eSentire Says It Traced Citrix NetScaler Exploitation to Weeks Before Disclosure

Summary

eSentire says its threat-response team traced Citrix NetScaler exploitation to September 8, before disclosure, and found activity across customer environments. The company describes its hunting, response, and detection work and recommends assessing appliance integrity.

Key points

eSentire’s Threat Response Unit says it traced exploitation of CVE-2026-88771 to September 8, nearly three weeks before Citrix disclosed it alongside CVE-2026-88772.
The company says it identified four attack clusters; the earliest hid a web shell among ordinary software files.
By September 28, eSentire says it had warned 15 exposed customers and found signs of exploitation at 10; its incident response team took over directly for two customers.
eSentire says custom detections for exploit attempts and observed attacker activity went live about 12 hours before public rule sets, with five new findings detected overnight.
The article describes later activity involving a legitimate remote-management tool and a public proof-of-concept exploit, affecting additional eSentire customers.
eSentire recommends that NetScaler ADC and Gateway operators apply Citrix fixes and assess appliance integrity, particularly for internet-facing devices that were unpatched in early September.

Article Details

Defense Focus: Hunt existing telemetry for exploitation and post-exploitation activity on NetScaler appliances, then contain compromised systems and detect new attempts.
Detection Methods: Search historical customer NetScaler telemetry for known indicators of compromise and attacker behavior.
Deploy custom detections for exploit attempts and observed follow-on activity.
Assess appliance integrity for signs of compromise, including a web shell and a hidden administrator account.
Data Sources: Customer NetScaler telemetry
Activity traces on NetScaler appliances
Rule Types: Custom detections for exploit attempts and attacker activity; rule or query format not specified
Platforms: Atlas
Global Network Deny List
MDR for Network
MDR for Log
Defensive Actions: Apply Citrix fixes after reviewing business impact.
Treat internet-facing appliances that were unpatched in early September as compromised until an integrity assessment shows otherwise.
Block known malicious indicators through Atlas and the Global Network Deny List.
Isolate affected hosts and provide incident response for confirmed compromises.
Hunt historical telemetry rather than relying only on vendor signatures or alerts.