Saint PitScaler, Who Digs Pits in the Perimeter

Patron of VPN gateways, Citrix admins who haven't unpacked their bags since the last time, and everyone who patches but never hunts for backdoors.

Life

At the end of September 2026 Citrix published a bulletin with eight CVEs for NetScaler ADC and Gateway, two of them already exploited before the patch: CVE-2026-88771 let anyone run commands without authentication, CVE-2026-88772 was a memory overflow in DTLS. Kevin Beaumont named it PitScaler, CISA added it to its catalogue of exploited flaws at once, and the script was the familiar one: boxes breached before the patch, and backdoors the patch does not remove.

Prayer

O Saint PitScaler, who digs pits right on the drawbridge, let our gateways be patched before anyone falls in. Amen.

How to celebrate

Celebrated by upgrading NetScaler to at least 14.1-73.46 or 13.1-64.29 and then hunting for backdoors: the patch closes the door, it does not evict whoever is already inside.

On PitScaler's day, whoever falls in the pit finds company already there.