Citrix and Ivanti Edge Zero-Days: What to Patch Now

Citrix patched three NetScaler zero-days that attackers used before disclosure, two on 27 September and one on 4 October, and Ivanti patched a Connect Secure chain that compromised a fully patched appliance from 3 October.⁠¹⁠² If you run customer-managed NetScaler with SAML configured, or any Ivanti Connect Secure 25.1.x or 22.8 appliance, move to the fixed builds below by Friday 6 November and check the box for compromise before you close the ticket; if you run neither, confirm that with an inventory by Monday.

Three exploited NetScaler flaws landed within a week

Citrix disclosed eight NetScaler vulnerabilities on 27 September, each tracked under a CVE (Common Vulnerabilities and Exposures) identifier. Two were zero-day vulnerabilities, flaws attackers used before a fix existed: CVE-2026-88771, a remote code execution (RCE) flaw that works in the default configuration, and CVE-2026-88772, which needs DTLS (Datagram Transport Layer Security) enabled. Both score 9.5 on CVSS v4, the fourth version of the Common Vulnerability Scoring System. CISA, the US Cybersecurity and Infrastructure Security Agency, added both to its Known Exploited Vulnerabilities (KEV) catalog that day.⁠¹

Reported Rapid7's managed detection team saw the earliest exploitation attempt against CVE-2026-88771 on 20 September, a week before disclosure. That is active exploitation: a working zero-day exploit, meaning the attack code itself, used against real targets. Rapid7 had confirmed two compromised organizations by its last update. The NetScaler configuration file holds admin password hashes, TLS (Transport Layer Security) private keys and bind passwords for LDAP (Lightweight Directory Access Protocol), RADIUS (Remote Authentication Dial-In User Service) and TACACS (Terminal Access Controller Access-Control System), per Rapid7.⁠¹

The third flaw came on 4 October.

CVE-2026-88779 is a memory overflow in SAML (Security Assertion Markup Language) processing, rated 8.7: input larger than the memory set aside for it spills into neighboring memory. Rapid7 reports each attempt crashes the SAML service and the sixth crash reboots the appliance. Citrix disclosed it as exploited, and CISA listed it the same day.⁠¹

The 4 October fix builds still hit the 8 October SAML flaw

Citrix's 8 October bulletin CTX697191 covers CVE-2026-107406, a memory overflow that can lead to RCE or denial of service (DoS), where the attacker knocks the appliance offline. It scores 9.5 and applies only to appliances configured as a SAML service provider (SP), the application that accepts a login, or identity provider (IdP), the system that vouches for the user.⁠³

Builds from 14.1-73.37 through 73.41 and 13.1-64.23 through 64.28 are affected when the appliance acts as a SAML IdP. Older builds are affected in either SAML role.⁠³ The 4 October fixes for CVE-2026-88779 (14.1-73.41 and 13.1-64.28) sit inside that range.⁠¹⁠³

If you stopped at the 4 October build and run SAML as an IdP, you are not done.

Ivanti's chain beat a fully patched appliance

Reported Volexity found the chain on 5 October while investigating a customer whose Connect Secure appliance ran 22.8R2.4, the latest build at the time. Its digital forensics, the reconstruction of events from disks, memory and logs, show exploitation from 3 October.⁠² Defused told BleepingComputer it saw first signs on 1 October.⁠⁴

The attacker ran an exploit chain, several flaws used in sequence: an authentication bypass (skipping the login check), a file-write vulnerability that gave code execution, and a privilege escalation to root (limited access becomes full control). Ivanti tracks the first two as CVE-2026-104935 and patched them on 13 October. The escalation became CVE-2026-111357, patched on 29 October.⁠² The Canadian Cyber Centre records CISA adding CVE-2026-104935 to KEV on 13 October, and CVE-2026-111357 and CVE-2026-118527 on 30 October.⁠⁵ SecurityOnline calls CVE-2026-118527 a third chained flaw.⁠⁶

Volexity found no web shell, a script planted to run commands remotely, and no backdoor, a hidden way back in. The attacker re-ran the exploit for every command and trimmed log entries, so Ivanti's Integrity Checker Tool, which compares files against a known-good state, saw nothing. After access, the attacker went for directory secrets: the appliance's LDAP service account, LAPS local-admin passwords and BitLocker recovery keys. Volexity assesses with low confidence that the motive is criminal, not espionage.⁠²

A clean integrity check does not mean a clean appliance.

Who is affected, and on which builds

Citrix's bulletin covers customer-managed appliances only. Cloud Software Group upgrades its own managed cloud services, and Secure Private Access Hybrid deployments that use affected NetScaler instances need the upgrade too.⁠³ Both products are internet-facing assets: systems any host on the internet can reach. Per SecurityOnline, Ivanti 22.7.x and earlier do not contain the chained flaws.⁠⁶

Measured Shadowserver tracked more than 5,500 exposed Connect Secure instances on 13 October. BleepingComputer notes it can't say how many are honeypots or already secured.⁠⁴

Exploitation status should set your patch order

Opinion Rank by exploitation, not by score. CVE-2026-88779 rates 8.7 and was exploited. CVE-2026-107406 rates 9.5 and has no exploitation stated. Apply the security patch for both, and run threat hunting, the search of your own systems for attacker traces, on the first. Here the lower-scoring flaw was the one attackers used, and why severity scores aren't enough takes the same ranking problem to a full month of Microsoft patches.

What we don't know: Citrix's bulletin does not state whether CVE-2026-107406 is exploited, and I found no report that it is. Ivanti says only that a limited number of customers were hit, and the count is not public. I could not open Ivanti's own advisory, so the fixed builds here come from the Canadian Cyber Centre's 30 October update of it. SecurityOnline's summary box lists different builds, and I treated it as the outlier.⁠⁵⁠⁶

Patch these builds and hunt before you close the ticket

1. Inventory every internet-facing NetScaler ADC, NetScaler Gateway and Ivanti Connect Secure appliance, and record the exact build.
2. Search each NetScaler configuration for add authentication samlAction (SAML SP) and add authentication samlIdPProfile (SAML IdP), the entries Citrix names in CTX697191.⁠³
3. Upgrade NetScaler straight to 14.1-73.46, 13.1-64.29, 14.1-FIPS 73.46 or 13.1-FIPS and NDcPP 13.1.37.283, or a later release of each, skipping the intermediate builds.⁠³
4. Upgrade Connect Secure to 25.1.1.3, 25.1.3.1 or 22.8R2.6 or later, matching your release line.⁠⁵
5. Hunt on Ivanti without relying on integrity checking. Volexity advises watching for requests where the URL path and the X-DSCGI-PATH header don't match, checking /tmp for post-exploitation files, and taking memory forensics (a capture of RAM) and network forensics (packet and flow records) if you suspect a compromise.⁠²
6. Start credential rotation if you find signs of compromise: the appliance's directory service account on Ivanti, and the admin, LDAP, RADIUS and TACACS secrets and TLS keys stored in the NetScaler configuration.⁠¹⁠²

Revisit when Citrix updates CTX697191 to report exploitation of CVE-2026-107406, or when Ivanti publishes a Connect Secure build newer than 25.1.3.1 or 22.8R2.6.