Citrix patches eight NetScaler flaws as two zero-days are exploited
CISA has given US federal agencies until 30 September to act and the National Cyber Security Centre is telling UK defenders to isolate affected appliances, while some IT suppliers told customers to pull the plug
- Citrix released fixes for eight NetScaler ADC and Gateway CVEs, CVE-2026-88771 to CVE-2026-88778, on 27 September.
- The two exploited flaws each score 9.5 on CVSS v4; the other six range from 7.0 to 9.3.
- CISA added both exploited flaws to its KEV catalog on 27 September with a 30 September due date for federal agencies.
- Palo Alto Networks’ Cortex Xpanse counted more than 50,277 exposed instances potentially vulnerable to the two CVEs as of 27 September, its Unit 42 threat brief says.
Do not let a patch ticket close this out. Include standby, disaster-recovery and test appliances in the inventory, since any unpatched gateway facing the internet is exposed. Where DTLS is not needed on VPN virtual servers, switching it off looks like a sensible interim step against the second flaw. Capture logs and a system image before any rebuild, and if compromise is suspected, treat accounts that authenticated through the gateway as exposed as well as the secrets stored on it.
“CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.”Cybersecurity and Infrastructure Security Agency, alert, US Cybersecurity and Infrastructure Security Agency
Citrix confirmed on 27 September that two critical flaws in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772, are being exploited as zero-days, and released fixes for them and six further vulnerabilities in one bulletin. Both score 9.5 on the Common Vulnerability Scoring System (CVSS) v4. The first lets an unauthenticated attacker run commands against a default configuration; the second is a memory overflow that needs Datagram Transport Layer Security (DTLS) switched on, which it is by default on VPN virtual servers.
The US Cybersecurity and Infrastructure Security Agency (CISA) added both to its Known Exploited Vulnerabilities (KEV) catalog the same day and gave federal agencies until 30 September to apply the vendor’s mitigations and carry out forensic triage. Its alert says to look for signs of compromise before patching, because an update can wipe the forensic trail.
Isolate first, patch second
The National Cyber Security Centre (NCSC) published its own alert on 28 September and is still assessing the impact on UK organizations. Its priority list puts patching fifth: identify affected systems, isolate them and where possible replace them with a new, fully updated build, hunt for compromise and report anything found, then update. The fixed builds are 14.1-73.37 and 13.1-64.23.
Administrators posting on Reddit, as reported by BleepingComputer, said IT suppliers, CERTs and national cyber agencies had contacted them before disclosure, in at least one case with advice to shut NetScalers down immediately. As reported by The Stack, Citrix’s guidance for any appliance suspected of compromise is to change every service account password and secret stored on it.
Sources
- The Stack, “Citrix confirms ongoing NetScaler zero day exploitation”, 27 September 2026 (updated 28 September). https://www.thestack.technology/netscaler-attacks-zero-days-reported-exploited/
- CISA, “Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway”, alert, 27 September 2026. https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
- CISA, Known Exploited Vulnerabilities catalog entries for CVE-2026-88771 and CVE-2026-88772, added 27 September 2026, due 30 September 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-88771
- National Cyber Security Centre, “Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway”, alert, 28 September 2026. https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway
- Palo Alto Networks Unit 42, “Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild”, 28 September 2026. https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/
- Rapid7, “Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772”, 28 September 2026. https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/
- BleepingComputer, “Citrix confirms two NetScaler RCE zero-days exploited in attacks”, 27 September 2026. https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/
- Help Net Security, “Citrix NetScaler RCE zero-days exploited globally for weeks”, 28 September 2026. https://www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/
