On September 27, 2026, Citrix published security bulletin CTX697096 covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway. This post focuses on CVE-2026-88771, an unauthenticated command execution vulnerability affecting default deployments, and CVE-2026-88772, a DTLS memory overflow vulnerability that can lead to remote code execution or denial of service.

Citrix states that exploitation of both vulnerabilities has been observed on unmitigated systems. GreyNoise also recorded CVE-2026-88771 exploitation attempts on September 24, more than three days before public disclosure, and documented an attempted post-exploitation chain involving privilege changes and a hidden, password-protected webshell.

Detection Coverage

We have added several new detection rules covering different parts of the currently available public evidence. We are listing the rule names and their intended purpose below, but not their matching strings or implementation details.

• EXPL_CVE_2026_88772_POC_Sep26

  Detects files and source-code artifacts associated with the publicly available CVE-2026-88772 proof-of-concept repository. The public project fingerprints NetScaler versions, checks for exposed DTLS services and can send a benign DTLS probe. It does not include the memory-overflow trigger or a complete exploitation chain. This rule therefore detects PoC-related artifacts, not exploitation attempts against an appliance. GitHub

• LOG_SUSP_EXPL_CVE_2026_88771_Sep26

  Detects potential CVE-2026-88771 exploitation traces in NetScaler log data. The rule focuses on the relationship between NetScaler process-failure messages, attacker-controlled log content and shell metacharacters associated with the command-injection path described by watchTowr. A match should be treated as a strong investigation lead, but not as standalone proof that command execution succeeded. watchTowr Labs

• WEBSHELL_CSS_PassThrough_Sep26

  Detects a compact PHP webshell pattern that combines command pass-through with cookie decoding. GreyNoise observed an actor attempting to install this type of password-protected webshell as a hidden file and configure the web server so that CSS-looking request paths were routed to it. The rule detects the relevant webshell behavior rather than relying only on the reported filename. GreyNoise

These rules focus on CVE-2026-88771, CVE-2026-88772 and the publicly documented post-exploitation activity. They should not be interpreted as detection coverage for all eight vulnerabilities listed in CTX697096.

NetScaler Filesystem IOC Set

In addition to the detection rules, we are releasing a dedicated YAML IOC set today:

title: NetScaler Exploitation - suspicious file artifacts
id: 99f5048e-e8f1-40cd-ba39-9877dc2c67e7

Citrix provided an IOC scanner shell script designed to identify signs of compromise on NetScaler ADC systems. The script was shared with us, and we extracted the filesystem-related detection patterns and converted them into our YAML IOC format. The resulting IOC set covers 12 direct filesystem checks from the original script, consolidated into four file-rule definitions.

It covers suspicious PHP and XHTML files in relevant NetScaler web directories, unusual signature files and specific package artifacts. The path expressions are case-insensitive and allow prefixes such as mounted-image locations, which makes them suitable for collected filesystem trees and mounted forensic images as well as paths taken directly from an appliance. netscaler-iocs netscaler-iocs

This is intentionally not a complete reproduction of the source scanner. Another 22 checks depend on log or configuration content, process information, file ownership, permissions or other runtime context. Those conditions cannot be represented accurately as simple file-path IOCs and are therefore not included in this set. 

The IOC set identifies suspicious files and locations that warrant further analysis. A match does not by itself establish that an appliance was compromised.

Availability

As of September 29, 2026, the new NetScaler detection rules listed above are already available through the THOR Preview signature channel.

The Preview channel was previously known as SigDev. Rules in this channel have passed automated quality checks but have not yet completed the full manual QA process. Preview signatures provide early access to new detection coverage, but customers should account for a potentially higher false-positive rate than with the stable signature set.

Standalone THOR users can retrieve the current Preview signatures with:

# Linux and macOS
./thor-util update --sigdev

# Windows
thor-util.exe update --sigdev

To verify that all NetScaler detection rules mentioned in this post are present in the local signature set:

./thor-linux-64 --print-signatures | grep -E 'EXPL_CVE_2026_88772_POC_Sep26|LOG_SUSP_EXPL_CVE_2026_88771_Sep26|WEBSHELL_CSS_PassThrough_Sep26'

The verification command should return entries for all three rules listed above.

To return to the current stable signature set, run the update command again without --sigdev:

./thor-util update

Management Center v4 users can enable Show Signature Preview Channel in Advanced Settings and then select the Preview channel in the Version Pinning configuration.

Customers who prefer to use only fully tested signatures can remain on the stable channel and receive the rules after completion of the regular QA process.

Recommended Response

Detection content does not replace patching. Citrix recommends upgrading affected NetScaler ADC and NetScaler Gateway systems to the fixed releases documented in CTX697096. CVE-2026-88771 affects default deployments without requiring an additional feature, while CVE-2026-88772 affects systems with DTLS enabled, including VPN virtual servers where DTLS has not been explicitly disabled.

Because exploitation was observed before public disclosure, installing the update cannot determine whether an exposed appliance had already been compromised. Organizations should preserve relevant NetScaler logs and filesystem evidence, apply the vendor updates and perform a compromise assessment of systems that were exposed during the affected period.

The signatures released with this update are designed to detect the currently known exploitation traces and post-exploitation artifacts associated with these NetScaler vulnerabilities and should help identify compromised systems.

We are continuously reviewing new technical publications and incorporating additional findings shared by partners and customers. As the situation develops, we currently expect to publish updated or additional Preview signatures on a daily basis. Customers performing a compromise assessment should therefore update to the latest Preview signature set before each scan.

References

• Citrix security bulletin CTX697096, covering CVE-2026-88771 through CVE-2026-88778. Citrix Support
• watchTowr technical analysis of the CVE-2026-88771 pre-authentication command injection. watchTowr Labs
• GreyNoise analysis of pre-disclosure exploitation attempts and the observed post-exploitation playbook. GreyNoise
• Public CVE-2026-88772 proof-of-concept and exposure-checking repository. Github