Saturday’s Citrix bulletin landed with the kind of sentence operators hate: exploits of two NetScaler remote-code-execution bugs “have been observed” on unmitigated appliances. One of them hits every ADC and Gateway deployment in its default configuration. If your VPN or load balancer is still on a Friday build, this is Monday’s first job.
If the NetScaler answers the Internet, assume someone already tried the new bugs.
What happened
On September 27, 2026, Citrix published security bulletin CTX697096 covering eight NetScaler ADC and NetScaler Gateway flaws. Two of them, CVE-2026-88771 and CVE-2026-88772, are critical unauthenticated remote code execution issues, and Citrix confirms both have been exploited against systems that were not yet mitigated.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
CVE-2026-88771 is improper input validation that lets an unauthenticated attacker run arbitrary commands. The precondition is blunt: all NetScaler ADC and Gateway deployments, default configuration, no extra feature required. CVE-2026-88772 is a memory-overflow RCE/DoS that needs DTLS enabled. DTLS is on by default on VPN virtual servers unless you explicitly turned it off.
The week started ugly. On September 26, administrators reported private advice from suppliers and security teams to take NetScalers offline after a Dutch NCSC pre-notification, and watchTowr warned that multiple unpatched NetScaler RCEs were already circulating from forensic work. Citrix’s fixed builds followed the next day. CISA moved CVE-2026-88771 into the Known Exploited Vulnerabilities catalog around the same window, which means federal agencies get a short clock and a forensic-triage expectation under BOD 26-04.
Why it matters
NetScaler sits in front of the crown jewels: SSL VPN, ICA/CVPN, AAA, and the apps users hit before they ever touch Active Directory. With unauthenticated RCE already exploited, the question is whether someone already has a shell. The Saturday patch also means many shops will first see this message on Monday morning with weekend exploitation already possible.
Six additional CVEs in the same bulletin (request smuggling, policy bypass, memory issues, TCP ISN prediction) raise the upgrade stakes even if you only came for the two exploited RCEs. There is no published workaround for 88771/88772. Upgrade.
What to do first
- Inventory every customer-managed NetScaler ADC and Gateway (including Secure Private Access hybrid instances). Citrix-managed cloud services are handled by Citrix.
- Upgrade to a fixed build: 14.1-73.37+, 13.1-64.23+, 14.1-FIPS 14.1-73.37 FIPS+, or 13.1-FIPS / 13.1-NDcPP 13.1.37.279+.
- Before you overwrite the box, preserve forensic evidence (disk image / relevant logs). CISA’s BOD 26-04 guidance expects a compromise check when a KEV grants total control.
- Hunt for unusual admin sessions, unexpected nsroot activity, new accounts, and outbound connections from the appliance management plane.
- If you cannot patch in the next few hours and the appliance is Internet-facing, pull management off the open Internet and be ready to take the VPN offline rather than leave an unpatched RCE live.
- After upgrade, confirm the build string and re-enable only the vServers you still need; for CVE-2026-88778, also apply Citrix’s enhanced ISN generation TCP change.
Forward this
If your team runs Citrix NetScaler ADC or Gateway for VPN or app delivery: confirm every appliance is on a September 27 fixed build (14.1-73.37 / 13.1-64.23 or the matching FIPS/NDcPP line) today. Citrix says two of the bugs were already exploited before the patch. Preserve logs before you upgrade, then treat any internet-facing box that sat unpatched over the weekend as a possible incident. Rotate secrets the appliance can reach and review admin access.
Details
- CVE-2026-88771: unauthenticated RCE via improper input validation (CWE-20); CVSS v4 9.5; all ADC/Gateway deployments, default config
- CVE-2026-88772: memory overflow → RCE/DoS (CWE-119); CVSS v4 9.5; DTLS enabled (default on VPN vServer)
- Also in CTX697096: CVE-2026-88773 through CVE-2026-88778 (smuggling, policy bypass, memory issues, TCP ISN prediction)
- Affected: 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; FIPS/NDcPP branches before the builds above
- Fixed: 14.1-73.37+, 13.1-64.23+, matching FIPS/NDcPP builds
- Exploitation: confirmed by Citrix on unmitigated deployments; CISA KEV for CVE-2026-88771
- Credits: JPMorgan Chase XOR Team (Michael Tucker, Chew Keong Tan, Alex Bernier) and Maxim Suhanov
Hunt / verify
- Confirm build with
show version/ GUI System information — look for 14.1-73.37+, 13.1-64.23+, or the FIPS/NDcPP equivalents. - For 88772 exposure: check whether any VPN vServer lacks
-dtls OFF, or any vServer is type DTLS. - Review aaa/vpn authentication logs and ns.log around Sep 26–28 for anomalous unauthenticated hits and new admin sessions.
- Compare running config and certificates against a known-good backup from before the weekend.
NetScaler to 14.1-73.37 / 13.1-64.23 (or FIPS match) today; preserve evidence first; Internet-facing VPN/ADC that sat unpatched since Sat = incident until proven otherwise.
Sources
- Citrix — CTX697096 NetScaler ADC/Gateway Security Bulletin (Sep 27, 2026)
- watchTowr — CVE-2026-88771 / 88772 NetScaler RCE
- Security Affairs — Citrix confirms two NetScaler zero-days exploited
- CISA Known Exploited Vulnerabilities Catalog
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
