Citrix NetScaler Zero-Day: Three Weeks Without a Patch

Citrix left customers exposed to two live zero-days for three and a half weeks. Rob Maas sits down with ON2IT CTI specialist Lars Nobelen to break down how attackers exploited CVE-2026-88771 and CVE-2026-88772 on Citrix NetScaler appliances, why a single log injection bug let them run arbitrary commands, and what actually stopped the attacks before the patch ever arrived.(00:00) - Cold open: three and a half weeks without a patch (00:19) - Meet CTI specialist Lars Nobelen (01:28) - Exploitation timeline: fingerprinting in August to the patch in September (03:09) - Two zero-days: how the log injection technique worked (05:02) - Gaining persistence with disguised web shells (09:10) - Why SSL inspection blocked the exploit before the patch existed (12:17) - Advice: rebuild, patch, and prepare for the next edge device Key Topics CoveredAnatomy of the two Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772) and the log injection technique behind themWhy exploitation outpaced the patch timeline by over three weeks, and what that gap cost defendersHow SSL/TLS inspection on the firewall blocked exploitation attempts before a patch was availableWhy Citrix's own indicator-of-compromise script could miss an active web shellLessons for any edge device: disabling unused features, network segmentation, and inbound decryptionRelated ON2IT Content & Referenced ResourcesThreat Talks – Citrix NetScaler: Does Remote Work (2024): https://threat-talks.com/citrix-netscaler-zero-day-three-weeks-without-a-patch/ CVE-2026-88771: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htmlCVE-2026-88772: https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.htmlWhy SSL Decryption Matters: https://www.youtube.com/watch?v=Xv_jVHVsD9w NCSC.nl advisory on Citrix NetScaler: https://advisories.ncsc.nl/2026/ncsc-2026-0394.htmlZ-CERT (Dutch healthcare sector) advisory: https://z-cert.nl/actueel/nieuws/z-cert-waarschuwt-zorgsector-voor-kritieke-citrix-kwetsbaarhedenSubscribe to Threat Talks and turn on notifications for deep dives into the world's most active cyber threats and hands-on exploitation techniques. 🔔 Follow and Support our channel! 🔔 === ► YOUTUBE: / @threattalks ► SPOTIFY: https://open.spotify.com/show/1SXUyUE... ► APPLE: https://podcasts.apple.com/us/podcast... 👕 Receive your Threat Talks T-shirt https://threat-talks.com/ 🗺️ Explore the Hack's Route in Detail 🗺️ https://threat-talks.com 🕵️ Threat Talks is a collaboration between @ON2IT and @AMS-IX