The first recorded move in this campaign was not a crash, an alert or a ransom note. It was someone asking a Citrix appliance for a stylesheet.
In its threat brief on the NetScaler zero-days, Unit 42 dates the earliest activity it identified to August 21st 2026, when two hosts requested the file /admin_ui/common/css/ns/ui.css from a NetScaler Gateway belonging to a US organization. Unit 42 reads those requests as version fingerprinting. Over the 21st and 22nd of August, the same requests went out to more than 100 other systems. The appliances answered, because answering is what they do.
Citrix published its security bulletin on September 27th. The last pre-disclosure request Unit 42 observed in that activity arrived at 01:54 UTC the same day, hours before the bulletin went live. If you were waiting for the vendor to tell you there was a problem, the attackers had roughly five weeks of head start.
What Happened?
The UK National Cyber Security Centre has urged organizations to act on vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, following a Citrix bulletin that covers eight separate flaws. Two of the eight are confirmed as being exploited in the wild.
The two that matter most right now:
- CVE-2026-88771: improper input validation that lets a remote attacker who has not authenticated at all run commands on the appliance.
- CVE-2026-88772: an operation that runs outside the bounds of a memory buffer, which can end in remote code execution or denial of service. Unit 42 places this one in the DTLS configuration on ADC and Gateway systems.
Unit 42 gives both a CVSS v4.0 base score of 9.5. More useful than the score: it reports that attackers used these flaws to drop web shells, giving them initial access and a way to stay. Analysis of what they did afterwards is still running.
According to the NCSC, the affected products are the on-premises, customer-managed builds:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
- NetScaler ADC FIPS before 14.1-73.37 FIPS
- NetScaler ADC FIPS and NDcPP before 13.1-37.279
Unit 42 also notes that Palo Alto Networks telemetry counted 50,277 exposed instances as of September 27th that could potentially be vulnerable. Treat that figure as a measure of internet exposure rather than a confirmed casualty list, which is how Unit 42 frames it. It is still a large number of front doors.
Once the flaws were public on September 27th, Unit 42 saw broad scanning and testing. That is the normal pattern: a small number of actors use a zero-day quietly, then everyone else arrives at once.
Why This Matters for Businesses?
A NetScaler ADC or Gateway appliance is no minor hardware component. It is usually how staff reach published applications and how remote access works at all. It sits in front of the network by design, facing the internet, authenticating people.
So an unauthenticated command execution flaw on that box is not a theoretical weakness in a product you happen to own. It is a stranger running commands on the device that decides who gets in.
The most alarming point is about sequencing. Exploitation started before a fix existed, which changes what “we patched it” means. Unit 42 is blunt about this in its guidance: applying the update does not evict an attacker who already has persistence. A web shell planted in September survives an October patch.
That is why the NCSC’s recommended order of operations begins with isolating the affected system and investigating for evidence of compromise using the indicators Citrix published, and only then installing updates and bringing the system back. Patch-first is the instinct, but here it’s the wrong sequence.
There is also an inventory problem hiding in the version list. These are the customer-managed, on-premises builds, the sort of appliance a mid-market firm bought during a remote-access project, configured well, and then stopped thinking about. Nobody is intentionally careless about the appliance. People are just busy, and the appliance keeps working.
What Organizations Should Consider?
Citrix is not uniquely bad. Edge devices are the one asset class where a monthly patch cycle is structurally too slow, because attackers reach them first and do not need a login to try.
Five questions worth asking your IT team this week:
Do we have one, and which build? Not “do we use Citrix” but the exact version string, checked against the list above. If the answer takes more than a day to produce, that delay is the problem.
Who owns each internet-facing device by name? Firewalls, VPN concentrators, gateways, file transfer appliances, remote access portals. A team member per device, not a team inbox.
What is our emergency patch path? Meaning: if a vendor publishes an actively exploited flaw on a Friday afternoon, what is the shortest route to an isolated or updated appliance, and who can authorize the outage that comes with it? The NCSC is upfront that isolating or replacing a system may interrupt service. Decide who owns that trade-off before you need to.
Could we answer “was it exploited” and not just “is it patched”? Unit 42 suggests preserving a VPX instance snapshot, logs held on remote syslog servers and NetScaler Console, a technical support bundle and a packet engine core dump before you start changing things. If your appliance logs live only on the appliance, you lose the evidence at the moment you most need it.
What would we hunt for? Unit 42’s general guidance points at odd administrative sessions, outbound connections nobody can explain, and gaps in logging where there should be none. The NCSC also points customers to NetScaler Console File Integrity Monitoring to spot unexpected changes to monitored files.
None of this requires new budget. It requires a list, an owner per line, and an agreement that a zero-day on an edge device opens an incident response process rather than a maintenance ticket. That is a process decision, and process decisions are cheap compared with the alternative.
What Can You Do About It?
Penetration Testing answers the question an inventory cannot: what is genuinely reachable from the internet today, and what does an attacker see when they look at your edge? Fingerprinting an appliance is step one for an attacker. It is a reasonable step one for you too.
Talk With Our Team
If you run a NetScaler ADC or Gateway appliance on premises, or you are not yet certain whether you do, we would rather have that conversation this week than next quarter. Reach us through ism.com/contact for the phone number, address and form, and bring your version numbers if you have them. If you do not have them, that is a fine place to start too.
Prefer to size up the problem on your own first? The Cyber Maturity Calculator will give you a sense of how well your current process would hold up the next time a vendor publishes bad news on a Sunday.
Sources
- Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, UK National Cyber Security Centre
- Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30), Unit 42, Palo Alto Networks