Netscaler CVEs are out:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
Patch isn’t yet through QA at Citrix still, been a week :02angery:
The primary vulns being exploited are CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 chained.
It gives unauth RCE in default appliance config. Attackers using it to drop webshells all month of September.
Probably nation state aligned as well resourced, espionage rather than teens.
‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway.
More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778
Citrix patches are out on the main support site now.
You will need to check every box after patching for webshells. Citrix are locking the script behind an NDA as apparently they’re from 1996… hopefully one of the NCSCs publishes a script again as the NDA thing is crap.
To be clear patching alone doesn’t remove the backdoors being placed.
RE: https://mastodon.social/@zackwhittaker/117344795797870712
Once a year I publish a blog about how Citrix is very unserious when it comes to security but I think I might go apocalyptic this year.
I don’t know if the story will come out about this one but governments etc have been hacked using this one, Citrix knew, and they just tried to hide it. Again.
RE: https://mastodon.social/@404mediaco/117344659806515505
The Onion became real life around 2016 didn’t it
River Light - Tukituki Valley, Hawke's Bay, New Zealand.
