Two NetScaler Zero-Days, One Wrong Assumption: Why Patching Does Not Close the Incident

On September 27, 2026 Citrix disclosed two critical NetScaler ADC/Gateway vulnerabilities (CVE-2026-88771 and CVE-2026-88772, CVSS 9.5) that were actively exploited prior to disclosure; one allows unauthenticated arbitrary command execution on default configurations and the other is a DTLS memory overflow enabling RCE or DoS. The report documents an early-September exploitation timeline, public PoC release and rapid mass scanning, observed post-exploitation persistence (password-protected PHP webshells, setuid /bin/sh, tunneling/proxying to C2 at 138.199.200.90 and DNS beaconing to *.instances.httpworkbench.com), recommended forensic evidence collection before patching, fixed builds, and a seven-step investigation and remediation process.