{"id":"citrix-netscaler-rce-zero-days-sep-2026","category":"patch","status":"closed","title":"Citrix NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 exploited; patches out","tldr":"Two critical Citrix NetScaler ADC/Gateway flaws were exploited as zero-days from early or mid September and fixed on 27 Sept. One needs no login or special setup. Organisations running their own appliances should update at once, check for compromise, and use the newer 14.1-73.","summary":"Citrix NetScaler ADC and NetScaler Gateway are widely used business appliances for remote access and traffic handling. On 27 September 2026 Citrix published bulletin CTX697096, fixing eight flaws and confirming that two, CVE-2026-88771 and CVE-2026-88772, had been exploited as zero-days against unpatched appliances. CVE-2026-88771 lets an attacker with no login run commands on the device in default settings. CVE-2026-88772 is a memory overflow that can allow code execution or a crash, and only affects appliances with DTLS enabled, which is on by default for VPN virtual servers. CISA listed both as exploited on 27 September. Attacks pre-dated disclosure: Rapid7 saw attempts on 20 September, and Mandiant tied attacks using CVE-2026-88772 to early September. After a proof-of-concept exploit was published, scanning and compromise became widespread. Fixed builds are 14.1-73.37, 13.1-64.23 and matching FIPS and NDcPP builds. Citrix later disclosed another exploited flaw, CVE-2026-88779, and its newer builds supersede these. Citrix-managed cloud services are being updated by Citrix. This record is built from press and security-firm reports because Citrix's own bulletin would not load when checked.","action":"If you run your own NetScaler ADC or Gateway, update to 14.1-73.41 or 13.1-64.28 (or later), then check for signs of compromise using Citrix's guidance. Everyone else: nothing to do, but ask your IT provider whether they use NetScaler and have patched.","product":"Citrix NetScaler ADC and NetScaler Gateway (customer-managed)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-88771","CVE-2026-88772"],"tags":["citrix","netscaler","zero-day","cisa-kev","remote-code-execution","vpn","gateway"],"affected":["NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37","NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23","NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS","NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1.37.279","Secure Private Access hybrid deployments using NetScaler instances"],"fixed":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP","Later superseding builds for CVE-2026-88779: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1.37.282"],"matches":[],"sources":[{"kind":"advisory","title":"Steps to take if NetScaler ADC is suspected to be compromised (CTX694799)","url":"https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html","by":"Citrix","date":"2026-09-27"},{"kind":"news","title":"Citrix admins warned to shut down NetScalers over 2 exploited zero-days","url":"https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/","by":"BleepingComputer","date":"2026-09-27"},{"kind":"news","title":"NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)","url":"https://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771","by":"Help Net Security","date":"2026-09-29"},{"kind":"research","title":"Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772","url":"https://rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772","by":"Rapid7","date":"2026-10-19"}],"started":"2026-09-27","closed":"2026-10-04","created":"2026-11-03T21:59:45.226Z","updated":"2026-11-03T21:59:45.226Z","cve_notes":[{"cve":"CVE-2026-88771","name":"Unauthenticated command execution in Citrix NetScaler","what":"An input validation flaw in NetScaler ADC and Gateway that lets an attacker with no login run commands on the appliance, in default configuration, and is being used in attacks.","severity":"critical","cvss":9.5},{"cve":"CVE-2026-88772","name":"Memory overflow in Citrix NetScaler DTLS handling","what":"A memory buffer overflow in NetScaler ADC and Gateway, reachable when DTLS is enabled, that an attacker could use to run their own code or crash the device, and which was used in attacks from early September.","severity":"critical","cvss":9.5}],"timeline":[{"at":"2026-10-04","added":"2026-11-03T21:58:27.032Z","kind":"new-fix","text":"Citrix disclosed a further exploited NetScaler flaw, CVE-2026-88779 in SAML handling, with newer builds (14.1-73.41, 13.1-64.28) that supersede the 27 September fixes.","url":"https://rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772","by":"Rapid7","patch":null},{"at":"2026-10-01","added":"2026-11-03T21:58:27.032Z","kind":"other","text":"Arctic Wolf published indicators of compromise for the opportunistic follow-on attacks that used CVE-2026-88771.","url":"https://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771","by":"Help Net Security","patch":null},{"at":"2026-09-29","added":"2026-11-03T21:58:27.032Z","kind":"wider-attacks","text":"Attacks widened after a root-cause analysis and proof-of-concept exploit were published by a security firm. Censys counted about 42,000 internet-facing NetScaler hosts, and researcher Kevin Beaumont said fewer than 10% were patched and he was tracking more than 100 victim organisations.","url":"https://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771","by":"Help Net Security","patch":null},{"at":"2026-09-27","added":"2026-11-03T21:58:27.032Z","kind":"disclosed","text":"Citrix published bulletin CTX697096 with fixes for eight NetScaler flaws and said CVE-2026-88771 and CVE-2026-88772 had been exploited as zero-days on unmitigated appliances. Fixed builds are 14.1-73.37, 13.1-64.23 and the matching FIPS and NDcPP builds. CISA added both to its exploited-flaws list the same day.","url":"https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/","by":"BleepingComputer","patch":"patched"},{"at":"2026-09-24","added":"2026-11-03T21:58:27.032Z","kind":"other","text":"GreyNoise saw a threat actor try to exploit a NetScaler Gateway, more than three days before public disclosure. Mandiant later tied attacks using CVE-2026-88772 to early September 2026, possibly earlier.","url":"https://www.helpnetsecurity.com/2026/09/29/netscaler-zero-day-exploitation-escalates-into-mass-attacks-cve-2026-88771","by":"Help Net Security","patch":null},{"at":"2026-09-20","added":"2026-11-03T21:58:27.032Z","kind":"other","text":"Rapid7's managed detection team recorded the earliest attempt it saw to exploit CVE-2026-88771, two attempts that day, a week before Citrix disclosed the flaw.","url":"https://rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772","by":"Rapid7","patch":null}],"url":"https://hard.fyi/live/citrix-netscaler-rce-zero-days-sep-2026/","json":"https://hard.fyi/api/live?id=citrix-netscaler-rce-zero-days-sep-2026"}