Mandiant said on September 29 that it identified active exploitation of Citrix NetScaler flaw CVE-2026-88772 in late September and found evidence that the campaign had been running since at least early September. The firm said organizations in North America and Europe across government, financial services, technology, education, legal, and professional services were likely impacted.
Citrix disclosed eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway deployments on September 27, 2026. Two of them, CVE-2026-88771 and CVE-2026-88772, were confirmed as exploited in the wild against unmitigated deployments. A separate Tech Help Canada report covers the original Citrix patch release.
Citrix’s bulletin says CVE-2026-88771 is an improper input validation flaw that can allow an unauthenticated attacker to execute arbitrary commands. The company says it affects all NetScaler ADC and NetScaler Gateway deployments, including default configurations, with no additional feature required. Rapid7 highlighted that scope as especially concerning.
CVE-2026-88772 is a memory overflow issue that can lead to remote code execution or denial of service when DTLS is enabled. Citrix notes that DTLS is enabled by default on VPN virtual servers, which makes configuration review an urgent part of exposure assessment.
Both flaws carry CVSS v4.0 base scores of 9.5. CISA said the vulnerabilities can independently enable remote code execution and that partner threat intelligence confirmed active global exploitation. The Canadian Centre for Cyber Security warned that successful exploitation may allow complete compromise of an appliance, unauthorized access to applications and services, credential theft, lateral movement, and further compromise of internal systems.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27 and set September 30 as the remediation due date for affected federal civilian agencies. The agency’s current KEV guidance also calls for forensic triage, reinforcing the need to look for evidence of compromise rather than treating the response as a patch-only exercise.
Mandiant describes web shells and tunneling
Mandiant’s report centers on CVE-2026-88772. According to Mandiant and Google Threat Intelligence Group, exploitation bypasses authentication and causes an unhandled termination of the NetScaler Packet Processing Engine, allowing initial root-level access on the appliance.
The post-exploitation toolkit described by Mandiant includes WHIPSHOT, a custom PHP web shell, and SLAPSHOT, a Python tunneling tool. Mandiant said the tunneler can proxy traffic into internal networks for reconnaissance and credential theft. In at least one observed intrusion, the threat actor used that proxy to conduct manual internal reconnaissance and steal credentials.
That finding changes the practical risk. An edge appliance may be patched after disclosure, but a pre-existing compromise may still leave behind web shells, configuration changes, stolen credentials, or access paths into the internal network. That is why CISA urged organizations to check for indicators of compromise before patching where possible and to preserve forensic evidence when compromise is suspected.
Affected versions and fixed builds
Citrix says the bulletin applies to customer-managed NetScaler ADC and NetScaler Gateway deployments. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are handled by Cloud Software Group, while Secure Private Access Hybrid deployments using NetScaler instances must be upgraded by customers.
The affected versions identified by Citrix are:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37.
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23.
- NetScaler ADC FIPS before 14.1-73.37 FIPS.
- NetScaler ADC FIPS and NDcPP before 13.1-37.279.
Citrix urges affected customers to install the relevant updated versions as soon as possible. Mandiant also recommends applying the latest Citrix build as the preferred response, while assessing suspected systems for compromise and isolating confirmed or suspected compromised appliances where necessary.
Exposure remains broad
Palo Alto Networks Unit 42 said Cortex Xpanse telemetry identified 50,277 exposed instances that may be vulnerable as of September 27. The figure is not the same as a confirmed victim count, but it gives a sense of the potential attack surface at the time Citrix and government cyber agencies were issuing alerts.
What defenders are being told to prioritize
The guidance across Citrix, CISA, the Canadian Centre for Cyber Security, CERT-EU, and Mandiant points to the following priorities.
- Identify every customer-managed NetScaler ADC and Gateway appliance. Internet-facing systems deserve priority because the exploited flaws affect edge appliances.
- Move to fixed builds. Citrix lists 14.1-73.37, 13.1-64.23, and the corresponding FIPS or NDcPP builds as fixed releases.
- Check for compromise, not just version numbers. CISA warned that updates may reduce forensic visibility, and Mandiant published hunting guidance for suspicious web server configuration changes, abnormal files, and anomalous egress.
- Treat suspected appliances as untrusted until validated. Mandiant recommends isolating confirmed or suspected compromised appliances, pausing high-availability synchronization until nodes are validated, and restricting appliance egress.
- Review downstream access. Because Mandiant observed internal reconnaissance and credential theft in at least one intrusion, response work may need to extend beyond the NetScaler appliance itself.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
