Citrix NetScaler ADC and NetScaler Gateway sit at the very edge of thousands of corporate networks, handling remote access, VPN connections and application delivery. That position makes them one of the most attractive targets on the internet: compromise the gateway, and you are standing at the front door of everything behind it.
On September 27, 2026, Citrix published security bulletin CTX697096, covering eight vulnerabilities. Two of them — CVE-2026-88771 and CVE-2026-88772 — were already being exploited in the wild, and each one can lead to remote code execution on its own.
What Are the Vulnerabilities?
CVE-2026-88771 — Improper Input Validation (CWE-20)
According to Citrix, "a remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands." Critically, it affects all NetScaler ADC and NetScaler Gateway deployments in their default configuration — no additional feature needs to be enabled.
CVSS v4.0: 9.5 — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE-2026-88772 — Memory Overflow (CWE-119)
A memory overflow that can lead to remote code execution or denial of service. It requires the DTLS (Datagram Transport Layer Security) configuration to be enabled — and Citrix notes that DTLS is enabled by default on VPN virtual servers, so most NetScaler Gateway deployments are in scope unless DTLS has been deliberately turned off.
CVSS v4.0: 9.5 — CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
How the Attacks Work (High Level)
Palo Alto Networks' Unit 42 investigated real intrusions and published a detailed analysis. At a high level:
- CVE-2026-88771: a multi-stage command injection chain in which attacker-controlled input is written into the appliance's logs and later processed in a way that leads to command execution.
- CVE-2026-88772: specially crafted DTLS packets corrupt memory on the appliance, which attackers used to run code.
- After exploitation: attackers dropped PHP webshells into the gateway's web directories, modified the appliance's web server configuration for persistence, and abused a privileged NetScaler binary to escalate privileges.
Potential Impact
Code execution on an edge gateway is about as serious as it gets. A compromised NetScaler can give attackers:
- Full control of the appliance and the traffic passing through it
- A persistent foothold via webshells that can survive until found and removed
- A launch point for lateral movement into the internal network
- Service disruption — CVE-2026-88772 can also cause denial of service on remote access
Who Is Affected?
Customer-managed NetScaler ADC and NetScaler Gateway appliances running the versions below. Citrix also states that Secure Private Access hybrid deployments using NetScaler instances are affected and must be upgraded, while cloud-managed instances receive updates automatically from Cloud Software Group.
| Product line | Vulnerable | Fixed in |
|---|---|---|
| NetScaler ADC & Gateway 14.1 | Before 14.1-73.37 | 14.1-73.37 and later |
| NetScaler ADC & Gateway 13.1 | Before 13.1-64.23 | 13.1-64.23 and later |
| NetScaler ADC 14.1-FIPS | Before 14.1-73.37 FIPS | 14.1-73.37 FIPS and later |
| NetScaler ADC 13.1-FIPS & 13.1-NDcPP | Before 13.1-37.279 | 13.1-37.279 and later |
The scale is significant: Unit 42 reported identifying 50,277 potentially vulnerable NetScaler instances exposed to the internet as of September 27, 2026, based on Cortex Xpanse data.
Exploitation Status
Both vulnerabilities were exploited as zero-days — before any patch or public advisory existed. Citrix confirmed that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," and CISA added both to its Known Exploited Vulnerabilities catalog on September 27, 2026, with a federal remediation deadline of September 30, 2026. CISA says threat actors are exploiting them globally.
| Date (2026) | What happened |
|---|---|
| Aug 21–22 | Initial fingerprinting of 100+ NetScaler systems observed (Unit 42) |
| Sep 4 – 24 | Pre-disclosure exploitation of CVE-2026-88772 observed (Unit 42) |
| Sep 21 | Pre-disclosure exploitation of CVE-2026-88771 begins (Unit 42) |
| Sep 27 | Citrix publishes CTX697096; CISA adds both CVEs to KEV; widespread scanning follows |
| Sep 30 | CISA remediation deadline for US federal civilian agencies |
Mitigation and Remediation
Because these flaws were exploited before disclosure, the right response is investigate, then patch — not just patch. CISA specifically advises organisations to preserve forensic evidence before applying updates, as updating may erase traces of compromise.
- Preserve evidence first — capture VPX snapshots, remote logs and technical support bundles before updating.
- Check for compromise using Citrix's compromise response guidance (CTX694799), CISA's published SIGMA rules and vendor detections — look for unfamiliar files in web directories, modified web server configuration, suspicious sessions, unexpected outbound connections and gaps in logging.
- Upgrade immediately to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS or 13.1-37.279 (FIPS/NDcPP) or later.
- If you find signs of compromise, isolate the appliance, treat it as an incident, and rotate credentials and secrets that passed through or were stored on it — patching does not remove an attacker who is already inside.
- Don't forget hybrid deployments — Secure Private Access hybrid environments using NetScaler need the same upgrade.
Key Takeaways for Security Teams
- Edge devices are prime targets. VPNs, gateways and load balancers are internet-facing by design and are repeatedly hit by zero-days — they need priority patching and dedicated monitoring.
- "Patched" doesn't mean "clean". With weeks of pre-disclosure exploitation, every exposed appliance should be checked for compromise, not just updated.
- Preserve evidence before you fix. Build forensic capture into your emergency patch process for network appliances.
- Know your defaults. CVE-2026-88771 needs no special configuration, and DTLS for CVE-2026-88772 is on by default for VPN — "we don't use that feature" is rarely a safe assumption.
- Watch reconnaissance signals. Fingerprinting began roughly two weeks before the first known exploitation — external attack surface monitoring can provide early warning.
In short: if you run NetScaler ADC or Gateway, preserve evidence, hunt for compromise, and upgrade now — in that order, and quickly.
References
- Citrix Security Bulletin CTX697096 — NetScaler ADC and NetScaler Gateway (September 27, 2026)
- CISA — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
- CISA — Adds Two Known Exploited Vulnerabilities to Catalog (September 27, 2026)
- Unit 42 — Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
- UK NCSC — Exploitation of Vulnerabilities Affecting Citrix NetScaler ADC and Gateway
- CVE.org — CVE-2026-88771 · CVE-2026-88772