CVE-2026-88771/72/79/107406: Citrix NetScaler — Global RCE, Persistence, Disruption (August 2026)

CVE-2026-88771/72/79/107406 — Citrix NetScaler ADC & Gateway

Four critical vulnerabilities (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, CVE-2026-107406) in Citrix NetScaler ADC and Gateway are under active exploitation as of August 2026. Attackers are leveraging these flaws for remote code execution, memory corruption, and forced system reboots. The vulnerabilities have no user interaction requirement and are being exploited in the wild, with observed impacts including persistent web shells and service outages. Severity is critical; immediate action is required.

Attack Vector

Attackers exploit exposed NetScaler instances via network access, using custom PHP web shells to establish persistence and conduct reconnaissance. Exploitation includes memory corruption leading to system instability and forced reboots, disrupting services. No authentication is required for initial compromise. Web shells are deployed post-exploitation, enabling ongoing attacker access and lateral movement within affected environments.

Who Is at Risk

All Citrix NetScaler ADC and Gateway customers are exposed, including cloud and on-premises deployments. Confirmed victims include multiple hospitals—where patient portals were briefly inaccessible—and dozens of organizations across healthcare, finance, and other sectors. Any unpatched NetScaler instance is at immediate risk of compromise.

Patch & Mitigate

• Patch: Apply Citrix-released hotfixes for CVE-2026-88771, CVE-2026-88772, CVE-2026-88779, and CVE-2026-107406 immediately. Check Citrix advisory for exact versions.
• Workaround: No official workaround. Isolate affected systems from the internet if patching is delayed.
• Detect: Search for unexpected PHP files or web shells in NetScaler directories; review logs for anomalous authentication or command execution activity.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit remote services to gain entry without user interaction.
• TA0005 — Defense Evasion: Custom web shells evade standard detection, enabling persistent access.
• TA0007 — Discovery: Web shells are used for reconnaissance and lateral movement post-compromise.

Source: https://www.cybersecuritydive.com/news/cisa-citrix-netscaler-customers-patch-new-flaws-disclosed/832741/