Network edge appliances are supposed to be the bouncers at the club door. Right now a lot of Citrix NetScaler bouncers have been quietly letting attackers in since August, and the attackers have started posting the guest list online.
Two Zero-Days, Then a Third Wheel
Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them, CVE-2026-88771 and CVE-2026-88772, were exploited as zero-days to plant webshells. According to Cybersecurity Dive, exploitation began as early as August 21, weeks before public disclosure in late September. CISA added both to its Known Exploited Vulnerabilities catalog on September 27.
CVE-2026-88771 is an improper input validation flaw that lets remote, unauthenticated attackers run commands on devices with a default configuration. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled, and DTLS is on by default for virtual VPN servers. Then, on October 4, CISA added a third NetScaler bug, CVE-2026-88779, to the KEV list and gave federal agencies until October 7 to deal with it.
The Proof-of-Concept Changed Everything
At first this was quiet, targeted work. Google Threat Intelligence and Mandiant described the attackers as showing "advanced knowledge and sophistication" with suspected state-level ties. Once a root-cause analysis and a public proof-of-concept appeared, Help Net Security reports, it turned into mass "spray and pray" exploitation. Researchers are tracking victims across government, healthcare, finance, telecom, education and energy.
The part most teams get wrong is assuming the patch is the finish line. With attackers inside since August, a patched box may still be hosting a webshell and leaking credentials it collected weeks ago. Guidance is to patch to 14.1-73.37 or 13.1-64.23 (or later), isolate anything suspicious, rotate credentials, revoke sessions, and audit downstream Citrix and Windows logs. If you can't patch right away, disable DTLS and block inbound UDP/443.
Patching closes the door, but it does nothing about anyone already inside, so go look.
The same rule applies well beyond Citrix: anything internet-facing that you haven't inventoried is a liability. If you want help auditing what your web stack exposes to the internet, that's a conversation we're always glad to have.
Source: Cybersecurity Dive