Citrix NetScaler zero-days exploited pre-patch
Two unauthenticated RCE flaws in Citrix NetScaler ADC/Gateway are being actively exploited in the wild, CERT-FR warns.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-88771 and CVE-2026-88772 as exploited in the wild.
CERT-FR issued an alert on a Citrix security bulletin (CTX697096) covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them, CVE-2026-88771 and CVE-2026-88772, allow an unauthenticated remote attacker to execute arbitrary code, and Citrix confirms these have been actively exploited in the wild, with exploitation beginning before patches were available. Citrix states that any unpatched device running in its default configuration is vulnerable.
Affected versions include NetScaler ADC 13.1-FIPS prior to 13.1-NDcPP 13.1.37.279, ADC/Gateway 13.1.x prior to 13.1-64.23, ADC 14.1-FIPS prior to 14.1-73.37 FIPS, and ADC/Gateway 14.1.x prior to 14.1-73.37. Given the pre-patch exploitation and unauthenticated RCE impact, this represents an urgent, actively exploited zero-day scenario affecting widely deployed edge/VPN gateway appliances.
Citrix has made indicators of compromise available to customers via the NetScaler console. Defenders should immediately apply the vendor-provided patches referenced in CTX697096, review IOCs distributed via the NetScaler management console, and check for signs of compromise on internet-facing NetScaler ADC/Gateway instances, given active exploitation predating fix availability.
Mentioned in this report
Detection guidance
Citrix NetScaler Unexpected Child Process Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects shell or command interpreter spawned as a child of NetScaler system processes, indicating post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Citrix NetScaler Unexpected Child Process Execution
description: Detects shell interpreters or command execution tools spawned as child
processes of NetScaler daemon processes (nsmgr, nsppe, nsics, nsworker). This behaviour
is indicative of successful pre-authentication RCE exploitation where the attacker
executes arbitrary commands within the appliance context.
tags:
- attack.execution
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_netscaler_parents:
ParentImage|contains:
- nsmgr
- nsppe
- nsics
- nsworker
- nsd
selection_shell_children:
Image|endswith:
- /bin/sh
- /bin/bash
- /usr/bin/perl
- /usr/bin/python
condition: selection_netscaler_parents and selection_shell_children
falsepositives:
- Legitimate NetScaler diagnostic or maintenance scripts executed by authorized administrators
- Citrix automation tools provisioning or updating the appliance
level: critical
id: cae212a2-af9e-5c2f-8e07-55de0bb593f6
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011
Citrix NetScaler Unauthorized File Write to System Directories
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unexpected file creation or modification in NetScaler system directories by non-admin processes, suggesting post-exploitation persistence or payload staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Citrix NetScaler Unauthorized File Write to System Directories
description: Detects file creation or write operations in critical NetScaler system
directories (var/netscaler, etc/netscaler, flash/) by processes that should not
have write access, typical of post-exploitation persistence or payload staging after
CVE-2026-88771/CVE-2026-88772 exploitation.
tags:
- attack.persistence
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection_system_paths:
TargetFilename|startswith:
- /var/netscaler/
- /etc/netscaler/
- /flash/
- /netscaler/
selection_suspicious_extensions:
TargetFilename|endswith:
- .sh
- .pl
- .py
- .elf
- .so
filter_admin_processes:
Image|contains:
- nsadmin
- /nsinstall
condition: (selection_system_paths and selection_suspicious_extensions) and not
filter_admin_processes
falsepositives:
- NetScaler update and patching processes writing legitimate scripts to system directories
- Authorized configuration management tools updating appliance settings
level: high
id: 8477a7f4-9cb4-5a83-bb8c-5ae0fa663363
status: experimental
author: Vorant
references:
- https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs