If you manage a Citrix NetScaler, the last two weeks have been rough. Between September 27 and October 8, 2026, Citrix published three security bulletins covering four serious NetScaler ADC and Gateway vulnerabilities, three of them exploited in the wild. In the middle of that, on October 6, SonicWall patched a CVSS 10.0 pre-auth flaw in its SMA1000 remote-access appliances, and researchers reported exploitation attempts within days.
Most small businesses up here don’t run NetScaler. Plenty run a SonicWall, a FortiGate, a WatchGuard or some other box that sits on the internet and lets people in from outside. The lesson from these two weeks applies to all of them: patching an edge appliance is the start of the job, not the end of it.
What happened, in order
NetScaler: CVE-2026-88771 and CVE-2026-88772 (September 27)
Citrix published bulletin CTX697096 on September 27 for two critical flaws in NetScaler ADC and NetScaler Gateway, both rated 9.5 under CVSS v4.0, and confirmed both were already being exploited. CVE-2026-88771 is a remote code execution bug that can be exploited without authentication. CISA added both to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a federal deadline of September 30.
The patch came late relative to the attacks. Mandiant and Google’s threat intelligence group said exploitation of CVE-2026-88772 began no later than early September and attributed the campaign to a suspected state-backed actor. Rapid7 recorded its earliest exploitation attempts against CVE-2026-88771 on September 20.
NetScaler: CVE-2026-88779 (October 3)
Six days later, on October 3, Citrix published CTX697174 for CVE-2026-88779, a memory overflow that only affects appliances configured as a SAML service provider or SAML identity provider. Citrix rated it 8.7 and described the impact as denial of service. CISA added it to KEV on Sunday, October 4, and gave federal agencies until Wednesday to patch.
One detail made this one worse than “just a DoS”: SecurityWeek reported on October 5 that researcher Kevin Beaumont saw exploitation attempts against honeypots that were fully patched for the September bugs. In other words, patching on September 27 didn’t take you out of the line of fire.
NetScaler: CVE-2026-107406 (October 8)
On October 8 Citrix published CTX697191 for CVE-2026-107406, another SAML-related memory overflow, rated 9.5, that could allow remote code execution or denial of service. Citrix said it knew of no unmitigated exploits when it published, and CISA updated its NetScaler alert on October 9 to tell everyone to patch it along with the earlier three. Reported fixed builds are 14.1-73.46 and 13.1-64.29 or later; FIPS and NDcPP builds have their own numbers, so check the bulletin for those.
SonicWall SMA1000: CVE-2026-102255 (October 6)
SonicWall published advisory SNWLID-2026-0017 on October 6, fixing four vulnerabilities in SMA1000 Series appliances (models 6210, 7210 and 8200v). The headline is CVE-2026-102255, a pre-authentication server-side request forgery in the Work Place interface rated 10.0. SonicWall lists no workaround; the fix is hotfix 12.4.3-03670 or 12.5.0-03082 and later.
SonicWall said it had no evidence of exploitation. Previdian’s Ryan Dewhurst told BleepingComputer its honeypots had seen exploitation attempts consistent with the flaw, and SecurityWeek reported the first attempts reached Defused’s SMA decoys on October 8, two days after disclosure. As of Friday, October 9, it was not in the KEV catalog. It’s the third pre-auth SSRF in the SMA1000 this year, and the two before it, in July and September, were both exploited and added to KEV. An SMA1000 that was fully patched in September is vulnerable today.
Why “we patched” isn’t the end of it
There are two traps here, and I see small shops fall into both.
Trap 1: patched, but already compromised. If an attacker planted a webshell or created an account before you patched, the patch doesn’t remove it. Coverage of the September NetScaler bugs said exactly that. With exploitation going back to early September, anyone who patched on September 27 or later should assume they need to look, not hope.
Trap 2: patched last week, vulnerable this week. Three NetScaler bulletins in under two weeks, three SMA1000 SSRFs in one year. If your process is “patch on the next maintenance night,” the next bulletin will beat you.
The diagram at the top is the loop I’d run for any internet-facing remote-access appliance: check exposure the same day, patch or isolate within 24 hours, then hunt.
How I’d work it
- Know what’s exposed. Keep a list of every appliance that terminates VPN, SSO or remote access from the internet, with model, firmware and who owns it. If you can’t produce that list in five minutes, start there.
- Check whether the vulnerable feature is on. The NetScaler SAML bugs only matter if SAML is configured. The SMA1000 bug is in Work Place. Knowing this tells you how hard to run, not whether to patch.
- Patch or pull it off the internet within 24 hours. For a client without in-house IT, I’d rather take a remote-access outage for an evening than leave a pre-auth bug exposed over a weekend.
- Hunt after patching. Look for unexpected files in web directories, new local admin accounts, new SSH keys, unexpected sessions and outbound connections from the appliance. Use the vendor’s indicators of compromise where they publish them.
- If anything looks wrong, rebuild. Restore from a known-good config onto a clean image, rotate every credential and key the appliance held (LDAP bind accounts, certificates, SAML signing keys), and kill active sessions.
- Ask whether it needs to be on the internet at all. For a lot of small offices, a smaller remote-access footprint with MFA in front of it is better than an appliance whose whole job is accepting connections from anyone.
Checking NetScaler configs for SAML
Citrix says the affected configurations are the ones with add authentication samlAction (SAML SP) or add authentication samlIdPProfile (SAML IdP) entries, and one write-up I read reminds admins to check every admin partition, not only the default one. If you keep config backups (you should), this checks a folder of saved ns.conf files in one pass:
#!/usr/bin/env bash
# Usage: ./saml-check.sh /path/to/netscaler-backups
# Looks for SAML SP/IdP config lines in every ns.conf under the folder,
# including admin partition configs.
set -euo pipefail
root="${1:?usage: $0 /path/to/netscaler-backups}"
[[ -d "$root" ]] || { echo "Not a directory: $root" >&2; exit 2; }
found=0
checked=0
while IFS= read -r -d '' conf; do
checked=$((checked + 1))
if hits=$(grep -nE '^add authentication (samlAction|samlIdPProfile) ' "$conf"); then
echo "== $conf"
echo "$hits"
found=1
fi
done < <(find "$root" -type f -name 'ns.conf' -print0)
if [[ $checked -eq 0 ]]; then
echo "No ns.conf files found under $root" >&2
exit 2
elif [[ $found -eq 0 ]]; then
echo "No SAML SP/IdP configuration found in $checked file(s)."
fi📝 Note: A clean result doesn’t mean “don’t patch.” CVE-2026-88771 and CVE-2026-88772 aren’t SAML-specific. It tells you which appliances to patch and hunt on first.
Watching KEV for the vendors you actually run
The KEV catalog is published as a JSON feed. I don’t want to read every addition; I want to know the same day when something I manage shows up. This Python script pulls the feed and prints anything added in the last few days for a list of vendors:
#!/usr/bin/env python3
"""Print recent CISA KEV additions for the vendors you manage.
Usage: python3 kev_watch.py [days] (default: 7)
"""
import json
import sys
import urllib.request
from datetime import date, timedelta
FEED = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
VENDORS = {"citrix", "sonicwall", "fortinet", "watchguard", "ubiquiti",
"connectwise", "microsoft", "hikvision"}
def main() -> int:
days = int(sys.argv[1]) if len(sys.argv) > 1 else 7
since = date.today() - timedelta(days=days)
with urllib.request.urlopen(FEED, timeout=30) as resp:
kev = json.load(resp)
hits = [
v for v in kev["vulnerabilities"]
if v["vendorProject"].lower() in VENDORS
and date.fromisoformat(v["dateAdded"]) >= since
]
for v in sorted(hits, key=lambda v: v["dateAdded"], reverse=True):
print(f'{v["dateAdded"]} {v["cveID"]:<18} {v["vendorProject"]} {v["product"]}'
f' (due {v["dueDate"]})')
if not hits:
print(f"No KEV additions for watched vendors since {since}.")
return 1 if hits else 0
if __name__ == "__main__":
sys.exit(main())Run it from cron each morning and send the output anywhere you’ll see it. A non-zero exit means something matched. Edit VENDORS to match what’s actually in your clients’ racks; the names have to match the feed’s vendorProject field.
The takeaway
Edge appliances are where attackers go first because they’re on the internet by design and they often hold the keys to everything behind them. The September and October bulletins show the pattern clearly: exploitation starts before the patch, then follow-on bugs land while you’re still cleaning up. Patch fast, then go look, and keep looking until the vendor goes quiet.
Sources
- Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway, CISA, September 27, 2026 (updated October 9, 2026)
- Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772, Rapid7, September 2026
- Citrix NetScaler Zero-Days Spread Mass Exploitation: Patching Won’t Remove Backdoors, Tech Times, September 30, 2026
- CISA Adds One Known Exploited Vulnerability to Catalog, CISA, October 4, 2026
- Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier, SecurityWeek, October 5, 2026
- Citrix NetScaler security snafus get even worse amid more 0-day reports, The Register, October 5, 2026
- Security Update: Immediate Guidance for CVE-2026-107406 in NetScaler ADC and NetScaler Gateway, Citrix Community, October 8, 2026
- Critical NetScaler RCE Vulnerability CVE-2026-107406, The Cyber Throne, October 9, 2026
- SonicWall SSRF bug rated 10.0 exploited in SMA1000 Appliance Work Place, SC Media, October 2026
- Critical SonicWall Vulnerability Exploited Days After Disclosure, SecurityWeek, October 2026
- Known Exploited Vulnerabilities Catalog, CISA