Citrix patches two NetScaler zero-days that attackers used before any fix existed
Citrix shipped fixes on September 27 for NetScaler flaws CVE-2026-88771 and CVE-2026-88772, both rated 9.5 and exploited on unpatched appliances. Exploitation began before the fix, at a date Citrix has not given, so affected appliances need an intrusion check as well as an upgrade.
The Watch · Security desk
What happened
- On September 26, administrators said IT providers and security teams were privately telling them to take NetScaler systems offline, sometimes without saying why.
- The Dutch NCSC pre-notified organisations, and a notice seen by BleepingComputer said one of the flaws could let an attacker inject shellcode directly into memory.
- CVE-2026-88771 lets an unauthenticated attacker run arbitrary commands on any ADC or Gateway deployment in the affected versions, with no extra feature required.
- CVE-2026-88772 is a memory overflow on appliances with DTLS enabled, and DTLS is on by default for Gateway VPN virtual servers unless an administrator turned it off.
- Builds 14.1-73.32 and 13.1-63.21, installed last month to fix CVE-2026-19490, are still in the affected range for both new flaws.
Why it matters
- Who has to decide decision Response plans that wait for a Citrix advisory before pulling an edge appliance moved a day behind teams that acted on the provider and CERT warnings, some of which gave no reason.
- Who's exposed exposure Appliances marked current after the August CVE-2026-19490 upgrade are exploitable, so a compliance check keyed to last month's patch reports vulnerable devices as safe.
- What it limits constraint Turning off DTLS closes CVE-2026-88772 alone; CVE-2026-88771 works on any affected build with no optional feature, so it stays open until the appliance is upgraded or taken offline.
Administrators started getting private advice to pull NetScaler systems offline on September 26 [3]. Citrix published fixes on September 27 [7], a day later [17]. The company has not said when exploitation started, how many organisations were affected or who was behind the attacks [8]. Security Affairs, which reported the timeline, said the attacks were already under way while defenders waited for official details and fixes [16]. watchTowr said the vulnerabilities had been found during forensic investigations [5]. That means they turned up inside intrusions someone was already investigating. A team that pulled its gateways on the 26th cannot assume they were clean that morning [8].
Until the advisory, the evidence moved through private channels and rumour. "We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible," watchTowr wrote on X [15]. Citrix's advisory then confirmed it: "Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible." [9] The same release fixed six other issues, so it covered eight in all [18].
The fixed builds are 14.1-73.37 and later and 13.1-64.23 and later. Citrix also shipped fixes for the 14.1-FIPS, 13.1-FIPS and 13.1-NDcPP branches [13]. NetScaler handles VPN and remote access, load balancing and authentication [12]. An attacker who controls one sits at the edge of the network it serves [12].
Security Affairs reports that the September flaws are unrelated to CVE-2026-19490 and CVE-2026-19489, which were disclosed in August [4]. Citrix has now shipped NetScaler fixes for separate bugs in consecutive months [4][14].
What to watch
- Indicators of compromise or a first-exploitation date from Citrix, watchTowr or the Dutch NCSC; either one sets how far back owners have to search their logs.
- A public technical write-up or proof of concept for CVE-2026-88771, the unauthenticated command-execution bug that needs no optional feature.
- A victim count or attribution from Citrix or a national CERT, the first evidence on whether one group is behind the exploitation.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Citrix confirmed that two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches; the flaws allow remote code execution.
- [2]
CVE-2026-88771 and CVE-2026-88772 each carry a CVSS score of 9.5.
- [3]
The first warnings did not come from Citrix. On September 26, administrators said IT providers and security teams were privately advising them to take NetScaler systems offline, sometimes without explaining why.
- [4]
The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489, which were disclosed in August.
- [5]
watchTowr confirmed the reports were credible, said it was investigating reports of multiple unpatched NetScaler RCE flaws being exploited in the wild, and later said the vulnerabilities had been found during forensic investigations.
- [6]
The Dutch National Cyber Security Centre sent a pre-notification to organizations in the Netherlands. According to a notice seen by BleepingComputer, a European partner CERT had shared information about two critical NetScaler zero-days that could allow remote code execution, one of which could let an attacker inject shellcode directly into memory.
- [7]
Citrix published fixes for the two exploited vulnerabilities on September 27, along with patches for six other security issues.
- [8]
Citrix has not said how many organizations were affected, who was behind the attacks or when exploitation started.
- [9]
"Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible."
- [10]
CVE-2026-88771 involves improper input validation and allows an unauthenticated attacker to execute arbitrary commands; Citrix says it affects all NetScaler ADC and NetScaler Gateway deployments in the affected versions without requiring an additional feature to be enabled.
- [11]
CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service and affects appliances with DTLS enabled; DTLS is enabled by default for NetScaler Gateway VPN virtual servers unless an administrator has explicitly disabled it.
- [12]
NetScaler appliances provide VPN and remote access, load balancing and authentication, so compromising one can give an attacker a position at the edge of an organization.
- [13]
Fixes are available in NetScaler ADC and Gateway 14.1-73.37 and later and 13.1-64.23 and later, and for the 14.1-FIPS, 13.1-FIPS and 13.1-NDcPP branches.
- [14]
Builds 14.1-73.32 and 13.1-63.21, which fixed the authentication-bypass vulnerability CVE-2026-19490 last month, are still within the affected range for the new flaws.
- [15]
"We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible,"
- [16]
The reports show the attacks were already underway while defenders were still waiting for official details and fixes.
- [17]
Citrix's fixes arrived one day after administrators reported the private take-offline warnings.
- [18]
The September 27 release fixed eight security issues in total.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- securityaffairs.comCitrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day
1 article · September 27, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Zero-Day VulnerabilitiesFollow
- Patch And Redeploy LatencyFollow
- Network edge appliance securityFollow