Citrix NetScaler Is Under Attack Again, With Two Zero-Days

Citrix confirmed on September 27 that two critical remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway had been exploited in the wild before any fix existed. The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, each carry a CVSS v4.0 score of 9.5, and the company shipped fixed builds the same day in security bulletin CTX697096, according to BleepingComputer and The Hacker News.

The first of the two is the one that should keep network teams up at night. Per watchTowr's advisory, CVE-2026-88771 is an improper input validation bug that lets an unauthenticated attacker run arbitrary commands on the appliance, and it affects every deployment on a vulnerable version, including default configurations. Nothing special has to be switched on. The second, CVE-2026-88772, is a memory overflow that can produce remote code execution or a denial of service when DTLS is enabled, which The Hacker News notes is the default on VPN virtual servers.

A weekend of 'turn it off'

The disclosure did not arrive in the usual orderly fashion. Tenable's timeline puts the first administrator reports on Reddit on September 25. By September 26, NetScaler admins were being told by suppliers and security teams to shut their appliances down outright, after the Dutch National Cyber Security Centre (NCSC-NL) sent a private pre-notification to organizations in the Netherlands. BleepingComputer reports that NCSC-NL received the information from a European partner CERT and warned that one of the flaws allowed shellcode to be placed directly into memory. The same day, watchTowr published a public warning that unpatched NetScaler exploits were circulating, before CVE numbers had even been assigned.

Citrix's own account, as relayed by BleepingComputer, is that it found the bugs while investigating customer incidents that showed active exploitation, and that it filed notifications under the EU's Cyber Resilience Act. Its bulletin states plainly that exploitation of both CVEs on unmitigated appliances has been observed. CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog on September 27, per watchTowr's tracker.

What nobody has published yet is scale. NCSC-NL said it had seen exploitation at multiple customers but could not say whether attacks were widespread, and neither Citrix nor the security firms involved have released victim counts.

What is affected and what to install

The vulnerable branches, per the Citrix bulletin as summarized by Tenable:

• NetScaler ADC and Gateway 14.1 before 14.1-73.37
• NetScaler ADC and Gateway 13.1 before 13.1-64.23
• NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
• NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.279

Versions 12.1 and 13.0 are end-of-life and will not get patches, Tenable notes, which means anyone still running them has no fix to install and should treat those boxes as an unsupported liability. The bulletin also addresses six further flaws, CVE-2026-88773 through CVE-2026-88778, covering request smuggling, feature bypass and additional memory overflow issues. There is no public workaround for the two critical bugs.

Patching is not the end of it

The advice from responders goes further than updating. Because exploitation preceded the fix, a patched appliance may already be compromised. The Hacker News and watchTowr both advise preserving forensic evidence before upgrading: VPX snapshots, logs and core dumps. After that, rotate passwords, secrets and certificates, and keep management interfaces off the internet. Tenable points customers to NetScaler Console with telemetry enabled for indicators of compromise, and suggests contacting Citrix Support directly for IoCs. Organizations that cannot patch immediately were told to cut the appliance's internet exposure until they can.

This ordering matters. Patching first overwrites the state an investigator needs, and a web shell or stolen session credentials survive an upgrade. The lesson from earlier NetScaler waves was that the organizations that got hurt worst were often the ones that patched and moved on.

Why NetScaler keeps showing up here

This is not a new story, only a new chapter. According to Tenable, CISA's KEV catalog now lists thirteen NetScaler entries. They include CitrixBleed (CVE-2023-4966), which ransomware crews used heavily; CVE-2023-3519, a critical RCE; and last year's CitrixBleed 2 (CVE-2025-5777) and CVE-2025-7775 zero-day. Tenable's analysis attributes roughly two-thirds of the associated threat activity to state-linked APT groups and about a third to ransomware operators.

The reason is structural. NetScaler sits at the edge of the network, handles authentication and VPN sessions, and is reachable from the internet by design. A single unauthenticated RCE on such a box gives an attacker a foothold inside the perimeter with access to credentials and session tokens flowing through it. Edge appliances from several vendors have followed the same pattern for years, and they tend to lack the endpoint detection coverage that servers and laptops get, so compromises go unnoticed longer.

For AI-era infrastructure teams the point is uncomfortable: the same gateways now front model-serving clusters, internal agent tooling and the SaaS consoles that manage GPU fleets. A remote shell on the VPN concentrator is a path to all of it.

The practical checklist is short. Find every internet-facing NetScaler, including forgotten ones. Snapshot before touching. Upgrade to 14.1-73.37 or 13.1-64.23 or later. Hunt for indicators. Rotate everything the appliance could have seen. And if a box is on 12.1 or 13.0, the honest answer from the vendor's own support matrix is that it should come out of service.