CVE-2026-88771 & CVE-2026-88772: CISA KEV Alert — Citrix NetScaler Exploitation Detection and Remediation Guide

---
title: Suspicious Process Spawning From Web Server Parent - Potential NetScaler Webshell Pattern
id: 3f7c1a92-8d4e-4b61-a2c9-5e6f7a8b9c0d
status: experimental
description: Detects command shells, scripting engines, or system utilities spawned by a web server process (httpd/nginx/apache), consistent with webshell execution following exploitation of an edge appliance such as Citrix NetScaler (CVE-2026-88771, CVE-2026-88772). Apply to Linux syslog process audit data forwarded from NetScaler appliances and adjacent web infrastructure.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/27
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1190
  - attack.t1505.003
logsource:
  product: linux
  service: auditd
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/nginx'
      - '/apache2'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/perl'
      - '/python'
      - '/python3'
      - '/nc'
      - '/ncat'
      - '/netstat'
      - '/whoami'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate web server plugins invoking system utilities during maintenance windows
level: high
---
title: Webshell File Creation in NetScaler Portal and CGI Directories
id: 8b2e5d14-6f3a-4c97-b1d8-2a4c6e8f0a1b
status: experimental
description: Detects creation of script files in NetScaler portal, template, and CGI directories — the canonical webshell staging locations observed in NetScaler exploitation campaigns, including activity associated with CVE-2026-88771 and CVE-2026-88772. Apply to file integrity monitoring or forwarded syslog from NetScaler appliances.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/27
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/netscaler/portal/scripts/'
      - '/netscaler/portal/templates/'
      - '/netscaler/ns_gui/'
      - '/var/vpn/'
      - '/var/netscaler/gui/'
      - '/var/tmp/'
      - '/tmp/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.pl'
      - '.py'
      - '.sh'
      - '.cgi'
      - '.jsp'
  filter_known:
    TargetFilename|contains:
      - '/netscaler/portal/scripts/common/'
  condition: selection_path and selection_ext and not filter_known
falsepositives:
  - Legitimate NetScaler GUI customization or theme deployments (change-control these events)
level: high
---
title: Credential Dumping or Reconnaissance Following Interactive Session on Internal Host
id: 1c9a4f77-2e5b-4d38-a6c1-9f0b3d5e7a2c
status: experimental
description: Detects credential access and reconnaissance tooling executed on internal Windows systems shortly after perimeter exploitation, a common post-NetScaler-compromise pivot pattern observed with CVE-2026-88771 and CVE-2026-88772. Tune the host list to jump boxes and servers reachable from your NetScaler DMZ segment.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1003/
  - https://attack.mitre.org/techniques/T1018/
author: Security Arsenal
date: 2026/09/27
tags:
  - attack.credential_access
  - attack.discovery
  - attack.t1003
  - attack.t1018
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'sekurlsa::'
      - 'lsadump::'
      - 'comsvcs.dll'
      - 'MiniDump'
      - 'procdump'
      - 'ntdsutil'
      - 'vssadmin create shadow'
      - 'nltest /dclist'
      - 'net group "Domain Admins"'
  filter_service:
    User|contains: 'SYSTEM'
    Image|endswith: '\\MsMpEng.exe'
  condition: selection and not filter_service
falsepositives:
  - Authorized penetration testing and red team activity
  - Backup and snapshot management tooling invoking vssadmin
level: high

// NetScaler exploitation hunt: CVE-2026-88771 / CVE-2026-88772
// Requires NetScaler syslog/audit log forwarding to Sentinel (Syslog or CommonSecurityLog)
let lookback = 14d;
union (Syslog | where TimeGenerated > ago(lookback)),
      (CommonSecurityLog | where TimeGenerated > ago(lookback))
| extend rawmsg = tostring(column_ifexists("SyslogMessage", column_ifexists("Message", "")))
| where rawmsg has_any (
    "/vpn/", "/logon/LogonPoint", "/cgi/", "/logon/",
    "httpd", "crash", "segmentation", "core dumped", "pid ",
    "bash.log", "sh -c", "/var/tmp", "/netscaler/portal/scripts", "cron"
  )
| extend Indicator = case(
    rawmsg has "core dumped" or rawmsg has "segmentation", "Possible memory corruption crash (CVE-2026-88772)",
    rawmsg has "/netscaler/portal/scripts", "Possible webshell staging path",
    rawmsg has "/var/tmp", "Possible payload staging in /var/tmp",
    rawmsg has "sh -c" or rawmsg has "bash", "Shell execution on appliance",
    rawmsg has "/cgi/", "Probe of CGI handler path",
    "Gateway/AAA endpoint request")
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            SampleMessages = take_any(rawmsg, 3)
  by Computer, HostIP, Indicator
| order by EventCount desc

// Hunt for post-exploitation pivot from NetScaler DMZ segment
let lookback = 7d;
let dmz_prefixes = dynamic(["10.10.", "172.16.20."]); // <-- replace with your NetScaler SNIP/MIP subnets
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteIP startswith_any (dmz_prefixes)
| where LocalPort in (445, 3389, 5985, 5986, 22, 135)
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where FileName in~ ("cmd.exe", "powershell.exe", "psexec.exe", "wmic.exe", "nltest.exe", "net.exe")
    | project DeviceName, ProcTime = TimeGenerated, FileName, ProcessCommandLine, AccountName
  ) on DeviceName
| where ProcTime between (TimeGenerated .. TimeGenerated + 30m)
| project TimeGenerated, DeviceName, RemoteIP, LocalPort, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc

-- NetScaler post-exploitation hunt: webshell children, staging dirs, cron persistence
-- Run against NetScaler-adjacent Linux systems or appliance shell acquisitions
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (
    CommandLine =~ '(?i)(sh -c|bash|curl|wget|perl|python|nc |ncat)'
    AND Name =~ '(?i)^(sh|bash|dash|perl|python.*|curl|wget|nc|ncat)$'
  )
  OR Exe =~ '(?i)/var/tmp/'
  OR Exe =~ '(?i)/netscaler/portal/(scripts|templates)/'

-- Persistence and staging artifacts: recent files in high-risk paths + cron tampering
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
  '/netscaler/portal/scripts/**',
  '/netscaler/portal/templates/**',
  '/var/tmp/**',
  '/tmp/*.sh',
  '/tmp/*.pl',
  '/var/cron/tabs/*',
  '/etc/crontab',
  '/nsconfig/rc.netscaler'
])
WHERE Mtime > (now() - 1209600)  -- files modified in last 14 days
ORDER BY Mtime DESC

#!/usr/bin/env bash
# NetScaler pre-patch compromise assessment: CVE-2026-88771 / CVE-2026-88772
# Run on the NetScaler shell (drop from CLI with: shell) or via a jump box.
set -u
OUT="/var/tmp/netscaler_triage_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUT" && echo "[+] Evidence output: $OUT"

# 1) Record running build for patch-gap verification
echo "=== BUILD ===" | tee "$OUT/build.txt"
show ns version 2>/dev/null | tee -a "$OUT/build.txt"

# 2) Suspicious processes: shells/utilities parented to httpd or running from tmp
echo "=== SUSPICIOUS PROCESSES ===" | tee "$OUT/processes.txt"
ps aux | grep -Ei '(/var/tmp/|/tmp/[a-z0-9]+|bash|/bin/sh|perl|python|nc |ncat)' \
  | grep -Ev 'grep|/usr/sbin/(cron|sshd)' | tee -a "$OUT/processes.txt"

# 3) Webshell sweep in canonical staging directories
echo "=== RECENT FILES IN WEB/PERSISTENCE PATHS ===" | tee "$OUT/files.txt"
for d in /netscaler/portal/scripts /netscaler/portal/templates /var/vpn \
         /netscaler/ns_gui /var/tmp /tmp; do
  [ -d "$d" ] && find "$d" -type f \( -name '*.php' -o -name '*.pl' \
    -o -name '*.py' -o -name '*.sh' -o -name '*.cgi' \) \
    -mtime -30 -ls 2>/dev/null | tee -a "$OUT/files.txt"
done

# 4) Cron and startup persistence
echo "=== CRON / RC PERSISTENCE ===" | tee "$OUT/persistence.txt"
cat /etc/crontab 2>/dev/null | tee -a "$OUT/persistence.txt"
ls -la /var/cron/tabs/ 2>/dev/null | tee -a "$OUT/persistence.txt"
for u in /var/cron/tabs/*; do [ -f "$u" ] && { echo "-- $u"; cat "$u"; } ; done >> "$OUT/persistence.txt" 2>&1
grep -Ev '^\s*(#|$)' /nsconfig/rc.netscaler 2>/dev/null | tee -a "$OUT/persistence.txt"

# 5) Rogue SSH authorized keys
echo "=== SSH KEYS ===" | tee "$OUT/ssh_keys.txt"
for k in /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys /nsconfig/ssh/authorized_keys; do
  [ -f "$k" ] && { echo "-- $k"; cat "$k"; } | tee -a "$OUT/ssh_keys.txt"
done

# 6) Failed/successful logon anomalies in ns.log
echo "=== AUTH ANOMALIES (last 72h) ===" | tee "$OUT/auth.txt"
grep -Ei 'login|authentication' /var/log/ns.log* 2>/dev/null \
  | grep -Ei 'fail|denied|invalid|unknown user' | tail -200 | tee -a "$OUT/auth.txt"

# 7) HTTP access log review for probe/exploit paths
echo "=== SUSPICIOUS HTTP REQUESTS ===" | tee "$OUT/http.txt"
grep -Eih '(/cgi/|\.\./|/logon/LogonPoint|%2e%2e|/vpn/index|portal/scripts)' \
  /var/log/httpaccess.log* 2>/dev/null | tail -500 | tee -a "$OUT/http.txt"

echo "[+] Triage complete. Preserve $OUT before patching."
echo "[+] Next: apply Citrix fixed build per the security bulletin, then"
echo "    'kill nsconmsg -d' NOT required — instead: reboot, kill all sessions:"
echo "    > kill aaa session -all ; kill system session -all"