A pre-authentication memory overflow in NetScaler ADC and Gateway, exploited as a zero-day since early September
On September 27, 2026, Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which were already being exploited as zero-days. CVE-2026-88772 is the one that should worry anyone running a Gateway: a memory overflow in the DTLS handler that lets an unauthenticated attacker run code on the appliance, or at least crash its packet engine. Exploitation began in early September, weeks before the fix existed, so this is patch-and-hunt, not patch-and-forget.
| CVE ID | CVE-2026-88772 | CVSS v4.0 | 9.5 (Critical) |
| Product | Citrix NetScaler ADC & Gateway | Weakness | CWE-119 memory overflow |
| Impact | Pre-auth remote code execution or DoS | Precondition | DTLS enabled (default on Gateway VPN virtual servers) |
| Status | Exploited in the wild; on CISA KEV since Sep 27, 2026 | Fixed in | 14.1-73.37+ and 13.1-64.23+ |
1. Timeline
• Early September: earliest exploitation traced by Mandiant/GTIG and eSentire. September 27: Citrix bulletin CTX697096 covers CVE-2026-88771 to -88778 and confirms exploitation of two; CISA adds both to KEV the same day with a September 30 deadline.
• September 29-30: Mandiant publishes its campaign analysis and IOCs, and root-cause details become public. No verified weaponized public exploit was reported as of late September, but expect that window to be short.
2. What is actually broken
DTLS is TLS for UDP. Because UDP gives no delivery guarantees, a handshake message can be split across several datagrams, and the receiver has to reassemble the fragments. Each fragment header declares the total message length and the length of the piece it carries. NetScaler terminates DTLS inside the NetScaler Packet Processing Engine (NSPPE), and this is where the bug lives.
Per WatchTower’s analysis, NSPPE trusts those attacker-controlled length fields while reassembling fragments. Incoming packets of up to 1,459 bytes are held in NetScaler Buffers and stitched into a single scratch buffer of only 35,840 bytes, without the declared sizes being reconciled against what is actually received and what the buffer can hold. The result is heap memory corruption that Mandiant observed being turned into shellcode execution as root on the appliance’s FreeBSD base.
Figure 1. Conceptual view of the DTLS reassembly flaw (not to scale), based on public analysis.
Four properties make it severe. The flaw sits in the handshake, so no authentication is needed. NSPPE runs with root privileges. Gateways expose UDP/443 to the internet, and DTLS is on by default for VPN virtual servers. And exploitation can need very little traffic, so volume-based anomaly detection may miss it. The CVSS v4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, high impact on confidentiality, integrity and availability) captures this, with “AT:P” reflecting the DTLS precondition. A failed attempt still crashes NSPPE, which causes an outage or HA failover and doubles as a detection signal.
3. Affected and fixed versions
| Branch | Vulnerable | Fixed |
| NetScaler ADC / Gateway 14.1 (incl. 14.1 FIPS) | Earlier than 14.1-73.37 | 14.1-73.37 or later |
| NetScaler ADC / Gateway 13.1 | Earlier than 13.1-64.23 | 13.1-64.23 or later |
| NetScaler ADC FIPS & NDcPP 13.1 | Earlier than 13.1-37.279 | 13.1-37.279 or later |
4. What attackers did after exploitation
Mandiant and GTIG tied the campaign to organizations in North America and Europe across government, financial services, technology, education, and legal and professional services. The post-exploitation tradecraft is the part defenders can actually hunt:
Figure 2. Observed attack path and post-exploitation architecture (1 exploit, 2 root, 3 persistence, 4 web shell and tunneler, 5 pivot).
• Foothold: an installer web shell edits httpd.conf so that files with non-script extensions such as .deb and .sig are executed as PHP. One variant aliases requests for /vpn/media/*.ico to a .sig shell, so C2 traffic looks like icon fetches and often returns a fake 404.
• Root persistence: the shell sets the SUID bit on /bin/sh, restarts httpd or reboots the appliance to apply changes, and scrubs its path from /etc/crontab.
• Command channel: Base64 commands carried in headers named like NetScaler’s own (HTTP_NSC_LDAP, HTTP_NSC_CLIENTTYPE), which blend into normal traffic.
• Pivoting: a PHP web shell (WHIPSHOT) talks to a loopback Python TCP tunneler (SLAPSHOT), giving the actor a proxy into the internal network for reconnaissance and credential theft.
CVE-2026-88771, the other exploited bug, is a separate input-validation flaw. The DTLS-specific mitigations below do not cover it; only the patched build fixes both.
5. Hunting and detection
Most of these artifacts are not forwarded to a SIEM by default, so confirm that /var/log/messages, the web server logs and ns.log are actually collected. Citrix also provides an IOC scanner through its console advisory dashboard. Network IOCs published by Mandiant include 143.198.7.94 and 157.254.167.12.
| Check | What suggests exploitation or compromise |
| Syslog (ns.log) | SSL_HANDSHAKE_FAILURE with DTLSv1.0 and reason “Handshake failure-Internal Error” |
| /var/log/messages | NSPPE process exit messages, or pitboss reporting it is NOT restarting NSPPE; new core files under /var/core/ |
| /etc/httpd.conf | AddHandler application/x-httpd-php for odd extensions (.deb, .sig), php_flag engine on, or AliasMatch on /vpn/media/ |
| Client script folders | Plain-text or PHP files under /var/netscaler/gui/vpn/scripts/linux/ and similar paths (legit files are binaries/archives) |
| Runtime state | SUID bit on /bin/sh; /tmp/.uxdport or /tmp/.uxdlock; Python run via nohup with Base64 payload |
| Web logs | 404s on /vpn/media/*.ico with multi-KB bodies; “file does not exist” errors for .sig files; gaps in access logs |
Quick triage on a suspect appliance (adapted from Mandiant’s guidance; read-only):
grep -En -i “application/x-httpd-php|php_flag|AliasMatch” /etc/httpd.conf
ls -l /bin/sh ; ls -la /tmp/.uxdport /tmp/.uxdlock
grep -E “\.(deb|sig)” /var/log/httperror*
6. Remediation playbook
Figure 3. Recommended response workflow for NetScaler ADC and Gateway estates.
1.Patch first. Move every ADC and Gateway to the fixed build for its branch (Mandiant’s top recommendation).
2.Stopgap only if you must: disable DTLS on Gateway virtual servers that do not need it and block inbound UDP/443 on an upstream firewall (local ACLs act too late, as traffic has already reached NSPPE). Covers CVE-2026-88772 only.
3.Assume compromise until the hunt says otherwise. If you find indicators, isolate the node, snapshot VM memory before any reboot, and pause HA sync so a bad httpd.conf does not replicate to the standby.
4.Rotate secrets after patching: sessions, admin and local accounts, SSH keys, TLS keys, LDAP bind, RADIUS/TACACS, SNMP and NITRO credentials, then review StoreFront, DDC and Windows logs for lateral movement.
7. Takeaways for pentesters and blue teams
• Scope UDP. External assessments often stop at TCP. Enumerate UDP/443 and DTLS on Gateways, fingerprint the build, and report exposure against the fixed-version list. Version checks suffice; do not crash-test production edge appliances.
• Edge devices sit outside EDR. Gateways and ADCs hold credentials and see internal traffic, which is why they keep showing up among exploited zero-days. Give them their own logging, integrity monitoring and egress controls.
• Do not over-trust the score. Sources disagree (eSentire cites 8.1, most others 9.5); active exploitation and KEV status, not the number, should set priority.
Length-field trust is an old bug class, and the appliance guarding remote access can be the way in. Patch, hunt, rotate, verify telemetry.
8. Update since the first advisory
Two things changed after September 29. watchTowr published a root-cause analysis of CVE-2026-88772 together with a detection artefact generator that sends the full exploit sequence, and Tenable notes that these tools also work as public proofs of concept, with some limitations. The quiet window mentioned in the timeline has closed. Mandiant has said dozens of organizations were affected and expects broad, opportunistic exploitation by several actors, so an unpatched Gateway is a target for more than the one campaign described above.
On October 3 Citrix published bulletin CTX697174 for CVE-2026-88779, a memory overflow that causes denial of service on appliances configured as a SAML service provider or identity provider. It scores 8.7 on CVSS v4.0, is exploited in the wild, and joined the CISA KEV catalog on October 4. The September 27 builds do not fix it, so SAML deployments that have already been upgraded have to upgrade again. To check exposure, look for add authentication samlAction (service provider) or add authentication samlIdPProfile (identity provider) in the running configuration.
| Branch | Fixed for CVE-2026-88771 to 88778 | Fixed for CVE-2026-88779 |
| NetScaler ADC / Gateway 14.1 | 14.1-73.37 and later | 14.1-73.41 and later |
| NetScaler ADC / Gateway 13.1 | 13.1-64.23 and later | 13.1-64.28 and later |
| NetScaler ADC 14.1-FIPS | 14.1-73.37 FIPS and later | 14.1-73.41 FIPS and later |
| NetScaler ADC 13.1-FIPS and NDcPP | 13.1-37.279 and later | 13.1-37.282 and later |
Until the newer build is installed, Citrix offers Global Deny List signatures that reduce exposure to CVE-2026-88779. They apply to standard (non-FIPS) 14.1 and 13.1 appliances that already run the September 27 builds and are managed through NetScaler Console.
9. The other six CVEs in the bulletin
Bulletin CTX697096 fixes six more flaws. None is reported as exploited, but several score high and depend on configuration, so the same upgrade that closes the two zero-days covers them as well.
| CVE | Weakness | CVSS v4.0 |
| CVE-2026-88773 | HTTP request smuggling (needs HTTP configuration enabled) | 9.3 |
| CVE-2026-88774 | Feature policy bypass | 7.0 |
| CVE-2026-88775 | Memory overflow | 8.8 |
| CVE-2026-88776 | Memory overflow | 8.8 |
| CVE-2026-88777 | Memory overflow | 8.8 |
| CVE-2026-88778 | TCP initial sequence number prediction | 8.8 |
CVE-2026-88778 needs one extra step: Enhanced ISN Generation has to be turned on in the TCP settings, because the upgrade alone does not fix it. Versions 12.1 and 13.0 are end of life and get no fixes. Citrix has not said whether they are affected, so those appliances should move to a supported branch.
10. Detection engineering
The table in section 5 finds artifacts after the fact. Mandiant also describes alerts that can catch an attempt while it happens.
• Alert on SSL_HANDSHAKE_FAILURE events with ClientVersion DTLSv1.0 and the reason “Handshake failure-Internal Error”, then look for an NSPPE crash on the same appliance within minutes. The pair is a strong exploitation signal and deserves a high-priority ticket.
• Alert on NSPPE termination messages and on pitboss declining to restart NSPPE as two separate events, without waiting for both. Add new core files under /var/core/ and unexpected HA failovers or restarts on internet-facing Gateways to the same watch list.
• Review inbound UDP/443 on appliances where DTLS is disabled or not expected, and baseline which sources normally open DTLS sessions to each Gateway. Exploitation can need very little traffic, so a volume threshold alone will miss it.
• Watch /etc/httpd.conf, /nsconfig/httpd.conf and /flash/nsconfig/httpd.conf for new AddHandler, php_flag or AliasMatch lines, and the VPN script and media directories for new .sig files.
• Flag outbound connections from the appliance to destinations outside its approved list, especially credential vaults, privileged access management systems, domain controllers on unusual ports, and SMTP on TCP/25.
After recovery, apply default-deny outbound rules to the appliance, keep NSIP and management interfaces off the internet, and make sure the appliance logs reach the SIEM, since upstream devices cannot see HTTP paths or headers once TLS ends on the box.
About the Author
Deepak Kumar Nath — MD & CEO, Threatsys Technologies; Entrepreneur, Cybersecurity Expert, Lead Auditor, TedxSpeaker; CISA, CISSO, CCISO, CPENT, LPT, CIPP, CPTE, CEH, ISO 27001 LA, CHFI, ECSA.
