Citrix NetScaler Zero-Days Exploited: Patch Now
Attackers are actively exploiting two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway worldwide, the U.S. Cybersecurity and Infrastructure Security Agency said, adding both flaws to its Known Exploited Vulnerabilities catalog on Sunday, September 27, 2026.
Key facts
The flaws: CVE-2026-88771 and CVE-2026-88772, both rated CVSS 9.5 (critical)
What they allow: CVE-2026-88771 lets an unauthenticated attacker execute arbitrary commands; CVE-2026-88772 allows remote code execution or denial-of-service
Exploitation status: CISA says it has reports and partner threat intelligence confirming active exploitation globally
Who's exposed: CVE-2026-88771 affects all NetScaler ADC and Gateway deployments; CVE-2026-88772 requires DTLS, which is on by default on VPN virtual servers
Deadline: U.S. federal civilian agencies must patch by September 30, 2026
What are these vulnerabilities?
Two separate flaws in Citrix NetScaler, an appliance many organizations use to manage network traffic and provide remote VPN access to internal systems.
CVE-2026-88771 is an improper input validation vulnerability — the software fails to properly check data it receives — that could allow an attacker with no login credentials to run arbitrary commands on the appliance. Researchers at watchTowr Labs said on September 28 that the flaw is rooted in a Perl script used to process NetScaler crash and error information.
CVE-2026-88772 is a memory buffer flaw that could allow remote code execution or crash the device.
A zero-day is a vulnerability being exploited before a fix was available. Remote code execution, or RCE, means an attacker can run their own software on your system from anywhere on the internet.
Which versions are affected, and what fixes them?
Citrix has released fixed versions:
NetScaler ADC and NetScaler Gateway 14.1-73.37 and later
NetScaler ADC and NetScaler Gateway 13.1-64.23 and later releases of 13.1
NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later
CISA acknowledged that updating NetScaler appliances can be complex and may require downtime, which is why it issued a separate alert to help organizations assess exposure and prioritize mitigation rather than simply listing the CVEs.
How do you know if you've been compromised?
Citrix has published generic indicators of compromise through the NetScaler Console. If compromise is suspected, Citrix recommends a specific sequence:
Preserve evidence of the NetScaler ADC VPX instance
Isolate the device
Revoke credentials and access
Investigate every server and system the NetScaler connected to for signs of further compromise
Rebuild and update firmware to the latest version
Rotate all local account passwords and Key Encryption Keys, and replace all restored SSL certificates if restoring from backup
Harden the device per Citrix's secure deployment guidance
That fifth and sixth step matter most. Patching a compromised appliance does not evict an attacker who already has credentials — which is why credential rotation is on the list.
Why NetScaler appliances keep getting attacked
Because of where they sit. These devices are internet-facing by design and act as the front door to internal networks and VPN access. An attacker who compromises one is not at the perimeter — they are past it, often with visibility into authentication traffic.
Edge devices like VPN gateways, firewalls and load balancers have become a favored target for both ransomware crews and state-linked actors for exactly this reason. They are exposed, they are hard to patch without downtime, and they are frequently forgotten in asset inventories.
What to do today
If your organization runs NetScaler, treat this as an emergency change, not a scheduled one. Confirm your version, check whether DTLS is enabled on your VPN virtual servers, apply the fixed release, and then review the indicators of compromise before assuming you were not hit. If you outsource IT, ask your provider today whether NetScaler is in your environment and whether it has been patched.
Sources: The Hacker News; CISA alert and KEV catalog; Citrix security bulletin.