Citrix NetScaler: CVE-2026-88779, a third pre-auth RCE that also hits the 88771/88772-patched builds — CISA KEV
> TL;DR: CISA added a third Citrix NetScaler flaw to the Known Exploited Vulnerabilities. CVE-2026-88779: pre-authentication arbitrary code execution via a race condition in the Web Interface session manager, CVSS 9.1 — and it also affects the builds already fixed for 88771/88772 (14.1-73.37, 13.1-64.23). watchTowr has a PoC, GreyNoise observed the first exploitations on October 1, and 43,812 instances remain exposed. CISA deadline: October 30, 2026.
A flaw that hits the versions that were fixed
Three flaws, three CVSS 9.x, the same gateway, the same pre-auth entry. If you patched 88771/88772 on September 30 and have done nothing since: you are still vulnerable.
The mechanism: two requests, one dead object
The race condition concerns Web Interface session objects. A session is created by an authentication request; a second request — concurrent, on another thread — manipulates the object after it has been freed. Result: write to freed memory, control of execution, code as root.
watchTowr's PoC sends two concurrent POSTs to \/nf/auth/doAuthentication.do\\ with an \X-Nitro-Session-Purge\\ header on the second one. No session, no cookie, no token — the same pre-auth entry as 88771.
The lesson is structural: this time it is not an input that becomes a shell command, it is a concurrency defect. Scanners that test inputs do not find it. You need the patch, and the verification.
Exploitations are already observed
185.220.101.74\\. Observed behavior: creation of \/var/tmp/ns_sess\\ then execution as root, POSTs to \/nf/auth/doAuthentication.do\\ at a 3 ms interval — the signature of a race condition.What to check now
/nf/auth/doAuthentication.do\\ at intervals under 10 ms, \/var/tmp/ns_sess*\\ files, unexpected local accounts.The lesson
A single CVE is a snapshot of the gateway's state, not of its code. 88771, 88772, 88779: same entry point, three mechanisms, three patches. When a vendor ships three pre-auth RCEs on the same module in ten days, the question is no longer "which version am I running?" — it is "who is testing my gateway, and how often?"
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Citrix NetScaler: two pre-auth RCEs, 50,277 exposed instances, CISA deadline Sept 30
CISA lists CVE-2026-88771 and CVE-2026-88772 in the Known Exploited Vulnerabilities: pre-authentication code execution on NetScaler ADC and Gateway, CVSS 9.5. watchTowr has a PoC, GreyNoise observed the first exploitations on September 24, and over 50,000 instances remain exposed.
FortiMail: a pre-auth RCE in the POP3 service (CVE-2026-44812) joins the CISA KEV
Heap buffer overflow in the FortiMail POP3 service: unauthenticated code execution, CVSS 8.8. CISA lists it in the KEV on October 2 (deadline October 30). Fixed in 7.6.6 and 8.0.4 — 9,412 instances remain exposed per Palo Alto Unit 42.
Palo Alto PAN-OS: CVE-2026-0322 exploited, no workaround, and three days for federal agencies
CISA adds CVE-2026-0322 to the KEV on October 14: code execution on the PAN-OS management interface, exploited in limited attacks. No known workaround, fixes per branch, federal deadline October 17.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.