Citrix NetScaler Zero-Days (CVE-2026-88771) Actively Exploited

Executive Summary

On September 27, 2026, Citrix released emergency security updates for its NetScaler Application Delivery Controller (ADC) and NetScaler Gateway products, addressing eight vulnerabilities. Two of these, CVE-2026-88771 and CVE-2026-88772, are rated critical (CVSS 9.5) and are being actively exploited in the wild as zero-days. These vulnerabilities allow unauthenticated attackers to achieve remote code execution (RCE) on affected appliances, providing a gateway into corporate networks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for immediate action. Due to the widespread deployment of NetScaler appliances as network edge devices for VPN and load balancing, the impact is global and affects all industries. Organizations must not only patch but also actively hunt for signs of compromise, as attackers have been observed deploying webshells for persistent access.

Vulnerability Details

The two zero-day vulnerabilities pose a severe threat to organizations relying on NetScaler appliances.

• CVE-2026-88771 (CVSSv4 9.5 - Critical): An improper input validation vulnerability that enables an unauthenticated attacker to achieve remote code execution. This is the most severe flaw as it affects default configurations and requires no user interaction. A successful exploit grants the attacker full control over the appliance.
• CVE-2026-88772 (CVSSv4 9.5 - Critical): A memory overflow vulnerability that also leads to unauthenticated remote code execution or a denial-of-service condition. This flaw is exploitable when the Datagram Transport Layer Security (DTLS) feature is enabled, which is the default setting for VPN virtual servers, making a large number of deployments vulnerable.

These vulnerabilities are particularly dangerous because they reside in appliances that sit at the perimeter of a network, often serving as the primary gateway for remote access. A compromise of a NetScaler device can provide an attacker with a direct foothold into the internal network.

Affected Systems

The vulnerabilities affect multiple versions of customer-managed NetScaler ADC and Gateway appliances. Citrix has released patches for the following product versions:

• NetScaler ADC and Gateway 14.1 before version 14.1-73.37
• NetScaler ADC and Gateway 13.1 before version 13.1-64.23
• NetScaler ADC FIPS before version 14.1-73.37 FIPS
• NetScaler ADC FIPS and NDcPP before version 13.1-37.279

Cloud-hosted Citrix services are not affected.

Exploitation Status

Both CVE-2026-88771 and CVE-2026-88772 are under active and widespread exploitation. CISA confirmed on September 27, 2026, that it has evidence of threat actors exploiting these flaws globally. Reports from security firms and national CERTs, including the Dutch NCSC, indicate that exploitation may have begun weeks before the patches were released. Attackers have been observed using these vulnerabilities to install webshells on compromised appliances, establishing persistent access and a platform for lateral movement within the victim's network. The ease of exploitation (unauthenticated, remote) combined with the critical function of NetScaler devices makes this a high-priority threat.

Impact Assessment

The business impact of exploiting these vulnerabilities is severe. As edge devices, NetScaler appliances control access to critical internal applications, services, and data. A successful RCE attack can lead to:

• Complete Network Compromise: Attackers can use the compromised appliance as a beachhead to pivot into the internal corporate network, access sensitive data, and deploy further malware, such as ransomware.
• Data Exfiltration: Sensitive corporate and customer data transiting through or accessible from the compromised network can be stolen.
• Operational Disruption: Attackers can cause a denial-of-service, disrupting VPN access for remote employees and access to critical applications for customers, leading to significant business interruption and financial loss.
• Reputational Damage: A public breach originating from a compromised security appliance can severely damage an organization's reputation and erode customer trust.

Given the KEV status and active exploitation, the risk is not theoretical. Any organization with a vulnerable, internet-facing NetScaler appliance should assume it is a target.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were listed as Indicators of Compromise in the source articles.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable systems or active exploitation attempts. Security teams should hunt for these indicators in their logs and on their NetScaler appliances:

Detection & Response

Defenders should prioritize immediate investigation and response activities.

1. Log Analysis: Scrutinize web server access logs, shell logs (/var/log/sh.log), and NetScaler system logs (/var/log/ns.log) for any signs of exploitation. Look for unusual requests, path traversal attempts, and unexpected command execution. D3FEND Network Traffic Analysis (D3-NTA) is critical here.
2. File System Integrity: Check for the presence of unauthorized files, especially webshells in directories like /netscaler/portal/ or /var/vpn/. Use file integrity monitoring or manual checks against a known-good baseline. D3FEND File Analysis (D3-FA) should be employed.
3. Process Monitoring: Look for unexpected processes or child processes spawned by the NetScaler nsppe process. Attackers may use these to run commands or establish reverse shells.
4. Network Traffic Monitoring: Monitor all traffic originating from the NetScaler appliance. Any outbound connections to non-standard ports or unknown IP addresses should be considered highly suspicious and investigated immediately.
5. Forensic Image: Before patching, CISA recommends preserving a forensic image of the appliance if compromise is suspected. This is crucial for incident response and investigation.

title: Citrix NetScaler RCE Exploitation Attempt
status: experimental
description: Detects potential exploitation attempts against Citrix NetScaler CVE-2026-88771/CVE-2026-88772.
logsource:
  product: webserver
  service: citrix
detection:
  selection:
    cs-method: 'POST'
    c-uri|contains|all:
      - '/..%2f'
      - '/vpns/'
  condition: selection
fields:
  - c-ip
  - c-uri
  - cs-user-agent
falsepositives:
  - Vulnerability scanners
level: critical

Remediation Steps

Immediate action is required to mitigate this threat.

1. Patch Immediately: Apply the security updates provided by Citrix to all affected NetScaler appliances. This is the primary and most critical step. This aligns with D3FEND Software Update (D3-SU).
2. Hunt for Compromise: Before and after patching, follow the detection steps above to search for indicators of compromise. Patching a compromised system does not remove the attacker.
3. Isolate and Rebuild: If any evidence of compromise is found, the affected appliance should be isolated from the network and rebuilt from a trusted source. Restore configuration from a clean backup.
4. Rotate Credentials: If compromise is confirmed, rotate all credentials, keys, and certificates stored on or accessible from the NetScaler appliance.
5. Harden Configuration: As a general best practice, restrict access to the NetScaler management interface to a trusted internal network segment. This is a form of D3FEND Network Isolation (D3-NI).