Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web Path

An unauthenticated remote attacker can run commands on a NetScaler ADC or Gateway appliance in its default configuration through CVE-2026-88771, and Rapid7 saw the first attempt at 14:28 UTC on Sept. 20, a week before Citrix published fixes. The command Rapid7 captured does not install malware. It copies the appliance's configuration into a directory the web server hands out to anyone.

Citrix disclosed eight vulnerabilities on Sept. 27, and CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog the same day. CISA says it has since added CVE-2026-88779 on Oct. 4 and CVE-2026-107406 on Oct. 9.

What the attacker's command does

In the intrusion Rapid7 documented, the attacker injected a command through a login-related field and ran tar czf /var/netscaler/gui/vpn/c -C /flash nsconfig. That writes a gzipped archive of /flash/nsconfig to /var/netscaler/gui/vpn/, which the gateway serves publicly at /vpn/. A plain unauthenticated GET request to /vpn/c then downloads it.

The archive holds ns.conf, which contains encrypted admin passwords and the LDAP, RADIUS and TACACS bind passwords. It also holds the ssl/ directory with certificates and private keys, SSH host keys, license files and high-availability sync settings. Rapid7 identified two compromised organisations: one through the command injection, the other through a webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.

The source address for the injection attempt was 149.104.78.208, per Rapid7.

Which of the nine CVEs are exploited

Rapid7's table of the flaws, with Citrix's CVSSv4 scores:

CVE	CVSSv4	Condition	In KEV
CVE-2026-88771	9.5	Command injection, default configuration	Yes
CVE-2026-88772	9.5	Memory overflow, DTLS enabled, high attack complexity	Yes
CVE-2026-88773	9.3	HTTP request smuggling	No
CVE-2026-88779	8.7	Memory overflow in SAML processing	Yes

The score understates CVE-2026-88779. An 8.7 reads as the quieter flaw, yet repeated attempts crash the SAML service and the appliance reboots on the sixth crash, according to Rapid7. CISA's alert says that reboot can help an attacker run code previously injected through CVE-2026-88771.

Timeline

• Sept. 20: Rapid7 records two attempts against CVE-2026-88771, the earliest it has seen.
• Sept. 24: GreyNoise records a zero-day attempt against a NetScaler Gateway, three days before disclosure, according to Help Net Security.
• Sept. 27: Citrix discloses eight flaws; CISA adds two to KEV.
• Oct. 4: Citrix advisory for CVE-2026-88779; CISA adds it to KEV.
• Oct. 9: CISA adds CVE-2026-107406.

Exposure and who is behind it

Help Net Security cites Censys data counting about 42,000 internet-facing NetScaler hosts, 13,549 of them in the United States and 5,678 in Germany. Censys cannot tell whether a given host is vulnerable or compromised. Researcher Kevin Beaumont's firmware scanning found fewer than 10 percent of exposed hosts patched, and he is tracking more than 100 victim organisations, each with a unique webshell that remote scanning cannot find.

Beaumont's view is that the first wave was espionage. That is an assessment, not an attribution. Help Net Security also reports that Mandiant dates suspected state-sponsored use of CVE-2026-88772 to early September. watchTowr Labs published a root-cause analysis and proof-of-concept exploit for CVE-2026-88771, and Lupovis CEO Xavier Bellekens said his sensors began recording live attempts within minutes of the release. No public exploit exists for CVE-2026-88772.

Edge appliances keep carrying this pattern. The Palo Alto GlobalProtect case involved a flaw patched in May that ransomware crews still exploit.

What to patch to, and what to do first

The fixed builds are 14.1-73.41 and 13.1-64.28 or later, which supersede the Sept. 27 builds of 14.1-73.37 and 13.1-64.23 because they also cover CVE-2026-88779. FIPS and NDcPP builds have their own numbers: 14.1-73.41 FIPS and 13.1.37.282.

CISA says to check for compromise before patching and to preserve forensic evidence first, since updates can reduce forensic visibility. If an appliance is suspect, restore a backup that predates the compromise and rotate every restored secret, including local account passwords, key-encryption keys and SSL certificates. Citrix's guidance for a suspected compromise is bulletin CTX694799. An archive named c under /var/netscaler/gui/vpn/ is the artifact Rapid7 lists for this attack, and its presence would mean the private keys inside it have left the appliance. One exposed secret was also enough in the Google DevSite cookie flaw.