TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1101-16Exploited in the wild
Citrix NetScaler pre-auth RCE (CVE-2026-88771): exploited command execution at the edge
Citrix fixed eight NetScaler ADC and Gateway flaws and warned that two were already being exploited: CVE-2026-88771, unauthenticated command execution, and CVE-2026-88772, a DTLS memory overflow, both CVSS v4.0 9.5. A SAML denial of service, CVE-2026-88779, followed into CISA KEV. Patch to the fixed build, then check for compromise before you trust the appliance.
SEVERITY
Critical
PEAK CVSS
9.5
AUTH REQUIRED
None
PUBLIC POC
Not confirmed
PUBLISHED
Nov 1, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
The NetScaler at your network edge is the one box an attacker most wants, because it terminates the VPN, brokers authentication, and sees traffic on its way in. This month it was a zero-day, twice.
CVE-2026-88771 lets an unauthenticated attacker run commands on the appliance. CVE-2026-88772, a DTLS memory overflow, reaches the same outcome by a different path. Both score 9.5, both were exploited before the fix, and Citrix said plainly that it had observed exploits on unmitigated deployments. A third flaw, a SAML denial of service, landed in CISA KEV days later.
NetScaler has a long memory. The CitrixBleed lineage taught defenders that patching the edge is not the end of the job, because an appliance compromised before you patched stays compromised: planted web shells, stolen session tokens, and harvested credentials all survive the update. So the real question after patching this set is not "are we on the fixed build," it is "was this box touched before we got there," and that takes a compromise check, not a version number.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a cluster of NetScaler ADC and Gateway flaws fixed on Sep 27, two of which Citrix confirmed were exploited before the fix: CVE-2026-88771, unauthenticated command execution, and CVE-2026-88772, a DTLS memory overflow, both CVSS v4.0 9.5. A SAML denial of service, CVE-2026-88779, was added to CISA KEV on Oct 4. NetScaler is a repeatedly targeted edge device, so patch to the fixed build and run a compromise check before trusting the appliance.
KEY JUDGMENTS
01
Citrix stated exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments had been observed. CVE-2026-88779 was added to CISA KEV on Oct 4, 2026.Observed
02
NetScaler sits at the authentication and VPN edge, so a compromise exposes session tokens, credentials and internal reach, not just the appliance.Assessed
03
Exposure depends on configuration. Gateway and AAA virtual servers, and SAML identity-provider setups, are the high-risk roles in this cluster.Reproduced
04
Given the CitrixBleed history, an appliance exposed while unpatched may already hold web shells or stolen tokens that a patch does not remove.Assessed
02 · VULNERABILITY DETAILS
Vulnerability summary
NetScaler ADC and Gateway pre-auth command execution
Sep 27Citrix publishes CTX697096 fixing eight NetScaler flaws and warns CVE-2026-88771 and CVE-2026-88772 were exploited on unmitigated deployments.
Oct 3 to 4Citrix discloses CVE-2026-88779, a SAML denial of service; CISA adds it to KEV on Oct 4 with an Oct 7 deadline.
Oct 9CVE-2026-107406, a SAML memory overflow, follows on the builds that fixed the September flaws.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Each bulletin names its fixed builds and later releases, so a newer build carries the earlier fixes. Confirm the exact fixed release for your train against Citrix's bulletins.
PRODUCT
AFFECTED
FIXED IN
STATUS
NetScaler 14.1 train
before the fix
14.1-73.37 and later
Fixed
NetScaler 13.1 train
before the fix
13.1-64.23 and later
Fixed
NetScaler 13.1 FIPS / NDcPP
before the fix
13.1-37.279 and later
Fixed
Citrix-managed cloud
handled by Citrix
no customer action
Not applicable
CHECK BEFORE YOU TRUSTGiven exploitation before the fix, patching is not sufficient on its own. Check each appliance for web shells, unexpected files and signs of token theft before you treat it as clean.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing NetScalerUpgrade to the CTX697096 fixed build for your train now. Two of these flaws were exploited pre-fix.
Appliances exposed while unpatchedRun a compromise check and rotate session secrets before trusting the box.
HighWithin 72 hours
Gateway and AAA virtual serversConfirm these roles are patched; they are the high-risk configurations.
SAML identity-provider appliancesApply CTX697174 for CVE-2026-88779 and watch for CVE-2026-107406 guidance.
SessionsTerminate and reissue active sessions after patching to invalidate stolen tokens.
HighBefore closing
Every applianceRecord the fixed build, the compromise-check result and any secret rotation as evidence.
WORKAROUNDS
Patch is the fix. There is no configuration that removes these flaws. Upgrade to the fixed build for your train.Reduce exposure. Limit which networks can reach the management and Gateway interfaces while you patch.Hunt before trusting. Check for web shells, unexpected files and anomalous authentications on exposed appliances.Rotate sessions and secrets. Invalidate active sessions and rotate credentials that an exposed appliance handled.
06 · DETECTION AND HUNTING
Observables and hunting queries
These are edge appliances, so detection leans on configuration, logs and file integrity rather than endpoint telemetry.
TYPE
OBSERVABLE
SOURCE
Exposure
A running build older than the CTX697096 fixed release
Appliance version, inventory
Behavior
Unexpected files or scripts on the appliance filesystem
NetScaler shell, file integrity
Behavior
Anomalous authentications or session reuse after disclosure
Gateway and AAA logs, SIEM
EXPOSURE · CVE-2026-88771confirm the running build
# compare the NetScaler build to CTX697096 fixed releases
HUNT · NetScalerunexpected files on the appliance
# per Citrix guidance, review the appliance for web shells and modified files
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Observed
Credential Access
T1539
Steal Web Session Cookie (CitrixBleed-class risk)
Assessed
08 · TECHNICAL ANALYSIS
Root cause and attack path
CTX697096 fixed eight flaws in customer-managed NetScaler ADC and Gateway. Citrix singled out two as exploited before the fix. CVE-2026-88771 is improper input validation that an unauthenticated attacker can turn into command execution on the appliance. CVE-2026-88772 is a memory overflow in DTLS handling that reaches a similar outcome through the VPN transport. Both carry a CVSS v4.0 of 9.5. A follow-on bulletin covered CVE-2026-88779, a SAML denial of service that CISA listed as exploited, and later CVE-2026-107406, a SAML memory overflow on the same fixed builds.
The reason these matter beyond the single box is the role NetScaler plays. It terminates VPNs, brokers SAML authentication and proxies inbound traffic, so control of it means visibility into sessions and a trusted path inward. The CitrixBleed family of memory-disclosure flaws established that attackers use NetScaler access to steal session tokens and bypass multifactor authentication, and that a patched appliance can still be compromised if it was reachable while vulnerable. That is why the response pairs patching with a compromise check and session rotation.
01 REACH
Attacker reaches an unpatched NetScaler at the edge
Control: Limit management and Gateway reachability
02 EXPLOIT
Pre-auth command execution or DTLS overflow
Control: Patch to the CTX697096 fixed build
03 PERSIST
Web shell, stolen tokens, harvested credentials
Control: Compromise check before trusting the box
04 PIVOT
Session hijack and inward movement
Control: Rotate sessions and secrets after patching
SAML denial of service added to CISA KEV on Oct 4, 2026.
AssessedNetScaler is the edge device attackers return to. Patch closes the door; a compromise check and session rotation decide whether someone was already inside.
09 · VALIDATION
Confirm remediation
A fixed build is necessary but not sufficient after pre-fix exploitation. Each appliance should end with evidence: patched, checked for compromise, and sessions rotated where it was exposed.
01
Confirm the running build
Across every ADC and Gateway, including FIPS and NDcPP builds.
# compare the NetScaler build to the CTX697096 fixed releases for your train
02
Identify the risky roles
Gateway, AAA and SAML identity-provider configurations are the priority.
# enumerate Gateway/AAA vservers and SAML IdP configuration
03
Check for compromise
Follow Citrix guidance to review the appliance for web shells and modified files.
# per Citrix: inspect the appliance filesystem and logs for tampering
04
Rotate sessions and secrets
Invalidate active sessions and rotate credentials the appliance handled.
# terminate active sessions; rotate secrets touched by the appliance
05
Confirm reachability control
Verify management and Gateway interfaces are restricted to intended networks.
# from untrusted networks, in scope: confirm management is not reachable
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-88771
01Do you run customer-managed NetScaler ADC or Gateway (14.1 or 13.1 trains)?
02Is the running build older than the CTX697096 fixed release for your train?
03Is the appliance configured as a Gateway, AAA, or SAML identity-provider virtual server?
04If an appliance was exposed while unpatched, have you run a compromise check and rotated sessions?
ANSWER TO SEE A VERDICT
Pick yes, no or not sure for each question.
11 · REFERENCES AND REVISION HISTORY
References
›Citrix bulletin CTX697096 (NetScaler ADC and Gateway, Sep 27)
›Citrix bulletin CTX697174 (CVE-2026-88779)
›CISA Known Exploited Vulnerabilities catalog (CVE-2026-88779 added Oct 4)
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-88771 being exploited?
Yes. Citrix stated exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated deployments had been observed, and the related SAML flaw CVE-2026-88779 is in CISA KEV.
Which builds fix it?
The CTX697096 fixed releases for your train: 14.1-73.37, 13.1-64.23 and 13.1-37.279 FIPS/NDcPP, and later. CVE-2026-88779 is fixed in CTX697174.
Does patching make the appliance safe?
Not on its own. Because two flaws were exploited before the fix, check for compromise and rotate sessions on any appliance that was reachable while unpatched.
Which configurations are most at risk?
Gateway and AAA virtual servers, and SAML identity-provider deployments, are the high-risk roles in this cluster.
VALIDATE YOUR EXPOSURE
Prove your edge is clean
Hayrok inventories your NetScaler appliances, confirms the fixed build per train, and tests whether management interfaces are reachable from untrusted networks. Every result lands in Evidence Fabric.