two netscaler zero-days put remote-access gateways at risk
Citrix disclosed two critical NetScaler ADC and Gateway flaws already being exploited, one of them an unauthenticated code-execution bug that works in default configurations.
- cve
- CVE-2026-88771, CVE-2026-88772
- cvss
- 9.5 (v4.0, Citrix) for each
- affected
- NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23; FIPS and NDcPP builds
- fixed in
- 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, 13.1-37.279 FIPS/NDcPP
- exploited
- yes — Citrix confirmed exploitation; both added to CISA KEV 2026-09-27
- platforms
- customer-managed NetScaler ADC and NetScaler Gateway appliances
what happened
- On September 27, 2026, Citrix published bulletin CTX697096, rated critical, covering eight NetScaler ADC and Gateway flaws, CVE-2026-88771 through CVE-2026-88778.[1]
- CVE-2026-88771 is an improper-input-validation flaw that lets an unauthenticated attacker execute code, scored 9.5 (CVSS v4.0). It affects default configurations.[1,3]
- CVE-2026-88772 is a memory overflow that can lead to code execution or denial of service, scored 9.5 (CVSS v4.0). It is exploitable when DTLS is enabled, which is the default on VPN virtual servers.[1]
- Citrix said exploits of both flaws had been observed against unmitigated deployments.[1]
- Fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 FIPS/NDcPP. Secure Private Access Hybrid deployments that use NetScaler are also affected, and Cloud Software Group patches Citrix-managed cloud services itself.[1]
- CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-09-27 with a 2026-09-30 due date, and its entry points customers to the Citrix-provided IOCs to run in the NetScaler console.[2]
- BleepingComputer reported that, before Citrix's disclosure, administrators said on Reddit that IT suppliers and security teams were advising them to shut down their NetScaler appliances.[3]
sources3
- 01NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697096) ↗ primaryCitrix (Cloud Software Group)accessed 2026-10-21
- 02CISA Known Exploited Vulnerabilities Catalog (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21
- 03Citrix confirms two NetScaler RCE zero-days exploited in attacks ↗ secondaryBleepingComputeraccessed 2026-10-21