12OCT

Citrix replaces its own NetScaler fix

3 min read

10:55UTC

Citrix shipped NetScaler builds for two exploited flaws on 27 September, then replaced them a week later after a third exploited flaw surfaced.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

Citrix's September NetScaler builds were superseded within a week by fixes for a third exploited flaw.

Citrix disclosed on 27 September that two flaws in NetScaler ADC and NetScaler Gateway had been exploited before any fix existed⁠¹. Many companies put these appliances at the edge of their network so staff can log in remotely. CISA, the US agency that keeps the federal catalogue of exploited flaws, listed CVE-2026-88771 and CVE-2026-88772 as exploited that day and gave federal agencies until 30 September. CVE-2026-88771 scores 9.5 and allows unauthenticated command execution on an appliance left in its default configuration.

Rapid7 saw the first attempt on 20 September, seven days before disclosure. The payload copied /flash/nsconfig to a publicly readable web path. That file holds encrypted administrator passwords, the appliance's TLS private keys, and the bind passwords NetScaler uses to log in to directory servers running Lightweight Directory Access Protocol (LDAP) and Remote Authentication Dial-In User Service (RADIUS). A second Rapid7 customer had a web shell, a hidden page giving the attacker remote control, planted on 24 September.

On 4 October Citrix disclosed CVE-2026-88779, a memory overflow on appliances set up for Security Assertion Markup Language (SAML) single sign-on, also exploited before disclosure. Builds 14.1-73.41 and 13.1-64.28 replace those shipped on 27 September⁠², so an administrator who patched promptly had to patch again. The UK's cyber agency, the National Cyber Security Centre (NCSC), had told UK organisations on 28 September to mitigate the first pair⁠³.

NetScaler now has five entries on CISA's exploited-flaw catalogue between 26 August and 4 October⁠⁴. The first, CVE-2026-8452, was the flaw Japan's JPCERT/CC warned about on 15 August while reporting no sign of attacks. Anyone who took the nsconfig file still holds what was in it, so Teams exposed from 20 September need to change the LDAP and RADIUS account passwords and replace the certificates.

Deep Analysis

In plain English

Citrix makes NetScaler, a box that sits at the edge of a company's network and lets staff log in from home. Attackers found flaws in it and used them before Citrix had a fix. In some attacks they copied a settings file that holds passwords the box uses to check staff logins, plus digital keys that prove the company's websites are genuine. Installing an update stops the next break-in, but anything already copied stays in the attackers' hands until the company changes those passwords and keys. Citrix then found a third flaw and released new versions a week after the first fix.

Deep Analysis

Root Causes

A remote-access gateway has to authenticate users against the corporate directory, so it stores service-account passwords for LDAP and RADIUS in its own configuration. Any flaw that reads that file turns an edge-device bug into a directory compromise.

The September flaws sit in memory handling for DTLS and SAML, the same class of defect behind March's SAML overread . Citrix shipped nine CVEs in one bulletin on 27 September, and the 4 October builds superseded that batch, a sign the first release went out under exploitation pressure.

What could happen next?

Risk
Organisations that patched but did not rotate LDAP and RADIUS bind credentials may still give attackers a valid route into the directory.
Consequence
A fix superseded inside a fortnight teaches administrators to wait for the second build, which lengthens exposure the next time a NetScaler zero-day lands.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In April 2020 CISA alert AA20-107A found attackers logging in to networks with credentials harvested through Pulse Secure flaw CVE-2019-11510 months earlier, after victims had patched. The fix closed the hole; the stolen passwords kept working until someone changed them.

Counter-parallel: For CitrixBleed (CVE-2023-4966) in October 2023, Citrix told customers to kill every active session after patching, a revocation step that limited reuse where it was followed. LockBit affiliates still reached Boeing and the US arm of ICBC through appliances where it was not.

The direct cost lands on identity Teams rather than network Teams. Reissuing TLS certificates and rotating directory service accounts usually needs a change window, coordination with every application that uses the same accounts, and a fresh certificate purchase where a public authority signed the originals.

Organisations that patched after 27 September and again after 4 October paid for two emergency changes on the same estate.

Consensus view: Rapid7's emergency response team treats the copied nsconfig file as the lasting damage: it holds the bind credentials NetScaler uses to query Active Directory, plus the private keys behind the appliance's certificates. On that reading the incident is a credential and certificate replacement job across the directory, not a firmware update.

Counter-view: Citrix's bulletins CTX697096 and CTX697174 frame remediation as upgrading and running its indicators of compromise, with no instruction to rotate bind passwords or reissue certificates. Japan's JPCERT/CC took a similarly vendor-led line in August, reporting no sign of exploitation of the earlier NetScaler flaw before CISA listed it.

Key tension: Whether an attacker can decrypt a stolen nsconfig offline, which decides if every exposed appliance's directory accounts must be treated as burned.

Sources:CISA·Rapid7·NCSC

Mentions:Citrix →NetScaler ADC →Rapid7 →NCSC →CISA →JPCERT/CC →Known Exploited Vulnerabilities →ICBC →Boeing →Security Assertion Markup Language →Japan →LockBit5 →United Kingdom →CVE-2026-88771 →CVE-2026-88772 →Pulse Secure →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

JPCERT alerts on NetScaler after watchTowr proof

JPCERT/CC's August NetScaler alert was followed by three more exploited NetScaler flaws in September and October.

Occurred 15 Aug 2026

Read story →

This Event

Citrix replaces its own NetScaler fix

Patching a NetScaler appliance stops the next theft but leaves stolen passwords and keys in attackers' hands.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.