How eSentire Responded to a Citrix NetScaler Zero-Day in One Day

eSentire's Threat Response Unit (TRU) traced exploitation of two Citrix NetScaler zero-days back to September 8, 2026, nearly three weeks before Citrix disclosed them on September 27, 2026. TRU got there by hunting backward through customer data, which showed that the evidence of what attackers did was sitting in telemetry long before any public rule existed.

On Sunday, September 27, 2026, Citrix confirmed that two NetScaler vulnerabilities were already being exploited. By noon the next day, eSentire had warned 15 exposed customers. By 4:00 PM, TRU had found signs of exploitation at 10 customers and put custom detections into production that flag new exploitation attempts as they happen, so the SOC can act on them.

A second wave of attacks followed within hours of disclosure. This case study walks through that day and what it should change about the questions you ask your own provider.

Attackers Were Inside NetScaler Appliances Nearly Three Weeks Before Disclosure

TRU's backward-looking hunt traced exploitation of CVE-2026-88771 to September 8, 2026, nearly three weeks before Citrix disclosed it alongside a second flaw, CVE-2026-88772. The two are critical vulnerabilities which let an unauthenticated attacker run code on NetScaler ADC and Gateway devices, which sit on the internet-facing edge of many networks.

With full eSentire coverage in place, a backward-looking hunt can show when attackers first arrived and what they did next. In at least one customer environment, TRU found signs of activity that may predate September 8.

Several attackers were involved. TRU identified four distinct attack clusters with different tools, and the earliest hid a web shell inside a folder of ordinary software files. A compromised gateway gives attackers a path to everything behind it, which puts the exposure well beyond the IT team. Patching doesn't evict an attacker who is already inside, so an appliance fixed after disclosure could still carry a web shell planted weeks earlier. eSentire closes this gap by hunting for attackers already inside customer environments instead of waiting for external announcements.

eSentire Hunted Customer Environments Before Any Public Detection Existed

At 8:00 AM on September 28, TRU began advising customers in plain-language what is happening and what to do about it. By 9:00 AM, known indicators of compromise, such as the addresses and file fingerprints attackers reuse, were blocked through the eSentire Atlas platform and added to the Global Network Deny List, a shared blocklist that stops traffic from known malicious sources across customer networks. From that point, customers were protected against that known attacker infrastructure. By 10:00 AM, eSentire's threat hunting team had confirmed which customers were running NetScaler, and by noon the advisory was public and those customers had been informed.

TRU began hunting at the same time. It searched every customer's NetScaler telemetry for known indicators of compromise and for attacker behavior. At 11:30 AM the results came in. For the 2 compromised customers, eSentire's incident response team took over directly. Incident response is built into eSentire MDR, so those customers had experts working in their environment without a separate engagement.

By 4:00 PM, custom detections for MDR for Network and MDR for Log were live, built to flag both the exploit attempts and the attacker activity TRU had just seen. They landed about 12 hours ahead of public rule sets. Overnight, Atlas detected and actioned 5 net-new findings. TRU also shared its intelligence with government officials the same day.

By the numbers

See TRU Threat Briefings & Advisories in Atlas

Customers can follow TRU's NetScaler advisory, and every other briefing and advisory TRU publishes, inside the Atlas platform. The advisory for this event lays out what eSentire is doing about it and what customers should do next.

Disclosure Triggered a Second Wave Within 24 Hours

Public disclosure didn't slow attackers down. Roughly 24 hours after Citrix's announcement, TRU saw a second group hit 3 eSentire customers using a legitimate remote management tool, which can make malicious activity look routine. Roughly 36 hours after disclosure, another group used a public proof-of-concept exploit, published on September 28, against 4 more customers.

The attackers' own tooling was revealing. One script created a hidden administrator account on the appliance and copied its configuration data off the device. Its web shell was disguised as ordinary stylesheet traffic. The code carried comments in the style of an AI assistant, a sign that the attackers may have used AI to write it.

Every one of these actions left traces on the appliance. A defender who watches only for the initial exploit misses the new account and the web shell that follow, which is why hunting existing telemetry matters.

A Signature-Only Response Would Have Left Those Appliances Exploited

Providers that depend on vendor feeds start when someone else finishes writing the rule. On September 27 that rule didn't exist, so there was nothing to deploy and no hunt to run. Even once a public rule ships, it only raises an alert and does nothing about an attacker who is already inside. Without a hunt and a response, compromised appliances stay compromised.

The 19 days before disclosure had already happened. The only question was who would look back at them.

Four Questions That Test a Provider's Zero-Day Response

If you are reviewing your own provider after an event like this one, start with these.

• How quickly can you tell me which of my systems are exposed? TRU mapped exposure about two hours after it started work.
• Will you search my existing data before a public rule exists? A rule catches what comes next, while a hunt finds what already happened.
• Will you tell me the same day if I'm already compromised? TRU confirmed exploitation at 10 customers within 90 minutes of starting its hunt.
• Who contains it once I've been told? eSentire's SOC isolated affected hosts on customers' behalf, so ask whether your provider acts or only alerts.

What NetScaler Owners Should Do Now

If you run NetScaler ADC or Gateway, apply the Citrix fixes after a business impact review, and move quickly. Attackers went after the public flaw within roughly 24 hours of disclosure. Treat any internet-facing appliance that was unpatched in early September as compromised until an integrity assessment shows otherwise. Our advisory has TRU's recommendations, and TRU's technical analysis covers the four clusters in detail for your security team.

eSentire customers with MDR for Network and MDR for Log are covered by the detections deployed on September 28.
 

ABOUT THE AUTHOR

Arindm Sharma Senior Web Developer

A seasoned Senior Web Developer with 7+ years of experience, specializing in React, Angular, Node.js, PHP, Craft CMS, and WordPress.

With a strong focus on UX design, I ensure every line of code contributes to a seamless user experience. My project management skills, including efficient ticket management, have proven crucial in delivering successful outcomes—especially in managing tight deadlines.

Collaborating closely with marketing operations and digital marketing teams, I've contributed to heightened online visibility through strategic SEO initiatives and meticulous AB testing analysis. Alongside these strengths, I'm known for custom web tool building to address unique challenges.