Image: unit42.paloaltonetworks.com · rights & removal

Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

Reporting by Unit 42 Palo Alto NetworksRead the original at unit42.paloaltonetworks.com

Executive Summary

Unit 42 is aware of potential zero-day activity against NetScaler devices, specifically CVE-2026-88771 (RCE) and CVE-2026-88772 (RCE/DoS), which have been exploited to deliver web shells and establish persistence. Palo Alto Networks Cortex Xpanse telemetry identified 50,277 exposed instances that could be vulnerable to these vulnerabilities as of September 27, 2026. Pre-disclosure activity involved two groups of web shell activity: DTLS exploitation dropping .deb web shells and a three-stage command injection exploit chain leading to PHP web shell execution. Initial activity involved fingerprinting NetScaler devices by requesting specific files from the appliance. Exploitation involved crafting malicious DTLS traffic against NetScaler devices, followed by requests for files from system directories, and subsequent activity involving requests to authentication pages. The analysis of recovered .deb files revealed a PHP web shell capable of remote command execution, file exfiltration, and uploading, utilizing RC4-encrypted communication and privilege escalation techniques.

Facts Only

* CVE-2026-88771 is a remote code execution (RCE) vulnerability in NetScaler ADC and Gateway systems due to improper input validation.
* CVE-2026-88772 is a memory overflow vulnerability leading to RCE or DoS on DTLS configuration in NetScaler ADC and Gateway systems.
* Palo Alto Networks Cortex Xpanse identified 50,277 exposed instances potentially vulnerable based on telemetry as of September 27, 2026.
* Pre-disclosure activity included exploitation via DTLS to drop .deb web shells and a three-stage command injection exploit chain dropping PHP web shells.
* Initial activity involved fingerprinting NetScaler devices through file requests starting August 21, 2026.
* Exploitation involved crafting malicious DTLS traffic against NetScaler devices and requesting files from `/vpn/scripts/linux/`.
* The exploited web shell executed commands via custom HTTP headers derived from server variables, cookies, and request parameters.
* The web shell utilized `shellexec`, `exec`, `passthru`, `system`, and `popen` for command execution.
* Persistence involved modifying configuration files to enable PHP execution and registering a web shell under the path `/logon/LogonPoint/custom/`.
* Indicators of Compromise include IP addresses such as 45.61.136[.]143, 77.83.199[.]39, and 104.248.244[.]66.

Full Take

The narrative presented frames a vulnerability disclosure as a timeline of observed attacker behavior, moving from reconnaissance to weaponization, persistence, and finally public awareness. The structure explicitly separates pre-disclosure activities from post-disclosure scanning, which serves to define the threat actor's initial methodology before layering on subsequent noise. This separation is critical: the pre-disclosure phase details a precise, multi-stage chain—fingerprinting via CSS requests, exploiting DTLS for memory corruption, and then executing staged commands via log poisoning to implant a persistent web shell disguised as legitimate assets (CSS files). This sequence demonstrates a high degree of operational specificity rather than generalized threat noise.
The implication is that the security posture relies not just on patching but on monitoring highly specific, low-level system calls and unusual HTTP request patterns within appliance logs, especially authentication path requests. The shift to post-disclosure activity suggests that once the initial zero-day mechanism is known, actors revert to broader scanning, indicating a calculated response to increased public scrutiny rather than entirely new exploits. The emphasis on observing log poisoning in the `pitboss` sequence highlights that traditional perimeter defense may miss exploitation if the persistence mechanism abuses internal logging functions and shell execution capabilities.
Bridge questions: If the specific chain of command injection and web shell deployment is understood, what observable, non-log-based anomalies in live NetScaler operational traffic would indicate an ongoing, successful session? How does the observed preference for using `.deb` files for payload delivery reflect a systemic gap between application security hardening and underlying operating system integrity controls on these appliances?

From the original · Unit 42 Palo Alto Networks

Executive Summary Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild.

Read the full story at unit42.paloaltonetworks.com

Sentinel — Human

Confidence

The text reads like a highly technical security report detailing forensic findings, exhibiting high specificity and structure consistent with human threat intelligence analysis rather than purely synthetic content.

Signals Detected

Moderate sentence length variance; inclusion of highly technical, densely packed procedural steps inconsistent with smooth AI flow.

Strong internal coherence linking specific forensic findings (IPs, file names, shell commands) to the vulnerability context; absence of typical synthetic 'fluff'.

Structured presentation of findings mimicking a formal security report (Vulnerabilities listed, Pre/Post-Disclosure activity detailed, Indicators of Compromise provided).

Presence of specific, highly technical details regarding exploitation chains (e.g., the three-stage command injection payload analysis) and exact file/hash references suggests deep, direct sourcing or expert synthesis.

Human Indicators

The detailed breakdown of the multi-stage exploit process, including specific shell commands and web shell artifacts, indicates deep technical knowledge likely derived from an incident response context.

The inclusion of dynamic indicators (IP addresses, specific file hashes) tied to real-time telemetry suggests a basis in actual investigation data rather than generic LLM generation.