The first warning did not come from Citrix. According to Help Net Security, reports surfaced on Reddit on Friday and were then picked up by IT suppliers quoting the Dutch NCSC-NL, which had seen exploitation at several customers worldwide. Researcher Kevin Beaumont told the outlet the attacks had been running "this entire month", and described the operators as probably nation-state aligned - well resourced, interested in espionage rather than mischief.
One flaw that doesn't care how you configured it
CVE-2026-88771 is an input validation failure. The Hacker News reports the path runs through a Perl script, ns_monuploadd_err.pl, that handles crash information; commands injected via the /nf/auth/doAuthentication.do endpoint execute as root. No login, no special feature, low complexity. That last point is what makes it ugly. Plenty of "critical" NetScaler bugs over the years have needed a particular gateway role or a particular profile. This one applies to the box as shipped.
The second one is a DTLS problem, and DTLS is probably on
CVE-2026-88772 is a memory overflow that can give code execution or a crash. It needs DTLS enabled, and BleepingComputer notes that is the default on VPN virtual servers. If your NetScaler is the front door for remote access, assume you are in scope unless someone deliberately switched DTLS off. Citrix says it found both bugs while investigating customer incidents - so the fix followed the intrusions, not the other way round. The vendor's own security bulletin covers eight CVEs in total; these two are the ones being hit.
Patching is step three, not step one
Fixed builds are 14.1-73.37 and 13.1-64.23 or later, plus the matching FIPS and NDcPP releases. But the guidance that matters more is about what to do first. Attackers dropped a different webshell on each target and ran anti-forensics commands afterwards, and Help Net Security lists detection strings such as base64 content following the User-Agent field and a "pitboss" marker followed by IFS. CISA has told agencies to do forensic triage as well as patch, and the advice is to keep device memory and at least a month of logs from before you upgrade. Rebooting into a new firmware image destroys exactly the evidence you would need to learn whether you were already owned. Unit 42's threat brief and Rapid7's write-up are worth having open while you do it.
- Capture memory and at least 30 days of logs from every internet-facing NetScaler before touching firmware.
- Hunt for the published indicators (odd User-Agent tails, "pitboss"/IFS strings, unfamiliar files under the web tree) going back to early September, not just to the disclosure date.
- Upgrade to 14.1-73.37 or 13.1-64.23 or later; where that has to wait, pull the management and gateway interfaces off the open internet in the meantime.
- If anything suspicious turns up, follow Citrix's guidance: isolate the appliance, revoke every credential that ever passed through it, and rebuild rather than clean.
Those last two steps are the expensive ones, because a NetScaler that has been compromised has seen every VPN password and session token that traversed it. If you would like a second pair of eyes on that triage, email sales@halfteck.com.