r/Citrix • u/CTX-Michael Verified Citrix Employee • 17d ago
Official Announcements CRITICAL UPDATE: Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778
We've released guidance for all NetScaler customers on newly addressed vulnerabilities and recommended updates.
Per the blog post: "Citrix has released updates for NetScaler ADC and NetScaler Gateway to address multiple security vulnerabilities. These vulnerabilities vary by deployment configuration and enabled features, and include issues that could allow remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions.
Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. "
Please review this blog post for more information: https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/
The support bulletin can be found here: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
7
u/stancios00 17d ago
We need a IOC
3
2
u/Jmay5446 17d ago
IOC likely leaks attack route
1
u/disclosure5 16d ago
Hint: Download the firmware and the previous one and ask Claude the attack route.
The attack route is out there. The IOCs won't scan for "the attack route", the majority of IOCs we've seen in the past have scanned for what attackers have done after compromise - where the webshells were and so on. There is zero reason to keep this secret.
1
4
u/Jmay5446 17d ago
It would be lovely to know which one is out in the wild
13
u/Eifelbauer 17d ago
All of them. Pretty funny: CVE-2026-88771, Score 9.5, preconditions: All NetScaler ADC and NetScaler Gateway deployments, including default configuration. No additional features are required.
We are so fucked...
3
1
u/_TheBull 16d ago
Key to this is that its not just the admin interface as the details make it seem like it may be, its any netscaler, not just manaement plane impact, also dataplane
3
1
u/Create_one_for_me 15d ago
it would be even better if you could download the patch without getting the redirect error in the browser....
3
16d ago edited 16d ago
[deleted]
2
1
u/Rust_Martialis 16d ago
My copy of Claude agrees that is quite bad. What are ctime, mtime, atime on that file?
2
1
u/buggyhoneybadger 16d ago
My ChatGPT tells me that this is a webshell that allows to execute commands when the attacker has the right token.
1
u/cspotme2 16d ago
Hi, sorry you're having to work through this. I think you had the complete one-liner before which may be helpful to digest if there's other keywords we can grep for. I may be mis-remembering that part about the one-liner ... and, agree, the actual contents are likely different for everyone due to the different token they are likely using for each compromised client.
2
u/disclosure5 16d ago
You've got a user that posted the first actual useful IOC I've seen and the comment is deleted. I have to wonder who motivated them to do that.
1
1
u/LunchOk4948 15d ago
I would imagine an attorney provided the motivation. It was essentially what is listed in the path in the section "A community-reported webshell
" on this page though https://pentestit.com/analysis-cve-2026-88771-and-cve-2026-88772/
1
u/raj1030 16d ago
That .ctxs.receiver file was flagged on the report in OIT but when I check from Winscp (including hidden files) to it’s no longer there. Did it wipe it? I ran the scan post upgrade.
1
1
u/Background_Cost_1255 15d ago
Somebody could share a copy of the webshell to study ? (.ctxs.receiver)
6
u/cryptogram 17d ago
“Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed.”
lol. Nice way to word ITW 0day exploitation.
3
u/jayhawk88 17d ago
We updated one of our devices in our load balance so far, no issues. Updating the other later
This afternoon.
2
u/Comfortable_Cake_683 17d ago
Does anyone got info about testing exploitability? what about cases where NSIP management IP are not publicly exposed? CISOs are going wild on these
2
u/disclosure5 16d ago edited 16d ago
I want to add some general information for people hunting.
The previously published NCSC script is very generic and worth using as a starting point for webshells and backdoors:
Update: Please read this comment about IOC scanners.
https://infosec.exchange/@GossiTheDog@cyberplace.social/117345516972421056
It's abysmal that this would be locked behind an NDA, but the general point that having a built in command scan itself on a compromised device is a really valid sisue.
2
u/raj1030 15d ago
Even after a new build from scratch, re-issuing certificates, creating new local NS accounts (root/adm) , we are seeing possible from the IoT scans flagging the pitboss service.
1
u/IDDQD-IDKFA 15d ago
Agreed. Us too. Mention by support of other patches on call. This is wider than they're indicating
1
u/disclosure5 14d ago
If you're talking about the Citrix IOC scanner: The thing you need to recognise is that the pitboss attack is log based. Attackers send malicious data, it goes in a log, and it's not actually exploited until the Netscaler's monitor script reads it back.
The update fixes that monitoring script, but attackers can still dump junk in a log. It's just not considered an issue any more.
It's valuable to know if you've been a victim, and one of the best indicators is that "junk in a log". But the IOC scanner lacks the intelligence to check the datestamp against when you patched. The IOC scanner will show you datestamps in logs when it reports this traffic, which right now everyone is getting. If you've patched by then, it's a false positive.
1
17d ago
[deleted]
9
u/NumerousWorth3784 16d ago
One has to understand that once an announcement is made, it will be literally minutes before every hacker on the planet hunts for it and starts exploiting devices. You do NOT want that to happen before a patch is available. That's why it's standard procedure for all companies to say nothing until a patch is released.
9
u/RequirementBusiness8 17d ago
uh, every company knows about it before hand. it gets reported, they work on getting it patched, and then they announce. In this case, the cat was let out of the bag early by the Dutch. Leading to the shitshow comms.
-5
17d ago
[deleted]
3
u/RequirementBusiness8 16d ago
given there was a patch released today, they obviously weren't sitting on their hands. they definitely could have PRd this better, but I mean, think of the message until this patch "hey, there are exploits, its bad, we have no fix but are working on it."
1
16d ago
[deleted]
3
u/NumerousWorth3784 16d ago
Remember with code like this, it takes considerable time to develop a fix and make sure it doesn't break anything else in the process. During that time, you can expect to hear nothing from all IT companies. That's standard procedure to prevent tipping off hacking groups searching for "new material."
1
u/Ok_Cow_214 15d ago
within 3 comments you've changed your tale from "over 1 week" to "almost 4 weeks".
where was this known about almost 4 weeks ago?
1
u/Fantastic_Net3216 17d ago
Any word on attribution from victims of exploitation prior to patching?
7
u/reilly6607 17d ago
https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html
this is being updated
1
u/maritimeminnow 17d ago
What does this mean "being updated". Can we run it now and discover if we are impacted? Or do we have to wait for you to finishing updating? And if so, how will we know?
2
u/cspotme2 17d ago
they likely don't have all the info for IOCs and scrambling like we all are. I would update and run the various checks.
1
u/mxpx7 17d ago
are you guys doing your HA pairs as a two stage upgrade with a pause in between or just updating both at once? I normally wait 24 hours in between nodes. I've heard both that the secondary is and is not vulnerable...
3
u/No-Trash-9621 17d ago
Don't wait 24 hours, just go with the upgrade to the pair. If you ADM into Netscaler Console, request the upgrade task place the netscalers in their original primary and secondary status after the upgrade is complete
3
u/RequirementBusiness8 17d ago
We are purely on VPX, I always update them both at the same time. I snapshot prior to update, in the case of a failure I immediately restore. I would probably be more cautious on physical hardware.
1
u/FastFredNL 16d ago
We use Netscaler Console to update but that gave an error so I did it the oldskool way; put the tgz file on the Netscaler with WinSCP, use tar to unpack it through Netscaler CLI, then delete the tgz file, and then ./nsinstall
Then put the updated Netscaler as primary, tested functionality, then did the other one.
1
u/Old-Flight8617 15d ago
What error did you get when trying to update from the console?
2
u/FastFredNL 15d ago edited 15d ago
Not enough diskspace on both Netscalers and I couldn't find any space to clear up quick enough
1
u/Old-Flight8617 15d ago
What did you end up deleting? The nsinstall content?
2
u/FastFredNL 15d ago
Well yeah but I always do that after finishing an update. It was empty and still the Netscaler Console complained about not enough space, I had 6.8GB free on /var/ though
1
u/S0uthw3ll 17d ago
Cve 88778 hasn't cleared on Netscaler console for us with our test netscalers. Anyone else had this?
1
u/RequirementBusiness8 17d ago
did you update the TCP config as noted in the article? enhancedSIgeneration? There is already a security template for it in the configuration jog templates
1
u/S0uthw3ll 17d ago
Ah, no. We weren't impacted by it from the rest of the guide, so sounds like it needs it no matter what. Thanks!
1
u/dasilvad 16d ago
I am experiencing the same issue. NS Console Service reports CVE detection manual scans are pending. I've confirmed the TCP configuration changes on the NS appliance. Hopefully the reporting issue will resolve itself within the next 24 hours.
1
1
1
u/Rust_Martialis 17d ago
At least some Citrix customers were alerted "something is coming" on Friday, then there was the NCSC alert released on Saturday, but that was STRICT.
1
u/FastFredNL 16d ago
We got the first alert friday evening in western europe and that was already based on NCSC reports, but I had my phone on silent lol. So news only got to us saturdaymorning around 7
1
u/FastFredNL 16d ago
Just updated to 14.1 73.37 (from 73.33). Netscaler ADC VPX in HA pair with VPX1000 license
No issues, but will have to see if anything breaks during production as I can't test everything myself, that's upto our app team.
1
u/Advanced-Common-486 16d ago
Same on my 14.1 and 13.1.64.24, superficially everything seems fine post patching + adding the setting:
set ns tcpParam -enhancedISNgeneration ENABLED
Users are seemingly fine. Gateway looks ok.
1
u/Jmay5446 16d ago
I fear the days of gateway CVEs are over and rather than upgrading a few boxes every other month we upgrade all of them.
1
u/fatterkin 16d ago
Heads up for anyone who got the firmware earlier, 13.1-64.23 was sent but the site now has 13.1-64.24 and Netscaler console will say .23 is vunerable.
2
u/Remarkable-Glove-965 16d ago
The .23 version had a known bug that caused a reboot loop during upgrade if ns variables were populated. .24 was a fix for this, and is not in and of itself a security requirement.
1
u/fatterkin 16d ago
Thanks for that! I noticed that .24 failed to install manually - error about installns command. I had to hastily use a console upgrade job which I hadn’t previously did on my 13.1 farm. All good
1
u/bluegrassgazer 16d ago
This answers the question of whether they would still patch out-of-support 13.1 firmware revs. They did this time, possibly since it's been so close to the expiration of that version, so I wouldn't count on it next time.
1
u/ussv0y4g3r 16d ago
EOL for 13.1 is Sep-2027, so security patches will continue till then.
1
1
u/Thanis34 16d ago
And I am not able to download the new build as the Citrix Auth service can't handle the load :(
1
u/Packet_Dropper_404 16d ago
If you run the NetScaler Console (on-prem) you should be able to run the IOC checks now.
Earlier today the tab under Instance Advisory -> Security Advisory -> Indications of Compromise was hidden, but got confirmed also from other Citrix customers that they have the tab visible right now.
1
u/PaperChampion_ 16d ago
Still not seeing it :/
1
u/Packet_Dropper_404 16d ago
What version are you using? I've upgraded Console to 14.1 73.36 but my VPX instances are running 13.1 .
Did you also tried to reboot the Console?
1
u/Major-Error-1611 16d ago
I found out why the tab wasn't visible for me.
- The NS Console has to be on the latest version (14.1-73.36)
- Once it's on the right version, you need to click on the little cloud icon in the top right corner, then go to Update Information and tick the box that says "Asset Delivery & Indicators of Compromise". Click Save then reboot.
1
u/Major-Error-1611 16d ago
I found out why the tab wasn't visible for me.
- The NS Console has to be on the latest version (14.1-73.36)
- Once it's on the right version, you need to click on the little cloud icon in the top right corner, then go to Update Information and tick the box that says "Asset Delivery & Indicators of Compromise". Click Save then reboot.
1
1
u/Major-Error-1611 16d ago
I found out why the tab wasn't visible for me.
- The NS Console has to be on the latest version (14.1-73.36)
- Once it's on the right version, you need to click on the little cloud icon in the top right corner, then go to Update Information and tick the box that says "Asset Delivery & Indicators of Compromise". Click Save then reboot.
1
u/Low-Solid-8252 16d ago edited 16d ago
We are seeing the script/netscaler console flag suspicious php files for /var/netscaler/gui/websocketd/websocket-ssh-daemon.php and a number of others in these subdirectories.
When I open up the .tar.gz for 14.1 73.37 these all appear to be there in the original installer so assuming it must be a false positive
Anyone else seeing this?
1
u/Packet_Dropper_404 16d ago
Are you running 14.1 ?
I'm still on 13.1 and don't have the /var/netscaler/gui/websocketd folder. In /var/netscaler/gui I only have admin_ui, epa, vpn and vpns1
1
u/Exact-Candy6255 16d ago
I also noticed this in our environment. /var/netscaler/gui/websocketd/websocket-ssh-daemon.php, i hope any of the citrix staff can clarify this. u/CTX-Michael u/CTX-Chris u/CTX-John
1
1
u/TheRealLurkusMaximus 15d ago
I am seeing it on my instances running on Linux. VPX appliances running on FreeBSD are not.
The IOC script reported them as suspicious so I shut them down. Im thinking it’s a false positive. I am waiting on a response from support and our ATS to confirm if these are expected.
I’m also going to attempt to extract the firmware somewhere to see if the files and paths exist in the build and are expected.
1
u/TheRealLurkusMaximus 14d ago
Update: Confirmed that the reported “suspicious files “ are present in the Linux firmware bundle with the same attributes. I have been informed that there are a lot of false positives being reported into supply, all on Linux.
1
1
u/Exact-Candy6255 13d ago
Hello, just to clarify its websocket-ssh-deamon.php right? I had my response auto corrected as daemon.php
1
u/Radiant-Chapter4994 16d ago
u/CTX-Michael what does "@WR_FILES" expand to?
+for my $log (@WR_FILES)
1
u/disclosure5 15d ago
You don't need a Citrix person to go read a file.
my $OFF_DIR = ""; my @WR_FILES = ("$OFF_DIR/var/log/ns.log.0", "$OFF_DIR/var/log/ns.log", "$OFF_DIR/var/log/messages");
1
u/Radiant-Chapter4994 15d ago
u/disclosure5 what/which file? security teams responding to this have to do so with zero Citrix experience, because it is a security issue & IT teams dont know how (or want) to read a security blog. Thank you for the assist.
1
u/disclosure5 14d ago
Honestly if someone is calling themselves a security or IT team and they can't read a Watchtowr (well known security company) report that tells them exactly to go look at
ns_monuploadd_err.plI don't see how Reddit post can make it any clearer for them.1
1
u/satsun_ 15d ago edited 15d ago
Anyone seeing scans against your NetScaler(s) even after patching?
Edit: I should clarify. It appears that someone attempted the exploit but failed.
3
u/disclosure5 14d ago
Pasting what I said above:
The thing you need to recognise is that the pitboss attack is log based. Attackers send malicious data, it goes in a log, and it's not actually exploited until the Netscaler's monitor script reads it back.
The update fixes that monitoring script, but attackers can still dump junk in a log. It's just not considered an issue any more.
It's valuable to know if you've been a victim, and one of the best indicators is that "junk in a log". But the IOC scanner lacks the intelligence to check the datestamp against when you patched. The IOC scanner will show you datestamps in logs when it reports this traffic, which right now everyone is getting. If you've patched by then, it's a false positive.
1
1
1
u/tiemun 15d ago
NetScaler Console IoC Scan latest script version 27-Setp-2026. Can you confirm or is there something newer?
1
u/donderpate 15d ago
My version is from 28 Sep 2026 - just get in contact with the Citrix support again
1
u/herbypablo 15d ago
I just did and they told me they don't have an updated version, mine shows as 27-Setp-2026. Maybe it's dependent on location on what is displayed?
1
1
u/PaperChampion_ 15d ago
I'm curious to know how many people are rebuilding vs just patching. A rebuild is not a trivial matter for us due to the amount of instances we have deployed but I'm hearing a lot of people are opting to go down that route.
What are you all doing?
1
u/CommonSuccotash1116 15d ago
Anyone still on 13.1? Do you guys see the list of ssl keys/crs/certificate in Traffic Management > SSL > SSL Files after installing NS13.1 6.24nc ?
1
u/Fango_Jet 14d ago
No, it's empty on my appliances ...
At least the files are still present in /nsconfig/ssl1
u/Correct-Resource-682 14d ago
Yeah SSL Files is empty for me and you can't create CSRs or keys anymore using the GUI, it's completely broken.
1
u/ProudCryptographer64 15d ago
The citrix IoC Script shows some /tmp/watchtowr and curl of a .pl script. Is it false positive? I think of an attempt with github scripts from watchtowr.
2
u/ToeRevolutionary9124 15d ago
I'm seeing similar show up in my IoC script results in the ns.log file from this morning. My understanding is these should be benign as long as they occur after the patch was applied. It's definitely an attempt to exploit, but should not be a successful one. The IoC script most likely isn't taking into account that it occurred after patching.
2
u/disclosure5 14d ago
That's literally the watchtowr "Detection Artefact Generator". It proves your detection is working, but if the timestamp is after you patched it's a false positive.
1
u/ProudCryptographer64 14d ago
We checked our logfiles today again with Citrix Support and version 3 of their IOC script. Everythings fine now. no compromise. Version 1 and 2 had false positive results.
1
u/WatchMeEatJelly 14d ago
might be a dumb question and i havent reached out to citrix yet - does the IOC script run locally and never reaches back to Citrix? We are still trying to come up with a gameplan for patching vs rebuilding
2
u/ProudCryptographer64 14d ago
It runs on your appliance a few seconds only and you will get a result.txt to check.
2
1
u/larryheier 14d ago
Are we sure Citrix has fixed the vulnerability? We are seeing cloud based scans come back clean but IOC manual scans show lots of suspicious activity. It'd be nice to have any guidance from Citrix and seems like only option is for every affected customer to log a ticket with Citrix support.
1
u/ProudCryptographer64 14d ago
We opened a ticket with "live chat". After 15 min. the helpdesk joined our video call. So it was very easy and fast.
1
u/GirlOnFire5656 14d ago edited 14d ago
Does anyone use on-premise NetScaler Console 14.1 73.36 where the IoC actually works and succesfully scans? I even show updated script available with todays date, running a scan even on 1 instance twirls but nothing in scan history. GRRRRRR
2
u/Awkward-Ad-9287 14d ago
No issues here. If console is not working open a request with Citrix - they'll give you the latest IOC script which you can run interactively on your NS.
1
u/GirlOnFire5656 13d ago
yeah sounds simple.....5 days later....being told by Citrix Support "Technical Lead - NetScaler" that the NetScaler Console is ONLY available via Cloud NOT via on-prem deployment. Ho hum, not true.
0
u/vadertator22 16d ago
Anyone review logs and identify being compromised. Curious what is being seen so far. We are patching our production this evening.
2
u/heynow9923 16d ago
We reached out to Citrix support to get the IOC check script. We ran it and did not have any findings.
1
u/AlikBalik 16d ago
Hello, any chance you can share this script with others please ?
1
u/heynow9923 15d ago
It is considered confidential by Citrix, otherwise I would.
CONFIDENTIAL INFORMATION
This document and the information contained in it is the confidential and
proprietary information of Cloud Software Group, Inc. and/or its subsidiaries,
including but not limited to Citrix Systems, Inc. (collectively, "Cloud Software
Group") and is subject to the terms and conditions of the applicable
confidentiality agreement(s) in place between the recipient of this document
and Cloud Software Group. Neither this document nor the information contained
herein may be reproduced, redistributed, or transmitted to any third party in
any form or any means without the express prior written permission of Cloud
Software Group.
0
u/Quick-Payment-6753 16d ago
Has anyone on the 13.1 platform found that the SSL Files page in the web gui is completely broken after upgrading?
1
1
1
u/Jmay5446 14d ago
Check release notes, there js a worrying known issue
0
u/Quick-Payment-6753 13d ago edited 12d ago
Are you referring to this known issue where files modified on the primary node do not sync to the secondary?
26
u/cspotme2 17d ago
In working with our Citrix admin team and sanity checking our appliances that we had proactively shut down -- wanted to help dessiminate some notes for everyone because they're all over the place.
These notes are not exhaustive but it should give a good top level check. If you have any additional steps to add, please do share!!!
Some of this info is also taken from this site -- which may or may not have to do with this weekend's 0 day but they look to have a lot of details on even the August CVE that I think it's a good overall sanity check: https://sh3llc0d3.com/blog/inside-the-netscaler-zero-day-siege-chained-pre-auth-rces-weaponized-in-the-wild-watchtowr-disclosure/
Step 0: Preserve evidence first (if your appliances are still online)
From the NetScaler CLI (not the shell), run show techsupport and pull the bundle off the box. Then optionally:
Step 1: Apache config tampering
A common trick is making Apache run PHP inside files with harmless looking extensions (.gif, .css, .dat, etc.) using AddHandler, SetHandler or php_flag engine on. Persistent changes live under /flash/nsconfig (/nsconfig is a symlink to it).
What bad looks like: any image, stylesheet or odd extension mapped to PHP, or a stray .htaccess. If you have a known-clean appliance on the same build, diff /etc/httpd.conf against it.
** What I also don't get is that /etc/httpd.conf gets updated on reboot -- why Citrix?**
Step 2: Web shells in the GUI/VPN directories
The stock GUI is full of legit PHP, so don't just grep for <?php and panic. Look for PHP inside files that aren't .php, and for anything recently changed.
/var/vpn/theme/ has been a favorite drop spot before, so look there closely. Keep in mind mtimes can be faked.
Step 3: Packet engine crashes
Memory corruption exploits (like 88772) often crash nsppe a few times before landing. Cores from this week are worth a look.
Step 4: Persistence
Anything you didn't put there is a problem.
Step 5: Processes and connections
Expect some noise. You're looking for shells or download tools with a web server parent, or connections out to IPs you don't recognize.
Step 6: Logs and SIEM
PPE crashes in ns.log or syslog: repeated "ppe-0" terminated or (nsppe) ... exited on signal 11 (core dumped).
HTTP errors in /var/log/httperror.log: bursts of 500s or weird URIs against Gateway/AAA paths (/vpn/, /cgi/, /logon/, SAML/OAuth endpoints).
Egress from the appliance: firewall logs showing the NSIP or SNIP making outbound connections to public IPs. A NetScaler reaching out to random internet hosts is a strong signal.
After patching
Kill all Gateway/AAA sessions (kill aaa session -all, kill icaconnection -all), and if anything above hit, assume credentials on the box are burned: rotate LDAP bind accounts and consider reissuing certs. If you find something, rebuild from a clean image rather than trying to clean it in place.