5SEP

Citrix replaces its own NetScaler fix

3 min read

12:09UTC

Citrix shipped NetScaler builds for two exploited flaws on 27 September, then replaced them a week later after a third exploited flaw surfaced.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyAssessed

Key takeaway

Citrix's September NetScaler builds were superseded within a week by fixes for a third exploited flaw.

Citrix disclosed on 27 September that two flaws in NetScaler ADC and NetScaler Gateway had been exploited before any fix existed⁠¹. Many companies put these appliances at the edge of their network so staff can log in remotely. CISA, the US agency that keeps the federal catalogue of exploited flaws, listed CVE-2026-88771 and CVE-2026-88772 as exploited that day and gave federal agencies until 30 September. CVE-2026-88771 scores 9.5 and allows unauthenticated command execution on an appliance left in its default configuration.

Rapid7 saw the first attempt on 20 September, seven days before disclosure. The payload copied /flash/nsconfig to a publicly readable web path. That file holds encrypted administrator passwords, the appliance's TLS private keys, and the bind passwords NetScaler uses to log in to directory servers running Lightweight Directory Access Protocol (LDAP) and Remote Authentication Dial-In User Service (RADIUS). A second Rapid7 customer had a web shell, a hidden page giving the attacker remote control, planted on 24 September.

On 4 October Citrix disclosed CVE-2026-88779, a memory overflow on appliances set up for Security Assertion Markup Language (SAML) single sign-on, also exploited before disclosure. Builds 14.1-73.41 and 13.1-64.28 replace those shipped on 27 September⁠², so an administrator who patched promptly had to patch again. The UK's cyber agency, the National Cyber Security Centre (NCSC), had told UK organisations on 28 September to mitigate the first pair⁠³.

NetScaler now has five entries on CISA's exploited-flaw catalogue between 26 August and 4 October⁠⁴. The first, CVE-2026-8452, was the flaw Japan's JPCERT/CC warned about on 15 August while reporting no sign of attacks. Anyone who took the nsconfig file still holds what was in it, so Teams exposed from 20 September need to change the LDAP and RADIUS account passwords and replace the certificates.

Deep Analysis

In plain English

Citrix makes NetScaler, a box that sits at the edge of a company's network and lets staff log in from home. Attackers found flaws in it and used them before Citrix had a fix. In some attacks they copied a settings file that holds passwords the box uses to check staff logins, plus digital keys that prove the company's websites are genuine. Installing an update stops the next break-in, but anything already copied stays in the attackers' hands until the company changes those passwords and keys. Citrix then found a third flaw and released new versions a week after the first fix.

Deep Analysis

Root Causes

A remote-access gateway has to authenticate users against the corporate directory, so it stores service-account passwords for LDAP and RADIUS in its own configuration. Any flaw that reads that file turns an edge-device bug into a directory compromise.

The September flaws sit in memory handling for DTLS and SAML, the same class of defect behind March's SAML overread . Citrix shipped nine CVEs in one bulletin on 27 September, and the 4 October builds superseded that batch, a sign the first release went out under exploitation pressure.

What could happen next?

Risk
Organisations that patched but did not rotate LDAP and RADIUS bind credentials may still give attackers a valid route into the directory.
Consequence
A fix superseded inside a fortnight teaches administrators to wait for the second build, which lengthens exposure the next time a NetScaler zero-day lands.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In April 2020 CISA alert AA20-107A found attackers logging in to networks with credentials harvested through Pulse Secure flaw CVE-2019-11510 months earlier, after victims had patched. The fix closed the hole; the stolen passwords kept working until someone changed them.

Counter-parallel: For CitrixBleed (CVE-2023-4966) in October 2023, Citrix told customers to kill every active session after patching, a revocation step that limited reuse where it was followed. LockBit affiliates still reached Boeing and the US arm of ICBC through appliances where it was not.

The direct cost lands on identity Teams rather than network Teams. Reissuing TLS certificates and rotating directory service accounts usually needs a change window, coordination with every application that uses the same accounts, and a fresh certificate purchase where a public authority signed the originals.

Organisations that patched after 27 September and again after 4 October paid for two emergency changes on the same estate.

Consensus view: Rapid7's emergency response team treats the copied nsconfig file as the lasting damage: it holds the bind credentials NetScaler uses to query Active Directory, plus the private keys behind the appliance's certificates. On that reading the incident is a credential and certificate replacement job across the directory, not a firmware update.

Counter-view: Citrix's bulletins CTX697096 and CTX697174 frame remediation as upgrading and running its indicators of compromise, with no instruction to rotate bind passwords or reissue certificates. Japan's JPCERT/CC took a similarly vendor-led line in August, reporting no sign of exploitation of the earlier NetScaler flaw before CISA listed it.

Key tension: Whether an attacker can decrypt a stolen nsconfig offline, which decides if every exposed appliance's directory accounts must be treated as burned.

Sources:CISA·Rapid7·NCSC

Mentions:Citrix →NetScaler ADC →Rapid7 →NCSC →CISA →JPCERT/CC →Known Exploited Vulnerabilities →ICBC →Boeing →Security Assertion Markup Language →Japan →LockBit5 →United Kingdom →CVE-2026-88771 →CVE-2026-88772 →Pulse Secure →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

JPCERT alerts on NetScaler after watchTowr proof

JPCERT/CC's August NetScaler alert was followed by three more exploited NetScaler flaws in September and October.

Occurred 15 Aug 2026

Read story →

This Event

Citrix replaces its own NetScaler fix

Patching a NetScaler appliance stops the next theft but leaves stolen passwords and keys in attackers' hands.

Led to

UTA0576 hit Ivanti VPNs before a fix

UTA0576 took Ivanti directory bind passwords the way the September NetScaler attacks did.

Occurred 13 Oct 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.