NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Citrix NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 exploited; patches out

Two critical Citrix NetScaler ADC/Gateway flaws were exploited as zero-days from early or mid September and fixed on 27 Sept. One needs no login or special setup. Organisations running their own appliances should update at once, check for compromise, and use the newer 14.1-73.

What to do

If you run your own NetScaler ADC or Gateway, update to 14.1-73.41 or 13.1-64.28 (or later), then check for signs of compromise using Citrix's guidance. Everyone else: nothing to do, but ask your IT provider whether they use NetScaler and have patched.

What’s happening

Citrix NetScaler ADC and NetScaler Gateway are widely used business appliances for remote access and traffic handling. On 27 September 2026 Citrix published bulletin CTX697096, fixing eight flaws and confirming that two, CVE-2026-88771 and CVE-2026-88772, had been exploited as zero-days against unpatched appliances. CVE-2026-88771 lets an attacker with no login run commands on the device in default settings. CVE-2026-88772 is a memory overflow that can allow code execution or a crash, and only affects appliances with DTLS enabled, which is on by default for VPN virtual servers. CISA listed both as exploited on 27 September. Attacks pre-dated disclosure: Rapid7 saw attempts on 20 September, and Mandiant tied attacks using CVE-2026-88772 to early September. After a proof-of-concept exploit was published, scanning and compromise became widespread. Fixed builds are 14.1-73.37, 13.1-64.23 and matching FIPS and NDcPP builds. Citrix later disclosed another exploited flaw, CVE-2026-88779, and its newer builds supersede these. Citrix-managed cloud services are being updated by Citrix. This record is built from press and security-firm reports because Citrix's own bulletin would not load when checked.

What
Flaw
Affects
Citrix NetScaler ADC and NetScaler Gateway (customer-managed)
Affected
NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1.37.279
Secure Private Access hybrid deployments using NetScaler instances
Fixed in
14.1-73.37
13.1-64.23
14.1-73.37 FIPS
13.1.37.279 FIPS and NDcPP
Later superseding builds for CVE-2026-88779: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1.37.282
CVE
CVE-2026-88771, CVE-2026-88772
Since
27 Sept 2026
Closed
4 Oct 2026

Timeline

  1. New fix

    Citrix disclosed a further exploited NetScaler flaw, CVE-2026-88779 in SAML handling, with newer builds (14.1-73.41, 13.1-64.28) that supersede the 27 September fixes.

  2. Update

    Arctic Wolf published indicators of compromise for the opportunistic follow-on attacks that used CVE-2026-88771.

  3. Wider attacks

    Attacks widened after a root-cause analysis and proof-of-concept exploit were published by a security firm. Censys counted about 42,000 internet-facing NetScaler hosts, and researcher Kevin Beaumont said fewer than 10% were patched and he was tracking more than 100 victim organisations.

  4. Made publicFixed

    Citrix published bulletin CTX697096 with fixes for eight NetScaler flaws and said CVE-2026-88771 and CVE-2026-88772 had been exploited as zero-days on unmitigated appliances. Fixed builds are 14.1-73.37, 13.1-64.23 and the matching FIPS and NDcPP builds. CISA added both to its exploited-flaws list the same day.

  5. Update

    GreyNoise saw a threat actor try to exploit a NetScaler Gateway, more than three days before public disclosure. Mandiant later tied attacks using CVE-2026-88772 to early September 2026, possibly earlier.

  6. Update

    Rapid7's managed detection team recorded the earliest attempt it saw to exploit CVE-2026-88771, two attempts that day, a week before Citrix disclosed the flaw.

Sources

  1. Steps to take if NetScaler ADC is suspected to be compromised (CTX694799)Citrix · 27 Sept 2026
  2. Citrix admins warned to shut down NetScalers over 2 exploited zero-daysBleepingComputer · 27 Sept 2026
  3. NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)Help Net Security · 29 Sept 2026
  4. Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772Rapid7 · 19 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS