# Citrix Patches Two NetScaler Zero-Days Already Under Attack

Page: https://hirantha.me/blog/citrix-patches-two-netscaler-zero-days-already-under-attack
Published: 2026-09-28
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: citrix, netscaler, zero-day, vulnerability, network security

> Citrix fixed two critical NetScaler flaws on September 27 that attackers were already exploiting before any patch existed.

## The flaws

Citrix's NetScaler ADC and NetScaler Gateway appliances, the boxes that sit at the edge of a corporate network handling virtual private network (VPN) connections and load balancing, carried two critical bugs that attackers found and used before Citrix had a fix ready.

Both carry a severity score of 9.5 out of 10 on the Common Vulnerability Scoring System (CVSS), the industry-standard scale for how easy and damaging a flaw is to exploit.

| CVE | Issue | CVSS |
|---|---|---|
| CVE-2026-88771 | Improper input validation; unauthenticated attacker can run arbitrary commands in the default configuration | 9.5 |
| CVE-2026-88772 | Memory overflow triggered when Datagram Transport Layer Security (DTLS) is enabled, the default on VPN virtual servers; can crash the device or allow code execution | 9.5 |

Citrix's same update, bulletin CTX697096, also closed six lower-severity bugs in the same product line. CVE-2026-88773, an HTTP request-smuggling flaw, scored 9.3. Three memory-overflow issues, CVE-2026-88775, CVE-2026-88776 (specific to Oracle load-balancing configurations), and CVE-2026-88777 (affecting non-HTTP Layer 7 protocols), each scored 8.8, as did CVE-2026-88778, a flaw that lets an attacker predict TCP sequence numbers. CVE-2026-88774, a policy-bypass bug, scored 7.0. None of those six were reported as exploited in the wild; only CVE-2026-88771 and CVE-2026-88772 carry that distinction.

## How it came to light

Citrix has not said how it first spotted the exploitation, only that the pattern turned up while it was investigating incidents inside customer environments. The Dutch National Cyber Security Centre privately warned organizations in the Netherlands before anything was public. Security research firm watchTowr went public on September 26, a day before Citrix had assigned CVE identifiers or shipped a fix, telling NetScaler administrators to check their exposure immediately. Citrix confirmed both bugs and released fixed builds the next day, September 27, in bulletin CTX697096. The US Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog, the list of flaws it has confirmed are being used in real attacks.

## Who is affected

The fix applies to NetScaler ADC and NetScaler Gateway version 14.1 before build 73.37, and version 13.1 before build 64.23. It also covers the Federal Information Processing Standard (FIPS) builds, fixed at 14.1-73.37 FIPS and 13.1-37.279, and the Network Device collaborative Protection Profile (NDcPP) builds used by government and other regulated customers who need certified cryptographic modules. Secure Private Access deployments that route traffic through a NetScaler instance in hybrid mode are covered by the same advisory. Citrix says it directly observed both vulnerabilities being exploited on deployments that had not applied the fix. No one has claimed responsibility, and Citrix has not named a suspected attacker. NetScaler appliances have a history of drawing both state-linked espionage groups and ransomware crews, because a compromised NetScaler sits inside the network perimeter with visibility into VPN traffic and internal load-balanced services.

## What it means in practice

Because both bugs were used against real targets before any patch existed, applying the update alone is not enough for an organization that was running an affected, internet-facing version during the exposure window. Citrix's advisory effectively treats any unpatched NetScaler that was reachable from the internet as potentially compromised: administrators are expected to rotate credentials and certificates tied to the device and review logs for signs of unauthenticated command execution, not just install the patch and move on. Anyone who cannot patch immediately should at least disable DTLS on VPN virtual servers, which closes off CVE-2026-88772, though it does nothing for CVE-2026-88771, since that bug is exploitable through the appliance's default setup regardless of which features are switched on.

For a device class that keeps turning up at the center of major intrusions, the lesson repeats each time: internet-facing NetScaler boxes need to be on the current build as a priority, not routine maintenance to get to eventually. The gap between when an attacker starts using a flaw and when a fix appears, in this case at least a day, and likely longer given Citrix found the pattern through incident investigations rather than proactive testing, is exactly the window in which perimeter devices like this one are most valuable to compromise: they sit ahead of firewalls and other controls, and a foothold there tends to be harder to spot than one on an ordinary server further inside the network.

## Questions

**What should NetScaler administrators do right now?**
Apply Citrix bulletin CTX697096 immediately, and if the device was internet-facing and unpatched during the exposure window, treat it as potentially compromised: rotate credentials and certificates and check logs for unauthenticated command execution rather than assuming the patch alone fixes things.

**Were these really zero-day vulnerabilities?**
Yes. Citrix and CISA both confirmed that CVE-2026-88771 and CVE-2026-88772 were being actively exploited before Citrix had assigned CVE numbers or released a fix.

**How severe are the two flaws?**
Both scored 9.5 out of 10 on the CVSS scale. CVE-2026-88771 allows an unauthenticated attacker to run commands on a default configuration, and CVE-2026-88772 is a memory overflow that can lead to code execution or a crash.

**Who discovered the vulnerabilities?**
Citrix found the exploitation pattern while investigating customer incidents, the Dutch National Cyber Security Centre privately notified affected organizations, and security firm watchTowr made the issue public on September 26, a day before an official fix existed.

**Is there a known attacker behind the exploitation?**
No. Neither Citrix nor the researchers who disclosed the flaws have attributed the attacks to a specific group, though NetScaler vulnerabilities have historically been used by both state-linked espionage actors and ransomware operators.

## Sources

- [Citrix NetScaler Zero-Day RCE FAQ: CVE-2026-88771 and CVE-2026-88772](https://watchtowr.com/intelligence/citrix-netscaler-zero-day-vulnerabilities-faq/), watchTowr
- [Citrix admins warned to shut down NetScalers over 2 exploited zero-days](https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/), BleepingComputer
- [Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation](https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html), The Hacker News