Three actively exploited NetScaler zero-days in eleven days. The first two, disclosed September 27, were unauthenticated remote code execution. The third, disclosed October 4, was "only" a denial-of-service — and it is the one this article is about, because Citrix told researchers it has observed targeted attacks chaining it with the first RCE on unmitigated systems. A crash that knocks VPN and single sign-on offline is not a minor bug when it arrives in the same window as an RCE. It is a smokescreen, a availability weapon, and — if you are watching for it — a detection signal.
The pattern here should be familiar by now. Part 1 of this series (Ivanti) and Part 2 (Fortinet) both ended at the same place: the patch is necessary and insufficient. NetScaler adds a third variation on the theme: the thing you patch last, because it looks least severe, is the thing that tells you where to hunt.
The three CVEs, in order
CVE-2026-88771 (September 27): unauthenticated RCE from improper input validation (CWE-20), CVSS 9.5 vendor / 9.8 NVD. No special configuration needed — every deployment was exposed. CVE-2026-88772 (September 27): RCE or denial-of-service from a memory flaw (CWE-119) in Gateway VPN configurations using DTLS, which is on by default. Both were fixed in 14.1-73.37 and 13.1-64.23 and later, and both were already running in production — one of them for roughly a month — before any patch existed.
CVE-2026-88779 (October 4, bulletin CTX697174): an unauthenticated memory overflow (CWE-119) in appliances configured as a SAML service provider or SAML identity provider, CVSS 4.0 score 8.7. A crafted SAML authentication request crashes the authentication service, and repeated crashes can reboot the whole appliance — knocking VPN and SSO access offline organization-wide. CISA added it to the Known Exploited Vulnerabilities catalog the same day, with a three-day federal remediation deadline of October 7. Fixed in 14.1-73.41 and 13.1-64.28 (FIPS 14.1-73.41, NDcPP 13.1-37.282); those builds were themselves superseded later in October by 14.1-73.46 and 13.1-64.29. Patch to the newest build, not the first fixed one — the October wave rewarded teams that stopped at the first patch with a second disclosure days later.
Two honest caveats. First, the classification is contested: Citrix calls 88779 a denial-of-service, while Norway's NSM has raised the possibility of remote code execution. Treat it as a DoS with an open question, not a settled RCE — but note that the distinction matters less than it looks, because Citrix has confirmed the chaining with 88771, an RCE, on real targets. Second, no named threat actor has been publicly attributed to the 2026 NetScaler wave as of this writing. The tradecraft below is drawn from observed post-exploitation behavior across this wave, not from a single actor profile.
Why the crash matters more than the score
A denial-of-service on an authentication gateway is not a nuisance finding. SAML SP/IdP configurations sit in front of VPN and SSO for the whole organization; a crash loop there is an outage with a security cause, and outages do two things defenders should care about. They create pressure to roll back, disable, or work around the control that is crashing — and they flood the timeline with noise that buries the quieter compromise happening beside them. If you only investigated 88779 as an availability incident, you investigated half of it.
There is also the lineage. NetScaler has been here before, twice, and both times the lesson was the same. The original CitrixBleed (CVE-2023-4966, October 2023) was a memory over-read that let attackers steal valid session tokens and hijack authenticated sessions, bypassing passwords and MFA — exploited by LockBit affiliates and others. CitrixBleed 2 (CVE-2025-5777, June 2025, CVSS 9.3, KEV-listed July 10) repeated the trick against session tokens rather than cookies, with ReliaQuest observing exploitation for initial access and sessions reused across multiple IPs, including hosting-provider ranges. The through-line: on NetScaler, the session is the target, and a stolen session survives patching. Citrix's own guidance for both Bleed flaws says it plainly — after patching, terminate all active and persistent sessions, because stolen tokens stay valid until the sessions are killed. Any NetScaler hunt that ends at the patch is unfinished by definition.
For scale: the /news/ exposure tracker currently counts hundreds of thousands of internet-visible NetScaler hosts. The September RCEs needed no configuration to be reachable. Assume your appliance was in scope unless you can prove otherwise.
The hunt: four checks worth running this week
Hypothesis: if a NetScaler appliance was hit during the September–October wave, you will find one of: a crash/reboot pattern in the SAML window, a web shell or persistence artifact in a web-served directory, a session reused from an unexpected source, or an appliance still below the newest fixed build — before downstream lateral movement or ransomware impact.
Hunt 1 — The crash loop is a detection, not just an outage (Splunk)
The exploit itself leaves little in logs. The crash does not. Scope to September 1 onward, and look for repeated authentication-service crashes or appliance reboots clustered in time — the signature of 88779 being worked, or of an availability attack masking something else.
index=netscaler (sourcetype=netscaler:syslog OR host=ns-*)
| rex field=_raw "reboot|crash|restart"
| bucket _time span=1h
| stats count AS crash_events, dc(host) AS hosts by _time
| where crash_events >= 3
| sort - crash_events
Three or more crash/restart events in an hour on a SAML-configured appliance is your triage trigger, not your conclusion. Correlate each cluster against change records: an unplanned cluster during the September 27 – October 7 window, on an appliance that was unpatched at the time, goes to the top of the queue. And check the inverse too — a SAML virtual server that went quiet (no auth events at all) during a period when users were active may be a crashed service nobody noticed, not a quiet day.
Hunt 2 — Web shells and persistence in web-served directories
Across this wave, the consistent post-exploitation tradecraft has been web shell deployment into directories the appliance itself serves, plus rogue cron entries, modified rc files, and binaries masquerading as legitimate NetScaler processes. The paths that recur in reporting: /netscaler/portal/, /var/vpn/, /var/ns_gui/, and theme and customization directories — locations that survive reboots and some upgrades.
# Run on the appliance (or against a filesystem image) — flag files outside change windows
find /netscaler/portal /var/vpn /var/ns_gui -type f -newermt "2026-09-01" ! -newermt "2026-10-28" \
-exec ls -la {} \; | sort -k6,7
# Cross-check against your change log: anything here without a ticket is suspect.
# Also sweep cron and rc files for entries added in the same window:
grep -R "curl\|wget\|nc \|/bin/sh" /etc/crontab /etc/rc* /var/cron/ 2>/dev/null
A web shell on an edge appliance is not a low finding. It is persistence on the box that terminates your VPN — treat it as a compromise of the sessions behind it, not as a single-file cleanup.
Hunt 3 — Session reuse: the CitrixBleed test (KQL)
This is the hunt that catches the compromise patching misses. A stolen session token reused from a new source IP, an impossible-travel login, or a gateway session originating from a hosting or consumer-VPN range are all observable in AAA logs if you collect them.
// NetScaler AAA: same session, new source — or session from hosting/VPN ranges
NetScalerAAA
| where TimeGenerated > ago(60d)
| summarize Sources = make_set(SourceIP), Logins = count() by SessionId, UserPrincipalName
| where array_length(Sources) > 1
| extend Flag = "session reused across IPs — compare against user's normal ASN and geography"
| project UserPrincipalName, SessionId, Sources, Logins, Flag
One refinement from the CitrixBleed 2 reporting: look specifically for sessions that appear from both an expected corporate IP and an unexpected one, and for authentication granted without user knowledge — the MFA-bypass signature. If you find a reused session, kill it and every session for that user, then work backward to the appliance and the window, not forward to the next alert.
Hunt 4 — The version inventory, done properly
List every NetScaler ADC and Gateway appliance, including Secure Private Access hybrid instances (their NetScaler instances need upgrading too), and flag anything below 14.1-73.46 / 13.1-64.29 — the newest fixed builds, not the first ones. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are upgraded by the vendor; customer-managed appliances are yours. Two traps: an appliance patched to 14.1-73.37 in late September was fixed for the RCEs and still vulnerable to 88779 until the October build, and a FIPS or NDcPP build has its own fixed line (14.1-73.41 FIPS, 13.1-37.282) — check the variant, not just the version family. And never expose the management interface to the internet; segment and restrict it regardless of patch state.
Defensive takeaways
- Patch to the newest fixed build, then kill every session. The patch closes the vulnerability; only session termination evicts a token thief. Do both in the same change window, in that order, and verify the kill — a session that survives is a finding, not a leftover.
- Treat the DoS as a hunt trigger. A crash loop on a SAML virtual server during the September–October window is not closed as an availability ticket until it has been correlated against the RCE window and the session-reuse hunt.
- Collect appliance telemetry centrally before you need it. The exploit is hard to detect in logs; the post-exploitation behavior — web shell writes,
nshttpdspawning shells, anomalous NITRO API configuration calls from non-admin sources, hijacked-token authentication — is observable only if syslog and AAA logs actually leave the appliance. An edge box whose logs live only on itself is a blind spot with a VPN attached. - Assume the chain, not the single CVE. The 2026 wave was three disclosures in eleven days, one of them already chained in the wild. Scope every NetScaler incident to all three CVEs and to the Bleed lineage, not to the CVE in the ticket title.
The edge-appliance story of 2026 is not that vendors keep shipping memory bugs. It is that the same boxes keep getting hit in waves, that the "minor" disclosure in each wave is the one that tells you where the real compromise is, and that patching without hunting leaves the intruder inside with a valid session. Patch the box, kill the sessions, hunt the crash.
Further reading
- Three actively-exploited NetScaler zero-days in eleven days, with the chaining detail and fixed-build table
- Detection and remediation guide for the third flaw, including the post-exploitation tradecraft sequence
- CitrixBleed 2 under active attack — session-token theft, MFA bypass, and the kill-sessions guidance
- CitrixBleed 2 exploitation detail, including session reuse across IPs and AD reconnaissance
