Citrix Security Bulletin CTX697096 (27 September 2026) confirms exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler ADC/Gateway. CVE-2026-88771 (CVSS 4.0 9.5) — improper input validation enabling unauthenticated arbitrary command execution on all ADC/Gateway deployments including default configuration (CWE-20). CVE-2026-88772 (CVSS 4.0 9.5) — memory overflow RCE/DoS when DTLS is enabled (default on VPN vServer; CWE-119).

Bulletin also ships CVE-2026-88773–88778 (smuggling / policy bypass / memory overflow / TCP ISN). Affected: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; FIPS/NDcPP trains as in bulletin; SPA Hybrid NetScaler instances likewise. Customer-managed only.

UPDATE 27–28 Sep 2026: CISA Alert (27 Sep) and CISA KEV (dateAdded 2026-09-27) list CVE-2026-88771 and CVE-2026-88772 with FCEB due 30 Sep 2026 and forensic-triage required under BOD 26-04 — preserve evidence before patching (updates can erase forensic visibility); use NetScaler Console IoC checks as supporting telemetry.

UPDATE 28 Sep 2026: ASD’s ACSC Critical alert (first published / last updated 28 Sep 2026) covers the eight CVEs, states at least CVE-2026-88771 and CVE-2026-88772 were under active exploitation globally before a patch was available, and notes ACSC has not yet received reports of confirmed exploitation in Australia.

UPDATE 29 Sep 2026: WA SOC advisory 20260929001 (TLP:CLEAR) restates Citrix NetScaler ADC/Gateway/FIPS CVEs including CVE-2026-88771/88772 (CVSS 9.5) through CVE-2026-88778, notes CISA KEV listing, and states WA SOC has not received reports of exploitation on Western Australian Government networks at time of writing; recommends vendor patches within expected timeframes. Primary: Citrix CTX697096; AU: ACSC Critical 28 Sep + WASOC 20260929001; KEV/alert: CISA.

UPDATE 29 Sep 2026 — BleepingComputer citing Mandiant and GreyNoise post-exploitation: attackers exploited the zero-day window (Mandiant: began at least early September; NA/EU victims across government, financials, education, legal, professional services) to deploy custom web shells and tunneling malware, gain root, steal credentials and move internally. GreyNoise observed 149.104.78.141 attempting exploitation on 24 Sep (pre-disclosure): setuid/setgid on /bin/sh, password-protected PHP webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver, httpd aliases mapping receiver.min.css / receiver.min.[hex].css to the hidden PHP handler; webshell SHA-256 published in GreyNoise “Swarming Against Citrix 0-Day Exploitation”.

Mandiant CTO (LinkedIn via Cybersecurity Dive): hunt compromise before/while patching — webshells can survive upgrade/HA sync. Hunt IoCs on both HA nodes; preserve evidence per CISA BOD 26-04.

UPDATE 29–30 Sep 2026: watchTowr (29 Sep) published a technical analysis of CVE-2026-88772 as a DTLS handshake-reassembly / scratch-buffer memory overflow on NetScaler Packet Processing Engine paths; reiterates DTLS is enabled by default on VPN virtual servers unless administrators set -dtls OFF.

Same write-up restates Citrix guidance that CVE-2026-88778 (predictable TCP ISN) is addressed by enabling Enhanced ISN Generation — not by the firmware upgrade alone.

Desk does not reproduce exploit construction; use vendor bulletin + watchTowr for defender context.

UPDATE 30 Sep 2026: Mandiant/Google TI (via BleepingComputer 29 Sep and The Register 29 Sep) name the post-exploit toolkit as WHIPSHOT (PHP web shell disguised as a Debian package in the NetScaler VPN scripts directory; HTTP transport bridge hiding Base64 C2 in native HTTP headers) and SLAPSHOT (Python TCP tunneling tool that accepts WHIPSHOT commands and forwards arbitrary TCP streams to internal hosts — used in at least one intrusion for manual recon and credential theft). Sector impact restated: government, financial services, education, legal and professional services in North America and Europe.

Mandiant CTO: examine for compromise before/while patching — patching alone may not eradicate the actor.

UPDATE 30 Sep 2026 (desk 1 Oct 10:00 Perth): ASD’s ACSC Critical alert (first published 28 Sep; last updated 30 Sep 2026) now states that since the 28 Sep publication it has received reports from Australian organisations confirming exploitation. ACSC recommends reviewing for evidence of compromise since at least 4 September 2026; Citrix IoCs via NetScaler Console and Security Bulletin for CVE-2026-88771 through CVE-2026-88778.

UPDATE 1 Oct 2026 (desk 13:00 Perth): LevelBlue THOR (via The Hacker News 1 Oct) documents post-exploitation across customer NetScaler environments weaponizing CVE-2026-88771 with attacker-controlled authentication usernames containing pitboss / NSPPE strings. Observed follow-ons: curl/wget payload fetch from 64.94.85[.]67:443/update_c08937.pl and 31.56.197[.]72:9090/lula; Python reverse shell main.py to 45.141.21[.]130:443 that kills /var/python/bin/customsnmpd; Perl update_c08937.pl creates local superuser sec_monitor, archives /flash/nsconfig to /tmp/update_result_3567cs.tgz for exfil, chmod 6555 on /bin/sh, deploys PHP webshell at /var/netscaler/logon/LogonPoint/.local_journal, and maps it via httpd.conf to CSS-like URLs (aligns with GreyNoise receiver.min.css-style mapping already on this card).

Hunt these paths/accounts/IoCs alongside WHIPSHOT/SLAPSHOT. Lead paragraph supersedes the still-present Background sentence that said ACSC had not yet received AU confirmation. Wire: Cyber Daily 1 Oct. exploited_au flipped to yes on this pass.

UPDATE 3 Oct 2026: ACSC Critical alert last updated 3 October 2026 adds a newly identified NetScaler SAML authentication issue (crashes/DoS/potential exploitation; AU organisations impacted) that ACSC says is separate from CVE-2026-88771/88772 — see desk card citrix-netscaler-saml-acsc-20261003. CVE-2026-88771/88772 patch/hunt guidance unchanged (hunt since ≥4 Sep; IoCs via NetScaler Console).

UPDATE 13 Oct 2026 (desk 19:00 Perth): Binary Defense (blog 'Platypwned', published 12 Oct US time) describes an incident-response case on two NetScaler appliances that a triage collection flagged while the customer was upgrading. One showed exploitation but no dropped files; on the other, attackers who had abused CVE-2026-88771/88772 delivered a private, modified fork of the open-source Go remote-admin tool Platypus, compiled for FreeBSD and disguised as a Perl file (one sample named .ns_09343.pl, actually an ELF binary).

It was installed with a one-shot curl | sh script carrying a single-use enrolment token, which Binary Defense found in ns.log; paths included /var/tmp/, /netscaler.local/ and a .ns-cache folder under /var/core/. Binary Defense believes registration with the attacker's server failed on that appliance. The fork adds privilege-escalation, persistence disguised as a health monitor, and anti-forensic timestamp/cleanup modules that are not in the public project; agents were built on 28 Sep 2026 and the C2 ingress certificate issued the same evening.

C2/staging domain: entretiensol[.]com (agent path /v1/artifacts/<os>/<arch>/latest); related infrastructure named: white-guard[.]pro, gurerasfalt[.]com, garyvard[.]com, hickoryusedauto[.]com.

SHA-256 hashes are in the Binary Defense post. eSentire separately reported Platypus enrolment against three customers on 28 Sep from the same C2. Cyber Security News wire 13 Oct. No new Citrix or ACSC guidance; patch builds unchanged.