1. Executive summary
The National Cyber Security Centre's 28 September 2026 alert identifies active exploitation of CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler ADC and Gateway. Mandiant's 29 September 2026 investigation describes observed exploitation of CVE-2026-88772, followed by disguised web shells and a proxy supporting internal access. Mandiant attributes exploitation of CVE-2026-88771 to vendor disclosures, preserving a distinction between its own observations and that additional reporting. Likely (B2), recovery limited to patching will leave material uncertainty where appliance secrets, active sessions or downstream systems were accessible during compromise.
2. Contextual background
The National Cyber Security Centre (NCSC) describes CVE-2026-88771 as an input-validation weakness allowing unauthenticated command execution. It describes CVE-2026-88772 as a memory-boundary weakness permitting remote code execution or denial of service. These are distinct vulnerabilities, even though they affect overlapping NetScaler deployments and appear in the same response effort.
Both appear in CISA's historical Known Exploited Vulnerabilities catalogue of 29 September 2026, with an addition date of 27 September 2026. That snapshot records ransomware-campaign use as Unknown for both. Unknown is a limit on that catalogue field, not evidence that exploitation is absent or that compromised credentials are harmless.
Mandiant reports campaign activity since at least early September 2026 and says organisations across several sectors in North America and Europe were likely affected. Preserve that qualification: the report is not a complete census of confirmed victims. Its value is the documented intrusion pattern and the response work it enables.
3. Technical analysis
Mandiant's telemetry suggests CVE-2026-88772 exploitation occurred during a Datagram Transport Layer Security (DTLS) handshake and produced memory corruption in the NetScaler Packet Processing Engine (NSPPE), enabling root-level execution. The researchers explicitly state that they did not possess exploit code. This mechanism is therefore their analysis of frontline telemetry, not a published reproduction of the complete exploit.
After access, Mandiant found changes to web-server configuration that caused files with non-PHP extensions to execute as PHP scripts. It describes both altered handlers and web-path aliasing, including .deb and .sig files used to conceal shells. Our recommendation is to inspect configuration and content together; a filename extension alone cannot establish how the server processes a file.
The report names WHIPSHOT, a PHP web shell, and SLAPSHOT, a companion Python tunneller. The latter bridges traffic from the compromised appliance towards internal hosts. In at least one observed intrusion, Mandiant saw the actor use that proxy for manual reconnaissance and credential theft. That case finding should not be inflated into a claim that every affected appliance produced the same downstream outcome.
Mandiant also reports shell-permission changes supporting persistent elevated execution and web shells that returned a misleading 404 response while transmitting data. The reported HTTP status therefore cannot be used on its own to classify a request as unsuccessful. Examine response size, processing time, content where available and related host activity.
4. Impact assessment
The exposed appliance is both an internet-facing service and a route into connected infrastructure. Mandiant's observations show why scoping must include the systems it can reach and the credentials it stores. Our recommendation is to map those relationships before declaring the incident contained, then test possible exposure against actual connection and authentication records.
The distinction between initial root access and later web-service execution also matters. Mandiant describes additional permission changes used to maintain elevated access after the initial exploit. Removing one shell without checking configuration, permissions and persistence may therefore leave an incomplete picture of the appliance's state.
Containment can interrupt remote access and other critical services. Both NCSC and Mandiant acknowledge that operational consequence. Identify the accountable service owner, available replacement capacity and a safe reintroduction plan. Operational impact should inform execution of containment, while the evidence of compromise determines the security problem being addressed.
5. Artefacts and hunting guidance
The following selected observations come from Mandiant's investigation. Investigate them in context rather than treating one generic error as proof of compromise.
| Observation | Reported significance | Defensive use |
|---|---|---|
Unexpected changes in httpd.conf |
Nonstandard PHP handlers or path aliasing | Compare with an authorised configuration baseline |
.deb or .sig files containing PHP |
Disguised web-shell staging | Preserve content and determine whether the server executed it |
/tmp/.uxdport, /tmp/.uxdlock |
SLAPSHOT port and lock artefacts | Correlate with processes and internal connections |
| 404 responses with unusual size or duration | Concealed shell or proxy interaction | Review response behaviour and appliance logs together |
| DTLS failure followed by NSPPE termination | Reported exploitation signal | Correlate events on the same appliance and investigate promptly |
Mandiant says SLAPSHOT can remove its port and lock files when it exits after inactivity. Their absence at examination is therefore weaker than evidence that the process never ran. Preserve historical file, process and network records where available, and record the limitations when the appliance retained only its current state.
Logging coverage needs explicit verification. Mandiant notes that the FreeBSD system log, /var/log/messages, is not included in standard forwarding of ns.log. It also explains that upstream devices generally cannot inspect application request details when encrypted connections terminate on the appliance. Confirm collection of system, web-access, web-error and identity evidence before relying on a detection that needs them.
For prioritisation, correlate protocol errors, engine termination, configuration changes and unexpected outbound traffic. A crash can be an investigative lead without proving exploitation in isolation. Conversely, a plausible explanation for one crash does not dispose of an unauthorised handler or an unexplained internal session.
Mandiant recommends checking web-error records as well as access logs because errors referring to disguised scripts may remain when access records have been altered. It also highlights chronological gaps and truncated entries as possible evidence of interference. Our recommendation is to compare available records across collectors and identify whether an apparent gap affects one log or the entire collection period. Preserve that distinction: incomplete collection and deliberate removal require different supporting evidence, even when both limit the investigation.
6. Incident response guidance
Mandiant recommends isolating confirmed or suspected compromised appliances. For high-availability (HA) pairs, it calls for independent assessment of both nodes and stopping configuration synchronisation until each is validated. This is intended to prevent malicious configuration from being copied to the standby node. Record the state and findings for each appliance separately.
Preserve relevant configuration, logs and runtime evidence. For virtual appliances, Mandiant recommends capturing the virtual-machine state, including memory, before rebooting where operationally possible. Coordinate preservation with containment so evidence collection does not become an open-ended reason to leave confirmed access available.
Credential recovery requires sequencing. Mandiant says to rotate credentials after successful patching and coordinate session termination across connected services. Invalidate active administrator, Gateway and VPN sessions; its guidance also includes terminating applicable Citrix application and desktop sessions where appropriate.
Its recovery list includes administrator and local-account passwords, Secure Shell keys, Transport Layer Security certificates and their private keys. It separately lists directory-bind and service accounts, remote-authentication shared secrets, network-management community strings and NetScaler's NITRO interface credentials. Inventory which of these are present, identify their owners and complete the corresponding replacements; a reset of the appliance administrator password alone does not cover that list.
Specifically, the integration categories in Mandiant's list are LDAP bind and service accounts, RADIUS shared secrets, TACACS credentials, SNMP community strings, and NITRO application programming interface credentials. Treat each configured integration as its own recovery item. Our recommendation is to verify that replacement credentials work on the intended connection, that the previous credentials no longer grant access and that any dependent monitoring remains available after the change.
Follow the access into downstream infrastructure. Mandiant specifically identifies StoreFront, Delivery Controllers and internal Citrix application or desktop hosts, and recommends reviewing authentication, remote access and credential-theft evidence. Include privileged-access-management audit records where relevant. Confirm which paths were used, which were only possible and which remain unresolved before narrowing the incident boundary.
7. ATT&CK context
These mappings are our analysis of the observed activity against MITRE ATT&CK. They do not attribute the operation to a named actor or imply that MITRE independently investigated it.
| Technique | Reported behaviour |
|---|---|
| T1190: Exploit Public-Facing Application | Vulnerability exploitation at the exposed appliance |
| T1505.003: Web Shell | PHP command access concealed behind altered handlers and extensions |
| T1090: Proxy | SLAPSHOT forwarding traffic into the internal network |
The Proxy mapping should lead to destination-side investigation, not merely a malware label on the appliance. Equally, the Web Shell mapping does not replace examination of the initial exploit or configuration persistence. Assign an evidence source and an investigative owner to each stage so recovery covers the full observed path.
8. Mitigation recommendations
NCSC lists the following affected supported release tracks. The versions are reproduced in full, including the specialised builds, from its 28 September 2026 alert.
| Deployment track | Affected versions |
|---|---|
| NetScaler ADC and Gateway 14.1 | Before 14.1-73.37 |
| NetScaler ADC and Gateway 13.1 | Before 13.1-64.23 |
| NetScaler ADC FIPS | Before 14.1-73.37 FIPS |
| NetScaler ADC FIPS and NDcPP | Before 13.1-37.279 |
Match the installed product track to the correct vendor release and verify the deployed build after maintenance. Mandiant advises obtaining vendor support if the required fixed build cannot be found in the customer download portal.
Temporary controls require a precise scope. Mandiant recommends disabling DTLS where feasible and restricting inbound UDP traffic on port 443 at an upstream firewall when patching is delayed. It explicitly says these controls address CVE-2026-88772 and must not be relied on for CVE-2026-88771. A fixed build remains necessary for both vulnerabilities.
Mandiant also warns that an appliance-local filter can allow traffic to reach the vulnerable packet-processing engine before it is discarded. Validate where a temporary restriction is enforced. Keep its operational owner and patch deadline explicit, and test required remote-access services after implementation.
Restrict management access to approved administration networks and hosts, and limit outbound access to documented dependencies. For virtual deployments, review separation from hypervisor management and other sensitive infrastructure. These measures reduce available routes; they do not substitute for investigating a device already showing compromise indicators.
9. Historical context and limits
The early September 2026 activity described by Mandiant precedes the public alerts cited here. That chronology means a present-day build check alone cannot establish that an appliance was safe throughout its earlier exposure. Reconstruct the locally evidenced timeline using retained logs, configuration history and maintenance records.
This account deliberately separates two confirmed exploited vulnerabilities from the detailed post-exploitation observations tied to Mandiant's CVE-2026-88772 investigation. It also preserves the researcher's limits on exploit possession and affected-sector confidence. Those distinctions prevent an incident summary from implying evidence that the sources did not provide.
10. Outlook and assessment
Likely (B2), recovery confidence will depend on reconciling appliance remediation with session invalidation, secret replacement and downstream investigation. The assessment follows the observed proxy use and credential theft, alongside the connected-system recovery actions Mandiant recommends.
Validated nodes, corrected configurations and explained downstream activity would reduce uncertainty. Missing historical logs, unexplained secret use or unexamined standby nodes would leave it open. Document those limits explicitly so restored service is not mistaken for a completed assessment of the intrusion.
