Citrix shipped patches for ten NetScaler flaws three weeks ago. Attackers had already been inside for a month.
On September 27, Citrix published a security bulletin covering ten vulnerabilities in NetScaler ADC and NetScaler Gateway, the appliances that sit in front of internal networks and terminate VPN traffic. Two of them, CVE-2026-88771 and CVE-2026-88772, allow remote code execution on their own. By that point, eSentire's Threat Response Unit had been watching them get used since the start of September.
"They were exploiting it weeks before anyone outside Citrix knew the bug existed," the TRU wrote in an October 6 post on its hunt. The team tracked several separate actor clusters, each with its own toolchain, hitting internet-facing NetScaler boxes.
That is the part that should reset your patch calendar. The public advisory landed September 27. Exploitation was under way in early September, and some of the activity the TRU caught came within roughly 24 hours of the bulletin going public. There was no window in which this was only theoretical.
Ten flaws, two of them bad enough on their own
The disclosure runs from CVE-2026-88771 through CVE-2026-88778, plus CVE-2026-88779 and CVE-2026-107406. The first two are the ones federal responders care about. CISA put both on its Known Exploited Vulnerabilities catalog on September 27, the same day Citrix went public.
CISA's scores put CVE-2026-88771 and CVE-2026-88772 at 9.5 out of 10. CVE-2026-88773 sits at 9.3, and CVE-2026-88774 at 7.0. The agency said it received reports and partner threat intelligence confirming threat actors are exploiting them globally.
CVE-2026-88779 is a different animal. It carries a CVSS of 8.7 and it does not hand over code execution by itself. In NetScaler deployments configured as a SAML Service Provider or Identity Provider, it creates a denial of service. CISA added it to KEV on October 4 and spelled out the relationship to the other bugs: attackers can use it to force a reboot that accelerates conditions to run code they injected earlier through CVE-2026-88771.
CVE-2026-107406 arrived later and pushed the count to ten. CISA folded it into the alert on October 9 and told organizations to patch the whole set, plus review Citrix guidance for suspected or confirmed compromises.
What the intrusions actually looked like
The TRU's writeup is the most concrete public account of what happened inside the boxes. Actors dropped a PHP web shell into /var/netscaler/gui/vpn/scripts/linux/, a directory already full of legitimate .deb packages, then named the shell nsgtrust.deb to blend in. Apache access logs showed it executing in early September.
From there the playbook splits. One cluster ran a lightweight PHP web shell and used Platypus for remote management. Another used a Perl-based installer that deployed a PHP web shell, created a backdoor account in NetScaler, and stood up a Python reverse shell. The common endgame was to set the SUID bit on /bin/sh and hold a root shell.
The web shell in the first cluster is nearly identical to the lightweight installer family Google Threat Intelligence Group described in its own research on NetScaler exploitation. Several groups, same toolkit, roughly the same week. That is not coincidence. That is a shared exploit that circulated before the CVE was public.
Why NetScaler is a bad place to lose a fight
NetScaler ADC and NetScaler Gateway are not ordinary servers. They terminate SSL for the whole enterprise, they hold the certificates, and in most deployments they are the thing your identity provider talks to through SAML. Whoever owns one owns the front door and a stack of credentials to go with it.
The log problem makes it worse. CISA told administrators to ship NetScaler logs to a central SIEM or log retention system, because local logs rotate quickly and can overwrite the artifacts you would need to reconstruct what happened. That advice lands oddly. The device that sees every session is also bad at remembering them.
Patch first, then assume you were already in
CISA's guidance is unusually blunt about sequence. Preserve forensic evidence before applying updates, because updates can reduce forensic visibility. Then restore a known good backup that pre-dates any suspected compromise, and rotate every restored secret: local account passwords, key-encryption keys, SSL certificates.
The patch itself is not a click. CISA acknowledged that updating NetScaler deployments can be complex and may require downtime, which is why the agency issued an alert instead of a routine advisory.
That is the part I doubt holds. An appliance that fronts production traffic for a bank or an airline does not get a maintenance window in a weekend, and CISA knows it. Three weeks after disclosure, unpatched NetScalers are still on the internet, still visible to anyone running a scanner.
The same week, same shape
Cisco and Fortinet shipped their own versions of this story inside a week. Cisco disclosed CVE-2026-76504 in Catalyst SD-WAN Manager on September 30, a URI encoding flaw in API session-based authentication that lets an unauthenticated remote attacker send a crafted HTTP request and land in the API with admin privileges. CVSS 9.8. Versions before 20.9.10.1 and the 20.12 line through before 20.12.8.2 are affected, among others. Singapore's Cyber Security Agency flagged it as reportedly actively exploited on October 6.
Fortinet went public on October 1 with CVE-2026-104286 in FortiMail, also 9.8. The flaw combines path traversal with bad NULL byte handling and lets an unauthenticated attacker write arbitrary files through crafted HTTP or HTTPS requests, which means code execution on the underlying system. Fortinet confirmed exploitation before disclosure. CISA added it to KEV the same day and gave federal civilian agencies a patch window closing October 4.
Fortinet's own table showed patches released for one of four affected FortiMail branches at the time of writing, with the rest marked upcoming. If you cannot patch, Fortinet's workaround is to disable Identity-Based Encryption support and lock the management interface to trusted networks.
Three vendors, three weeks, three unauthenticated admin-level holes in appliances that sit at the network edge. None of them were exotic. One was a URI encoding mistake, one was a path traversal, one was found internally by Citrix's own product security team after attackers had been using it for a month.
What to check this week
Start with the KEV list, not with a scanner. If CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-107406, CVE-2026-76504, or CVE-2026-104286 match anything in your estate, those are the ones with confirmed attackers attached.
For NetScaler specifically, Citrix published indicators of compromise through NetScaler Console, and CISA released a SIGMA detection rule set on GitHub for hunting suspicious activity in relevant log sources. Pull your logs first. Rotate secrets after you restore. And budget the outage, because the alternative is finding out later that a root shell has been sitting in /var/netscaler/gui/vpn/scripts/linux/ since September.
More edge-device coverage sits in our cybersecurity desk, and the CISA alert with the full advisory set is available here. Fortinet's advisory on CVE-2026-104286 is posted on FortiGuard.
Citrix has not published a victim count, and it likely will not. The KEV additions and the TRU's cluster analysis are the closest thing to a tally, and both point the same direction: the people inside these boxes found them first, and some of them are still there.