Citrix NetScaler ADC va Gateway qurilmalari CVE-2026-88771 orqali faol hujum ostida — bu tanqidiy, autentifikatsiyasiz masofaviy kod bajarish (RCE) zaifligi bo‘lib, uni ishga tushirish uchun hech qanday ixtiyoriy funksiyani yoqish shart emas.
ThreatLabz kuzatishicha, hujumchilar jurnallarni zaharlab buyruq bajarilishini ishga tushirishgan, veb-qobiqlar (web shells) joylashtirishgan va FreeBSD x64 implantini o‘rnatishga urinishgan.
Citrix zaiflikni 2026-yil 27-sentabrda e’lon qildi va uni noto‘g‘ri kiritish tekshiruvi (improper input-validation) zaifligi deb ta’rifladi.
Sotuvchi CVSS v4.0 bo‘yicha 9.5 ball berdi; NVD ham shu ballni tasdiqlaydi va autentifikatsiyasiz hujumchi ixtiyoriy buyruqlarni bajarishi mumkinligini qayd etadi.
Citrix ma’lumotiga ko‘ra, himoyalanmagan (unmitigated) qurilmalarda ekspluatatsiya kuzatilgan va CISA zaiflikni Ma’lum Ekspluatatsiya Qilingan Zaifliklar (Known Exploited Vulnerabilities) katalogiga qo‘shgan.
So‘rovlar kodlangan yukni HTTP kirish jurnallariga joylashtirish uchun mo‘ljallangan; User-Agent mazmunining o‘zi bajarish triggeri emas edi.
Keyin hujumchilar soxta Packet Processing Engine (PPE) nosozlik xabarlarini o‘z ichiga olgan maxsus kirish so‘rovlarini yuborishgan.
Xabarlarga qo‘shilgan buyruqlar HTTP jurnallarida INDEX: belgisini qidirgan, yukni ajratib dekodlagan va uni shell’ga uzatgan.
ThreatLabz tahliliga ko‘ra, hujumchilar yuk yetkazib berishni bajarishdan ajratishgan. Avval ular INDEX: bilan boshlanadigan va Base64-kodlangan buyruqlar bilan davom etadigan User-Agent bilan umumiy NetScaler yo‘llariga GET so‘rovlarini yuborishgan.
CVE-2026-88771 orqali NetScaler qurilmalarini buzish hujum zanjiri (Manba: Zscaler).
CERT-EU ham xuddi shu umumiy texnikani mustaqil ravishda hujjatlashtirgan: hujumchi nazoratidagi mazmun jurnallarga joylashtirilgan, so‘ngra zaif diagnostik ishlov berish orqali unga yetib borilgan.
Zaiflik NetScaler diagnostik Perl skriptining mos PPE nosozlik yozuvlarini qanday ishlashida yotadi.
U tizim jurnallarida “PPE missed too many heartbeats” yoki “PPE unexpectedly died” kabi xabarlarni qidiradi, so‘ngra tanlangan yozuvni hujumchi nazoratidagi mazmunni yetarlicha qochirmasdan (escaping) shell buyrug‘iga kiritadi.
CERT-EU xabar berishicha, skript oxirgi mos kelgan yozuvni tanlaydi, bu esa takroriy trigger urinishlarini tushuntiradi: hujumchilar o‘zlarining soxta qatorini qayta ishlanishini ta’minlashga harakat qilishadi.
Dekodlangan bosqichli buyruqlar qurilmaning bir nechta veb-kataloglarida fayllar yaratishga, PHP yoki Perl CGI’ni yoqishga va veb orqali kirish mumkin bo‘lgan skriptlarni o‘rnatishga urinishgan.
ThreatLabz shuningdek, Rust asosidagi FreeBSD 64-bit binar faylini yuklab ishlatadigan inline buyrug‘ni ham kuzatgan.
Bu xatti-harakatlar buyruq bajarish va doimiylik (persistence) o‘rnatish urinishini ko‘rsatadi, lekin kuzatilgan urinishlar har bir nishon qurilma muvaffaqiyatli buzilganini isbotlamaydi.
FreeBSD yuk (payload) ThreatLabz Adobe Commerce va Magento’da CVE-2026-75650 (StyleSmuggler deb nomlangan) zaifligini ekspluatatsiya qilgan hujumlar bilan ham bog‘liq bo‘lgan infratuzilmadan olingan.
Bu o‘xshashlik umumiy operatorlar, zararli dastur tarqatish infratuzilmasi yoki qayta ishlatilgan hostingni ko‘rsatishi mumkin. Bu o‘z-o‘zidan ikkala kampaniyani bir xil tahdid aktori o‘tkazganini isbotlamaydi.
Alohida Citrix muammosi — CVE-2026-107406 — SAML xizmat provayderlari yoki identifikatsiya provayderlari sifatida sozlangan ayrim NetScaler qurilmalariga ta’sir qiladi va RCE yoki xizmatdan voz kechish (denial of service) holatiga olib kelishi mumkin.
Citrix byulleteni 14.1-73.46 va 13.1-64.29 kabi tuzatilgan qurilishlarni (fixed builds) ko‘rsatadi; tashkilotlar bu maslahatni CVE-2026-88771 hujum zanjirining bir qismi deb emas, alohida baholashlari kerak.
CVE-2026-88771 uchun Citrix quyidagi tuzatilgan relizlarni ro‘yxatga olgan: 14.1-73.37 va undan yuqori, 13.1-64.23 va undan yuqori, 14.1-73.37 FIPS va undan yuqori, hamda FIPS va NDcPP uchun 13.1.37.279.
Administratorlar tegishli mahsulot shoxini tekshirib, sotuvchi tavsiya etgan qurilishni o‘rnatishlari kerak.
Potensial buzilgan qurilmani yangilashdan oldin mavjud sud-tibbiy dalillarni, jumladan tegishli jurnallar, qo‘llab-quvvatlash to‘plamlari (support bundles) va yadro damplarini (core dumps) saqlab qoling.
So‘ngra shubhali tizimlarni tegishlicha ajratib oling va shubhali INDEX: User-Agent qiymatlari, soxta PPE nosozlik xabarlari, kutilmagan veb fayllari, HTTP konfiguratsiyasidagi o‘zgarishlar, shubhali jarayonlar va notanish chiquvchi ulanishlar bo‘yicha tekshiring.
Agar buzilish tasdiqlansa, qurilma orqali kirish mumkin bo‘lgan ma’lumotlar va boshqa maxfiy ma’lumotlarni (credentials va secrets) aylantiring (rotate).
IOC’lar
Manba IP manzillari 45.153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[.]119
Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola yaratishni oldini olish maqsadida ataylab defang qilingan (masalan, [.]). Faqat nazorat qilinadigan tahdid razvedkasi platformalarida, masalan MISP, VirusTotal yoki SIEM tizimingizda qayta fang qiling.
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled.
ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant.
Citrix disclosed the vulnerability on September 27, 2026, describing it as an improper input-validation vulnerability.
The vendor assigned a CVSS v4.0 score of 9.5; NVD lists the same score and confirms that an unauthenticated attacker can execute arbitrary commands.
Citrix says exploitation has been observed against unmitigated deployments, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
The requests were designed to place the encoded payload in HTTP access logs; the User-Agent content itself was not the execution trigger.
Attackers then submitted crafted login requests containing forged Packet Processing Engine failure messages.
Commands appended to the messages searched HTTP logs for the INDEX: marker, extracted and decoded the payload, and passed it to a shell.
ThreatLabz’s analysis said that, attackers separating payload delivery from execution. First, they sent GET requests to common NetScaler paths with a User-Agent beginning INDEX: and followed by Base64-encoded commands.
Attack chain exploiting CVE-2026-88771 to compromise NetScaler appliances (Source : Zscaler).
CERT-EU independently documented the same general technique: attacker-controlled content was planted in logs, then reached through vulnerable diagnostic processing.
The vulnerability lies in how a NetScaler diagnostic Perl script handles matching PPE failure records.
It searches system logs for messages such as “PPE missed too many heartbeats” or “PPE unexpectedly died,” then incorporates a selected record into a shell command without adequately escaping attacker-controlled content.
CERT-EU reported that the script selects the last matching entry, which helps explain repeated trigger attempts: attackers try to ensure their forged line is the one processed.
The decoded staged commands attempted to create files across several appliance web directories, enable PHP or Perl CGI, and install web-accessible scripts.
ThreatLabz also observed an inline command that downloaded and ran a Rust-based FreeBSD 64-bit binary.
These behaviors indicate an effort to establish command execution and persistence, but observed attempts alone do not prove that every targeted appliance was successfully compromised.
The FreeBSD payload was retrieved from infrastructure that ThreatLabz had also associated with attacks exploiting CVE-2026-75650, dubbed StyleSmuggler, in Adobe Commerce and Magento.
The overlap may point to shared operators, malware distribution infrastructure or reused hosting. It does not, by itself, establish that the same threat actor conducted both campaigns.
A separate Citrix issue, CVE-2026-107406, affects certain NetScaler appliances configured as SAML service providers or identity providers and can lead to RCE or denial of service.
Citrix’s bulletin specifies fixed builds including 14.1-73.46 and 13.1-64.29; organizations should assess that advisory separately rather than treating it as part of the CVE-2026-88771 attack chain.
For CVE-2026-88771, Citrix lists these fixed releases: 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1.37.279 for FIPS and NDcPP.
Administrators should verify the applicable product branch and install the vendor-recommended build.
Before updating a potentially compromised appliance, preserve available forensic evidence, including relevant logs, support bundles, and core dumps.
Then isolate suspected systems as appropriate and investigate for suspicious INDEX: User-Agent values, forged PPE failure messages, unexpected web files, changes to HTTP configuration, suspicious processes and unfamiliar outbound connections.
If compromise is confirmed, rotate credentials and other secrets accessible through the appliance.
IOCs
Source IPs 45.153.212[.]101 46.233.40[.]20 46.236.167[.]143 46.33.33[.]95 49.150.197[.]119
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.