The NetScaler zero-days were exploited for weeks before anyone could patch them. For a target exposed in that window, diligence has to ask who got in, not only whether the fix is installed.
On 27 September 2026, BleepingComputer reported that Citrix had confirmed two critical NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, each rated CVSS 9.5, as exploited zero-days, and had released fixed builds for NetScaler ADC and NetScaler Gateway. Citrix found the flaws while investigating incidents in customer environments. The Dutch NCSC-NL said exploitation had been identified at multiple Citrix customers worldwide.
Two days later, BleepingComputer reported, citing Mandiant, GreyNoise and watchTowr, that the attacks began in early September, weeks before public disclosure. Attackers gained root access and deployed web shells disguised as CSS files and Debian packages, along with a tunnelling tool and the means to steal credentials. Targeted sectors included government, financial services, education, legal and professional services in North America and Europe. The recommended response had two parts: install the updates, described as the only complete fix, and inspect appliances for the published forensic indicators of compromise.
That second instruction is the one a deal team should read closely.
The diligence question moves from posture to history
For a target that ran an internet-facing appliance through that window, “is it patched?” and “was anyone inside before the patch?” are separate questions, and they need separate evidence. A patch closes the door. It says nothing about who already came through it.
A posture report dated before 27 September is silent on the second question. One dated after can mislead, because a line reading “patched” looks like a closed item. The history question is answered by a compromise assessment scoped to the exposure window, and that assessment is only as good as the logs covering the window. If the target’s appliance and network logs for early September have already rolled off, “no evidence of compromise” means “no evidence available”. That is a different finding. It belongs in the diligence report as an evidence gap, not as a clean result.
Telling those two statements apart takes judgement, and it works best when the diligence team and the deal team agree in advance what a “no findings” conclusion has to contain: the systems examined, the window covered, and the log retention that made the window visible. Agreed late, the same words can carry two very different levels of comfort.
The window is longer than the disclosure suggests
Edge infrastructure is where much of the exploitation now happens. Verizon’s 2025 Data Breach Investigations Report found exploitation of vulnerabilities was the initial access vector in 20 percent of breaches, and edge devices and VPNs made up 22 percent of those exploitation cases, up from 3 percent the year before. Only about 54 percent of edge-device vulnerabilities were fully remediated, with a median of 32 days to do so.
Detection does not close the gap quickly either. IBM’s Cost of a Data Breach 2025 puts the mean time to identify a breach at 181 days, and the mean time to identify and contain at 241 days. Mandiant’s M-Trends 2026 reports a global median dwell time of 14 days, up from 11. The two describe different populations, IBM’s broad and Mandiant’s drawn from its own investigations, so they should not be read as one curve. Both point the same way: the moment a fix ships is not the moment a buyer can stop asking.
For this flaw, the attacker’s head start began before any advisory existed. A target that patched within hours of disclosure still spent part of September exposed to a working exploit, with no signature to look for and no reason to look.
The Starwood case shows where the liability lands
A widely cited precedent is several years old, which is part of its value. Attackers gained access to the Starwood Hotels guest reservation network in 2014. Marriott acquired Starwood in 2016. The intrusion was not discovered until September 2018, and about 339 million guest records worldwide were affected.
In July 2019, the UK Information Commissioner’s Office announced its intention to fine Marriott about 99 million pounds, and said its investigation found Marriott “failed to undertake sufficient due diligence when it bought Starwood”. The Information Commissioner, Elizabeth Denham, said accountability for personal data can include “carrying out proper due diligence when making a corporate acquisition”. The final fine, in October 2020, was 18.4 million pounds, and it related only to failures from 25 May 2018, when GDPR came into force.
The lesson for a buyer is specific. The intrusion began on the seller’s watch, yet the penalty fell on the buyer, for failures in a period when the systems were already the buyer’s. An inherited intrusion becomes the acquirer’s own failure from the day it takes control, and that exposure keeps accruing for as long as the intrusion goes undetected after closing.
What changes the decision
Scope. Internet-facing remote-access and application-delivery appliances are visible from outside, before any data room opens. That makes them the kind of public signal worth checking before the LOI. Where a target ran an affected appliance through the window, a compromise assessment of those appliances, scoped to the exposure period and the published indicators, belongs in diligence. Tightly scoped, it is quick and inexpensive relative to the transaction.
Timing. Under exclusivity, before signing. Matters known to the buyer at signing generally fall outside warranty and indemnity cover, so a finding made in diligence has to be dealt with in the price or a specific indemnity, and those are only negotiable before the signature. After signing, the buyer’s levers narrow to interim covenants, access rights and closing conditions. The order in which the facts are established decides a good deal of who carries the loss.
Contract and price. Where the assessment cannot reach a clean answer because the logs are gone, the gap is a risk to be priced, not a finding to be footnoted. That can mean a specific indemnity for pre-closing intrusions on the named systems, an escrow or holdback sized to the exposure, and a post-closing obligation to complete the forensic review before the target’s network is connected to the buyer’s.
Occasionally, go or no-go. Confirmed attacker presence with root access and stolen credentials, in a target whose value rests on its data or its customers’ trust, is a different asset from the one in the model. Some committees will reprice it. Some should walk away.
What the investment committee should see
For any target that ran an affected appliance during the exploitation window, four answers belong on the page. Was the appliance exposed during the window? What was examined, and against which indicators? What period do the logs actually cover? What did “no findings” mean in practice, a clean result or an absence of evidence?
Each is a specific, checkable statement. A diligence report that shows a “patched” status and none of the four has answered the question about today’s posture, and left open the question that could change the price.