Citrix NetScaler Under Attack: What to Know About Zero-Days CVE-2026-88771 and CVE-2026-88772

Two Critical Zero-Days, Already Exploited

Citrix NetScaler administrators are facing one of the worst scenarios in enterprise security: critical remote code execution bugs that attackers found first. CVE-2026-88771 and CVE-2026-88772 are critical RCE vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway, and both were exploited in the wild as zero-days — before a fix existed.

Both flaws carry a CVSS v4.0 base score of 9.5, placing them firmly in the Critical band. Citrix published security bulletin CTX697096 on September 27, 2026, assigning the CVE IDs and listing the fixed builds.

The practical implication is that patching alone is not enough. Because exploitation preceded the advisory, any organisation running an affected build has to assume it may have been reachable by an attacker during the window before the fix shipped.

Breaking Down the Bugs

The two vulnerabilities are distinct in both mechanism and preconditions, which matters when you are triaging which appliances are most exposed.

• CVE-2026-88771 is an improper input validation flaw (CWE-20) that allows an unauthenticated attacker to execute arbitrary commands. Critically, it affects all NetScaler ADC and Gateway deployments in the default configuration — no additional feature needs to be enabled for an appliance to be at risk.
• CVE-2026-88772 is a memory overflow vulnerability (CWE-119) that can lead to remote code execution or denial of service. It requires DTLS configuration to be enabled — but DTLS is enabled by default on VPN virtual servers, so a large share of real-world Gateway deployments will meet that condition without any deliberate configuration choice.

In other words, the "requires a specific configuration" caveat on CVE-2026-88772 offers far less comfort than it first appears, and CVE-2026-88771 offers none at all.

Who Is Affected

The affected supported versions are:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
• NetScaler ADC FIPS before 14.1-73.37 FIPS
• NetScaler ADC FIPS and NDcPP before 13.1-37.279

Only on-premises, customer-managed deployments are affected. Organisations consuming NetScaler as a managed service are not in scope for these particular CVEs.

It is also worth reading CTX697096 in full rather than stopping at the two headline issues: the same bulletin addresses eight NetScaler vulnerabilities in total, tracked as CVE-2026-88771 through CVE-2026-88778.

Scale of the Exposure

The exposure is substantial. As of September 27, 2026, Palo Alto Networks Cortex Xpanse telemetry identified 50,277 exposed instances that could potentially be vulnerable to these CVEs.

That number reflects what makes NetScaler such a persistent target. ADC and Gateway devices sit at the network edge by design, terminating remote access and fronting internal applications, which means an internet-reachable instance is a direct target rather than something an attacker has to pivot toward. A pre-authentication command execution bug on that class of device is about as valuable as initial access gets.

Government and Industry Response

The official response moved quickly once the bulletin landed. CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026 — the same day Citrix published CTX697096, underscoring that active exploitation was already established rather than theoretical.

In the UK, the NCSC is urging UK organisations to promptly mitigate the vulnerabilities and says it is working to understand their impact on UK organisations.

On the private-sector side, watchTowr says it warned on September 26, 2026 that unpatched NetScaler RCE zero-days were being exploited, alerting clients to their exposure before the CVE IDs existed — a reminder that for defenders relying solely on vendor advisories, the clock had already been running.

What Defenders Should Do Now

There is no workaround. Every NetScaler ADC and Gateway instance must be updated to the fixed build — but because these were exploited as zero-days, patching should be sequenced after evidence preservation and a check for compromise, not instead of it.

Unit 42's recommended approach runs roughly as follows:

• Confirm exposure against the preconditions listed in the Citrix advisory, so you know which appliances actually meet the conditions for each CVE.
• Isolate vulnerable systems.
• Preserve evidence before you patch — specifically a VPX snapshot, remote syslog or NetScaler Console logs, a technical support bundle, and a packet engine core dump.
• Hunt for suspicious admin sessions, unexpected outbound connections, and gaps in logging.
• Update every instance to the fixed build.

One important framing note: Unit 42 presents these hunting steps as general guidance rather than a description of observed attacker tradecraft. Treat the list as a baseline for finding anomalies on an edge device, not as a set of confirmed indicators — and don't conclude an appliance is clean simply because none of these signals fire.