The flaws
Citrix's NetScaler ADC and NetScaler Gateway appliances, the boxes that sit at the edge of a corporate network handling virtual private network (VPN) connections and load balancing, carried two critical bugs that attackers found and used before Citrix had a fix ready.
Both carry a severity score of 9.5 out of 10 on the Common Vulnerability Scoring System (CVSS), the industry-standard scale for how easy and damaging a flaw is to exploit.
| CVE | Issue | CVSS |
|---|---|---|
| CVE-2026-88771 | Improper input validation; unauthenticated attacker can run arbitrary commands in the default configuration | 9.5 |
| CVE-2026-88772 | Memory overflow triggered when Datagram Transport Layer Security (DTLS) is enabled, the default on VPN virtual servers; can crash the device or allow code execution | 9.5 |
Citrix's same update, bulletin CTX697096, also closed six lower-severity bugs in the same product line. CVE-2026-88773, an HTTP request-smuggling flaw, scored 9.3. Three memory-overflow issues, CVE-2026-88775, CVE-2026-88776 (specific to Oracle load-balancing configurations), and CVE-2026-88777 (affecting non-HTTP Layer 7 protocols), each scored 8.8, as did CVE-2026-88778, a flaw that lets an attacker predict TCP sequence numbers. CVE-2026-88774, a policy-bypass bug, scored 7.0. None of those six were reported as exploited in the wild; only CVE-2026-88771 and CVE-2026-88772 carry that distinction.
How it came to light
Citrix has not said how it first spotted the exploitation, only that the pattern turned up while it was investigating incidents inside customer environments. The Dutch National Cyber Security Centre privately warned organizations in the Netherlands before anything was public. Security research firm watchTowr went public on September 26, a day before Citrix had assigned CVE identifiers or shipped a fix, telling NetScaler administrators to check their exposure immediately. Citrix confirmed both bugs and released fixed builds the next day, September 27, in bulletin CTX697096. The US Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog, the list of flaws it has confirmed are being used in real attacks.
Who is affected
The fix applies to NetScaler ADC and NetScaler Gateway version 14.1 before build 73.37, and version 13.1 before build 64.23. It also covers the Federal Information Processing Standard (FIPS) builds, fixed at 14.1-73.37 FIPS and 13.1-37.279, and the Network Device collaborative Protection Profile (NDcPP) builds used by government and other regulated customers who need certified cryptographic modules. Secure Private Access deployments that route traffic through a NetScaler instance in hybrid mode are covered by the same advisory. Citrix says it directly observed both vulnerabilities being exploited on deployments that had not applied the fix. No one has claimed responsibility, and Citrix has not named a suspected attacker. NetScaler appliances have a history of drawing both state-linked espionage groups and ransomware crews, because a compromised NetScaler sits inside the network perimeter with visibility into VPN traffic and internal load-balanced services.
What it means in practice
Because both bugs were used against real targets before any patch existed, applying the update alone is not enough for an organization that was running an affected, internet-facing version during the exposure window. Citrix's advisory effectively treats any unpatched NetScaler that was reachable from the internet as potentially compromised: administrators are expected to rotate credentials and certificates tied to the device and review logs for signs of unauthenticated command execution, not just install the patch and move on. Anyone who cannot patch immediately should at least disable DTLS on VPN virtual servers, which closes off CVE-2026-88772, though it does nothing for CVE-2026-88771, since that bug is exploitable through the appliance's default setup regardless of which features are switched on.
For a device class that keeps turning up at the center of major intrusions, the lesson repeats each time: internet-facing NetScaler boxes need to be on the current build as a priority, not routine maintenance to get to eventually. The gap between when an attacker starts using a flaw and when a fix appears, in this case at least a day, and likely longer given Citrix found the pattern through incident investigations rather than proactive testing, is exactly the window in which perimeter devices like this one are most valuable to compromise: they sit ahead of firewalls and other controls, and a foothold there tends to be harder to spot than one on an ordinary server further inside the network.
