^[67]

35. Sep 29, 04:39 UTC Reported observation

    Beaumont: mass exploitation

    #PitScaler is under mass exploitation, seeing it spray and pray now. I've done some firmware version scanning, fewer than 10% of boxes are patched

    The <10% figure is Beaumont's own estimate, not independently verified.

    Sources: ^[49]

36. Sep 29, 06:18 UTC Reported observation Compromise unverified

    Beaumont posts a public message to the NSA

    do forensics on 103.41.70.207,vdicorp.nsa.gov

    The domain resolves to that IP. That the host is an NSA-operated Citrix system has been validated independently. That it is compromised is Beaumont's implication and is not verified. This briefing does not identify any organisation as compromised, and these values are not listed as IoCs.

    Sources: ^[50]

37. Sep 29, 16:12 UTC Reported observation Validated

    Beaumont: IR writeups expose victim-unique indicators

    IR vendors are publishing PitScaler writeups containing victim-unique webshell names (.sig files) and attacker IPs, which he says lets him map victim orgs via network traffic. He warns that unremediated orgs' published webshell names can be used to access their boxes, and says one vendor uploaded its IR investigation to VirusTotal.

    Validated independently on 29 Sep.

    Sources: ^[51]

38. Sep 29, 18:49 UTC Reported observation

    The Register: government, banks and professional services targeted

    Why Citrix took so long to disclose these vulnerabilities is a question only Citrix can answer

    It reports GTIG/Mandiant findings that government, financial services, education and legal and professional services organisations in North America and Europe were likely hit. watchTowr CEO Benjamin Harris criticises the slow disclosure and says no attribution has been made public.

    Sources: ^[62][25]

39. Sep 29 Research

    watchTowr Labs part 2 (CVE-2026-88772)

    "Here We Go Again" (Sina Kheirkhah) - full RCE analysis plus a second Detection Artefact Generator.

    Sources: ^[22][23]

40. Sep 29 Research

    Google GTIG / Mandiant: custom malware WHIPSHOT and SLAPSHOT

    The CVE-2026-88772 campaign has been ongoing since at least early September. WHIPSHOT is a PHP webshell staged with a .deb disguise that hides base64 C2 in HTTP headers; SLAPSHOT is a Python TCP tunneler (open/push/pull/exch/close/ping) used to reach internal networks for reconnaissance and credential theft.

    Sources: ^[25][62]

41. Sep 29 Reported observation

    BleepingComputer: credential theft and internal spread

    It reports that attackers exploited CVE-2026-88772 to deploy webshells and tunneling malware, gain root, steal credentials and spread into internal networks, citing Mandiant. GTIG itself describes the credential theft and internal reconnaissance in at least one observed intrusion.

    Sources: ^[54][25]

42. Sep 29 Reported observation Validated

    Mandiant CTO: check for compromise before patching

    Given the active exploitation, NetScaler customers should prioritize examining their systems for compromise *before* upgrading/patching

    Charles Carmakal on LinkedIn, as quoted by The Register.

    Quote validated against a second, non-public source on 29 Sep.

    Sources: ^[62]

43. Sep 29 Research

    Nextron releases THOR rules and a NetScaler filesystem IoC set

    Three rules in the THOR Preview channel (higher false-positive rate than stable rules) plus a YAML IoC set derived from the filesystem checks in Citrix's scanner script. A match is a lead, not proof.

    Sources: ^[26]

44. Sep 29 Research

    eSentire publishes first-hand IR findings and IoCs

    Two webshell variants (.ico and .deb), 14 IPs and 2 SHA-256 hashes; the technique matches CERT-EU's description. eSentire advises treating appliances that were Internet-facing and unpatched in early September as potentially compromised until an integrity assessment shows otherwise.

    Sources: ^[32]

45. Sep 29 Telemetry

    Defused: hundreds of decoy hits across multiple exploit paths

    Defused reports hundreds of CVE-2026-88771 hits on its decoys in 24 hours via /nf/auth/doAuthentication.do, /cgi/login, /p/u/doLogon.do, /logon/LogonPoint/tmindex.html and User-Agent payloads on /. Observed follow-up: whoami/id to prove root, nx_verify.html marker files, curl/wget/fetch pulling a second stage, and blind DNS callbacks. Full IoCs are on Defused Radar (not reproduced here).

    Sources: ^[42]

46. Sep 29 Official advisory

    DKCERT warns Danish universities and research institutions

    DKCERT, the CERT for the Danish research and education network, reports two critical NetScaler zero-days exploited before a patch and notes that several administrators took systems offline before Citrix published details.

    Sources: ^[14]

47. Sep 29 Reported observation

    Mandiant: dozens of organisations impacted

    Cybersecurity Dive reports Mandiant CTO Charles Carmakal saying the actor deployed webshells and moved laterally into internal networks at some targets, with dozens of organisations impacted across North America and Europe, including telecommunications.

    Sources: ^[68]

48. Sep 29 Official advisory

    Dutch government confirms preventive disconnection

    Letter to parliament: on Saturday 26 Sep the CIO Rijk set the line "loskoppelen tenzij" (disconnect unless) for central government, and it was broadly applied; remote-work access has not yet been restored everywhere while the patch is tested and forensic investigation continues. Beaumont relays it at 18:32 UTC as "shut down all Citrix Netscalers".

    Sources: ^[17][53]

49. Sep 30, 05:00 UTC Reported observation

    Ingeniøren: PET, Danish Defence and police shut down Citrix

    Based on Shodan data, Ingeniøren reports that PET, the Danish Armed Forces, the Danish police and Copenhagen Airport, among many others, had to switch off their Citrix environments over the weekend. None of the agencies would explain why.

    Sources: ^[66]

50. Sep 30 Official advisory Deadline - upcoming

    Deadline: CISA KEV federal remediation

    Due on the snapshot date (30 Sep). A deadline, not an event.

    Sources: ^[5]

Public IoCs Public / TLP:CLEAR only

This table only contains indicators that have been published openly. The Sharing column shows each source's own marking. ^{[36][40][24][25]}

• GreyNoise published its set on 28 September, marked TLP:CLEAR. GreyNoise has announced a longer "GreyNoise Labs" version, but the link on its blog was still a placeholder on 29 September.
• IFIN says the observables it shares were shared without restriction.
• Truesec's page is public and has no TLP marking.
• GTIG/Mandiant's blog is public and has no TLP marking. GTIG keeps its full IoC collection for registered GTI users only.

Download all IoCs as CSV

Post-exploitation steps attempted on a GreyNoise sensor

GreyNoise says the attacker did not gain a foothold on its sensor. The steps below show the attacker's playbook, not a successful compromise.

• Set setuid and setgid on /bin/sh.
• Planted a PHP webshell that authenticates by cookie.
• Killed and restarted httpd, for anti-forensics or to activate the changed config.

A Reddit user described one sample of the .ctxs.receiver file, and IFIN relayed the description. This is unconfirmed. ^[40]

• The file is a 237-byte PHP one-liner.
• It runs a URL-decoded cookie value through passthru(), but only when a second cookie matches a hardcoded 16-character hex token.
• NetScaler uses both cookie names legitimately, so the traffic blends in.
• The file survived a reboot and the upgrade to 14.1-73.37.

The token likely differs per victim, so search the file's content rather than relying on its hash.

Source: GreyNoise, "Swarming Against Citrix 0-Day Exploitation". Victim-specific names and IPs from later IR-vendor writeups are deliberately left out. Beaumont warns that publishing them exposes organisations that have not yet remediated. ^[51]

Detection and hunting for NetScaler compromise

In short: review httpd.conf for PHP handler and AliasMatch changes, look for PHP files in VPN script and media directories, check /bin/sh for setuid, and correlate DTLSv1.0 handshake failures with NSPPE crashes. Sources: GTIG/Mandiant, CERT-EU and GreyNoise, as of 30 September 2026. ^[25][19]

Remediation: patching NetScaler ADC and Gateway

In short: check for compromise and preserve evidence first, then upgrade to 14.1-73.37 or 13.1-64.23 or later (FIPS/NDcPP builds below), per Citrix CTX697096 as of 30 September 2026. Patching does not remove an existing backdoor. ^[1]

Fixed builds (Citrix CTX697096)

Source: Citrix CTX697096. Use the bulletin as the authority for which build applies to your deployment.

13.1 upgrades: watchTowr advises running show ns variable first. If it returns any variables, use 13.1-64.24 to avoid a known reboot loop during the upgrade. ^[61] CVE-2026-88778 is fixed by enabling Enhanced ISN Generation, not by the upgrade alone. ^[13]

End-of-life releases: NetScaler ADC and Gateway 12.1 and 13.0 are end of life, receive no fix and are likely vulnerable. Migrate them to a supported release. ^[15][41]

The bulletin is inconsistent about the last build. Its fixed-builds list says 13.1.37.279, while its affected-versions list says "FIPS and NDcPP BEFORE 13.1-37.279". Truesec and IFIN use 13.1-37.279. The table above keeps Citrix's fixed-builds wording exactly.

After patching

1. Check for compromise and preserve evidence before you patch. Mandiant's CTO, Charles Carmakal, says customers should examine their systems for compromise *before* upgrading/patching. ^[62] Unit 42 lists the evidence to capture: ^[63]
   • a NetScaler VPX instance snapshot
   • logs on remote syslog servers and in NetScaler Console
   • a technical support bundle
   • a packet engine core dump
   Patching and restarting can destroy this evidence.
2. Patch to a fixed build from the table above.
3. Hunt for compromise. Check for:
   • webshells, including the GreyNoise path and alias above
   • changes to httpd.conf, such as an unexpected AliasMatch
   • unusual permissions on /bin/sh, such as setuid or setgid
   Use the CERT-EU and CIRCL guidance. ^[19][16][36]
4. Assume activity may be weeks old. Beaumont says slow disclosure means attackers have been active for weeks. ^[46]

Patching closes the vulnerabilities. It does not reverse a compromise that already happened. This page does not give remediation commands or guarantees. Follow Citrix and your national CSIRT.

NetScaler zero-day FAQ

References

Bracketed numbers in the text, such as ^[1], point to the rows below. Every link below is the exact URL from the compiled dataset. IFIN, Truesec, GTIG/Mandiant, Nextron, The Register, Unit 42, the Dutch government letter, two more Beaumont posts, the CVE record, a second BleepingComputer article, the Canada, HKCERT and ACSC advisories, eSentire, Beazley Security Labs, Ingeniøren, DKCERT, NHS England, the CERT-EU advisory, SDxCentral, heise, Dark Reading, Lupovis's own post, and the Censys, Shadowserver, Lupovis, Beazley, Corelight, Elastic, Sigma and Nuclei material were added later, on 29 September. Links marked verification pending did not load in an automated check at build time. The URL has been kept unchanged, not replaced. For all other links, the check only showed that the page loaded, not that its content was reviewed.