Read this one as a timeline rather than a bug. Word of an actively exploited NetScaler flaw moved through CTI channels on the Friday, carrying the kind of advice nobody gives lightly: turn the appliances off until there is a patch. On Saturday administrators were comparing notes in public, wondering whether a leak was real, and by Sunday morning they were asking rather more pointedly where the patch was. Citrix published on the Sunday.
The bulletin covers eight CVEs and does not hedge about two of them: “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.” Both score 9.5 critical: the first an unauthenticated command injection, the second a memory overflow reaching remote code execution. The rest of the set is its own indictment of the codebase: request smuggling (CVE-2026-88773, 9.3), three more memory overflows (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777), improper HTTP URL expression handling (CVE-2026-88774), and predictable values generated from previous ones (CVE-2026-88778, 8.8).
watchTowr took CVE-2026-88771 apart and the mechanism is gloriously old-fashioned: a Perl script that hunts for crash dumps builds a shell command out of a filename it scraped from those logs, so an attacker who gets a payload written into a log (via a username, a header, anything that gets recorded) ends up with backticks interpolated into find /var/core -name ${FILENAME}* and executed as root.
Execution is asynchronous, landing whenever the logs are next processed, which is to say up to a day after the request that planted it.
A shell metacharacter in a filename, in 2026, pre-auth, on an appliance whose entire job is to stand at the perimeter.
CVE-2026-88772 got the same treatment a day later, and it lives in DTLS, the UDP flavour of TLS that VPN virtual servers enable by default.
The handshake reassembly trusts the lengths the client declares, so a crafted sequence of fragments builds a chain of roughly 174 KB that then gets copied, without a bounds check, into a fixed 35,840-byte buffer in .bss.
No PIE on the binary meant fixed addresses, so the overflow could be steered into a function pointer, and from there into code execution, all before authentication.
GreyNoise caught an attacker trying the CVE-2026-88771 injection on a sensor on 24 September, three days before disclosure: set the setuid bit on /bin/sh, drop a password-protected webshell disguised as .ctxs.receiver, and add web-server alias rules so requests for receiver.min.css quietly land on it.
It didn’t get a foothold on the sensor, which is more than can be said for the real appliances.
PitScaler, an independent briefing site that labels every claim as official, research, telemetry or reported, puts the start well before that weekend: Unit 42 traced fingerprinting back to 21 August, eSentire saw CVE-2026-88771 exploitation on 5 September, and Danish government agencies pulled their NetScalers offline on 25 September, two days before Citrix said anything. CISA added both zero-days to KEV on the 27th with a three-day deadline, which for once was generous next to the three weeks the attackers had already had.
The lesson isn’t the Perl. It’s that the people running these boxes had actionable intelligence, and a shutdown recommendation, two days before the vendor confirmed anything.