Citrix published two NetScaler bulletins in one week. CTX697096, on 27 September 2026, fixed eight flaws in NetScaler ADC and NetScaler Gateway. Two are rated 9.5 on CVSS v4: CVE-2026-88771, unauthenticated remote code execution in the default configuration, and CVE-2026-88772, a memory overflow that needs DTLS, which is on by default for VPN virtual servers. Citrix says exploits of both "on unmitigated NetScaler deployments have been observed." CTX697174 followed on 3 October with CVE-2026-88779 (CVSS v4 8.7), a denial of service in SAML processing. CISA added the first two to its Known Exploited Vulnerabilities catalog on 27 September and the third on 4 October, according to CISA's KEV data feed.
Most coverage stops at "patch now". The part that matters after the patch is in Rapid7's analysis: in one of the two compromises it investigated, the attacker made the appliance pack its own configuration into a file that anyone could download.
Which build to install
The 3 October builds include the September fixes, so go straight to them. Per CTX697174:
| Branch | Fixed build or later |
|---|---|
| 14.1 | 14.1-73.41 |
| 13.1 | 13.1-64.28 |
| 14.1 FIPS | 14.1-73.41 FIPS |
| 13.1 FIPS and NDcPP | 13.1-37.282 |
CVE-2026-88779 only applies when the appliance acts as a SAML service provider or identity provider. Citrix suggests searching the configuration for add authentication samlAction or add authentication samlIdPProfile. Take the newer build even if neither shows up, because it also carries the 88771 and 88772 fixes. Customer-managed NetScaler instances in Secure Private Access hybrid deployments need the same upgrade. Citrix-managed cloud services do not.
What the attacker packed up
Rapid7 saw the first exploitation attempt on 20 September 2026 at 14:28 UTC, a week before the bulletin. In the first compromise the payload ran tar over /flash/nsconfig and wrote the archive to /var/netscaler/gui/vpn/c, which Rapid7 says was reachable at https://<gateway>/vpn/c with no login. At the second organisation it found a webshell, seen on 24 September, at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.
According to Rapid7 that archive holds ns.conf with the encrypted passwords of nsroot and other admin accounts, the bind passwords for LDAP, RADIUS and TACACS, the ssl/ folder with certificates and private keys, SSH host keys, and HA sync settings. Rapid7 does not say the archive was downloaded. It does not have to. If that file sat at a public URL on your gateway, you cannot prove nobody fetched it.
Patching does not un-leak a config file
The upgrade closes the hole. It does nothing about a bind password that is already on someone else's disk. If your gateway ran an affected build and faced the internet at any point between 20 September and the day you patched, treat its secrets as exposed. Citrix's own steps for a suspected compromise (CTX694799) list what to change. The order below follows them:
- Look for the two files above first. If
/var/netscaler/gui/vpn/cor.ctxs.receiverexists, you are handling an incident, not a maintenance window. Follow CTX694799 in full, including the rebuild from a known-good backup. - Change the service accounts NetScaler binds with on the systems that own them: the LDAP bind account, RADIUS shared secrets, TACACS keys, and any OAuth tokens, API keys and SNMP community strings.
- Revoke and reissue every certificate whose private key lived on the appliance, starting with the public gateway certificate.
- Change every local NetScaler password, nsroot first. If you restored from a backup, rotate the key encryption keys too, as CTX694799 says.
- Reset the users who signed in through the Gateway or AAA virtual servers during the exposure window, and end the sessions that are still open.
The LDAP bind account is the one people forget. It often has read access to the whole directory, and nobody remembers which other systems share it. Rotating it will break something, so list those systems before you change the password rather than after the phone starts ringing.
We made the same point about helpdesks after the Zammad zero-days at DIVD: an edge system that stores integration secrets is a key ring, and fixing the bug does not get the keys back. Stolen sessions work the same way at the user level, which is why the AiTM phishing figures in Microsoft's Digital Defense Report are worth reading next to this.
If you run gateways for other teams
Managed service providers, and central IT teams that run gateways for several business units, can sort the work with one question per appliance: which build was it on, and on what date did it move? That date, set against 20 September, decides whether you have a patch job or a rotation job. If you want a second pair of hands for the rotation, or for moving secrets out of appliance configs and into a vault, our infrastructure team does that work.
FAQ
Which NetScaler builds fix all three exploited CVEs?
14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, and 13.1-37.282 for 13.1 FIPS and NDcPP, or later. These come from CTX697174 and include the CTX697096 fixes.
Is upgrading enough?
Only if the appliance was never exposed on an affected build. Rapid7 saw exploitation from 20 September and an attacker archiving the whole configuration, including bind passwords and private keys, so an exposed appliance also needs its secrets rotated.
What was in the archived nsconfig directory?
Per Rapid7: ns.conf with encrypted admin passwords and LDAP, RADIUS and TACACS bind passwords, certificates and private keys, SSH host keys and HA settings.
We don't use SAML. Do we still need the October build?
CVE-2026-88779 only affects appliances configured as a SAML SP or IdP. The October build also contains the September fixes, though, so it is the simplest single target for every appliance.
