NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

Saturday’s Citrix bulletin landed with the kind of sentence operators hate: exploits of two NetScaler remote-code-execution bugs “have been observed” on unmitigated appliances. One of them hits every ADC and Gateway deployment in its default configuration. If your VPN or load balancer is still on a Friday build, this is Monday’s first job.

If the NetScaler answers the Internet, assume someone already tried the new bugs.

What happened

On September 27, 2026, Citrix published security bulletin CTX697096 covering eight NetScaler ADC and NetScaler Gateway flaws. Two of them, CVE-2026-88771 and CVE-2026-88772, are critical unauthenticated remote code execution issues, and Citrix confirms both have been exploited against systems that were not yet mitigated.

CVE-2026-88771 is improper input validation that lets an unauthenticated attacker run arbitrary commands. The precondition is blunt: all NetScaler ADC and Gateway deployments, default configuration, no extra feature required. CVE-2026-88772 is a memory-overflow RCE/DoS that needs DTLS enabled. DTLS is on by default on VPN virtual servers unless you explicitly turned it off.

The week started ugly. On September 26, administrators reported private advice from suppliers and security teams to take NetScalers offline after a Dutch NCSC pre-notification, and watchTowr warned that multiple unpatched NetScaler RCEs were already circulating from forensic work. Citrix’s fixed builds followed the next day. CISA moved CVE-2026-88771 into the Known Exploited Vulnerabilities catalog around the same window, which means federal agencies get a short clock and a forensic-triage expectation under BOD 26-04.

Why it matters

NetScaler sits in front of the crown jewels: SSL VPN, ICA/CVPN, AAA, and the apps users hit before they ever touch Active Directory. With unauthenticated RCE already exploited, the question is whether someone already has a shell. The Saturday patch also means many shops will first see this message on Monday morning with weekend exploitation already possible.

Six additional CVEs in the same bulletin (request smuggling, policy bypass, memory issues, TCP ISN prediction) raise the upgrade stakes even if you only came for the two exploited RCEs. There is no published workaround for 88771/88772. Upgrade.

What to do first

• Inventory every customer-managed NetScaler ADC and Gateway (including Secure Private Access hybrid instances). Citrix-managed cloud services are handled by Citrix.
• Upgrade to a fixed build: 14.1-73.37+, 13.1-64.23+, 14.1-FIPS 14.1-73.37 FIPS+, or 13.1-FIPS / 13.1-NDcPP 13.1.37.279+.
• Before you overwrite the box, preserve forensic evidence (disk image / relevant logs). CISA’s BOD 26-04 guidance expects a compromise check when a KEV grants total control.
• Hunt for unusual admin sessions, unexpected nsroot activity, new accounts, and outbound connections from the appliance management plane.
• If you cannot patch in the next few hours and the appliance is Internet-facing, pull management off the open Internet and be ready to take the VPN offline rather than leave an unpatched RCE live.
• After upgrade, confirm the build string and re-enable only the vServers you still need; for CVE-2026-88778, also apply Citrix’s enhanced ISN generation TCP change.

Details

• CVE-2026-88771: unauthenticated RCE via improper input validation (CWE-20); CVSS v4 9.5; all ADC/Gateway deployments, default config
• CVE-2026-88772: memory overflow → RCE/DoS (CWE-119); CVSS v4 9.5; DTLS enabled (default on VPN vServer)
• Also in CTX697096: CVE-2026-88773 through CVE-2026-88778 (smuggling, policy bypass, memory issues, TCP ISN prediction)
• Affected: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; FIPS/NDcPP branches before the builds above
• Fixed: 14.1-73.37+, 13.1-64.23+, matching FIPS/NDcPP builds
• Exploitation: confirmed by Citrix on unmitigated deployments; CISA KEV for CVE-2026-88771
• Credits: JPMorgan Chase XOR Team (Michael Tucker, Chew Keong Tan, Alex Bernier) and Maxim Suhanov

Hunt / verify

• Confirm build with show version / GUI System information — look for 14.1-73.37+, 13.1-64.23+, or the FIPS/NDcPP equivalents.
• For 88772 exposure: check whether any VPN vServer lacks -dtls OFF, or any vServer is type DTLS.
• Review aaa/vpn authentication logs and ns.log around Sep 26–28 for anomalous unauthenticated hits and new admin sessions.
• Compare running config and certificates against a known-good backup from before the weekend.

NetScaler to 14.1-73.37 / 13.1-64.23 (or FIPS match) today; preserve evidence first; Internet-facing VPN/ADC that sat unpatched since Sat = incident until proven otherwise.

Sources

• Citrix — CTX697096 NetScaler ADC/Gateway Security Bulletin (Sep 27, 2026)
• watchTowr — CVE-2026-88771 / 88772 NetScaler RCE
• Security Affairs — Citrix confirms two NetScaler zero-days exploited
• CISA Known Exploited Vulnerabilities Catalog

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].