CVE-2026-88771 and CVE-2026-88772: Critical Citrix NetScaler Zero-Days Exploited in the Wild

Citrix has released emergency security updates for two critical zero-day vulnerabilities affecting NetScaler ADC and NetScaler Gateway after confirming that attackers are already exploiting both flaws in real-world attacks. Tracked as CVE-2026-88771 and CVE-2026-88772, the vulnerabilities each carry a CVSS v4.0 score of 9.5 and can enable unauthenticated remote code execution on vulnerable appliances.

The flaws are particularly dangerous because NetScaler appliances commonly sit at the edge of enterprise networks, providing application delivery, VPN access, authentication, and remote connectivity. Successful compromise can therefore give attackers a strategically valuable foothold between external users and internal infrastructure.

CVE-2026-88771 is caused by improper input validation and can allow an unauthenticated attacker to execute arbitrary commands remotely. No optional feature or special configuration is required: vulnerable NetScaler ADC and Gateway deployments are exposed even in their default configuration.

CVE-2026-88772 is a memory overflow vulnerability that can result in remote code execution or denial of service. Exploitation requires DTLS to be enabled, but Citrix notes that DTLS is enabled by default on VPN virtual servers, making many NetScaler Gateway deployments potentially exposed without administrators having explicitly turned the feature on.

CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27, 2026, citing reports and partner intelligence confirming global exploitation. Federal Civilian Executive Branch agencies were given until September 30 to apply Citrix’s fixes.

Contact Sales

CVE-2026-88771 and CVE-2026-88772 analysis

The two zero-days provide different technical paths to compromise but lead to similarly severe outcomes.

CVE-2026-88771 analysis centers on an improper input validation weakness classified as CWE-20. Citrix states that an unauthenticated network attacker can exploit the flaw to execute arbitrary commands on a vulnerable NetScaler appliance.

The vulnerability requires no special deployment mode. CVE-2026-88771 affects all vulnerable NetScaler ADC and NetScaler Gateway installations, including systems running the default configuration.

Its CVSS 4.0 vector is:

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The vulnerability is remotely reachable, requires no attacker privileges or victim interaction, and can have high impact across confidentiality, integrity, and availability.

CVE-2026-88772 takes a different path. The vulnerability is classified as CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer. Memory corruption triggered through the vulnerable DTLS path can cause either remote code execution or denial of service.

The key details for CVE-2026-88772 are configuration-related. The vulnerable condition exists when DTLS is enabled on NetScaler ADC or Gateway. Citrix specifically warns that DTLS is enabled by default on VPN virtual servers.

For example, a configuration such as:

add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE

does not explicitly disable DTLS, meaning the VPN virtual server remains exposed.

A configuration containing:

-dtls OFF

does not meet the documented prerequisite for this particular vulnerability.

Other virtual servers configured directly with the DTLS type can also expose the vulnerable functionality.

CVE-2026-88772 has the following CVSS 4.0 vector:

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Although Citrix rates its attack complexity higher than CVE-2026-88771, successful exploitation can still provide unauthenticated RCE and potentially complete compromise of the affected appliance.

Both vulnerabilities affect the following supported NetScaler releases before their respective fixed builds:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
• NetScaler ADC FIPS 14.1 before 14.1-73.37 FIPS
• NetScaler ADC FIPS and NDcPP 13.1 before 13.1-37.279

Secure Private Access Hybrid deployments that use affected NetScaler instances also require upgrades.

Citrix-managed cloud services and Citrix-managed Adaptive Authentication are handled by Cloud Software Group, which applies the required software updates to those managed services.

The disclosure followed unusual warnings over the preceding weekend. Before Citrix published CVE identifiers and patches, security researchers and incident responders had reported evidence of multiple previously undisclosed NetScaler RCE vulnerabilities being exploited against internet-facing appliances. Some organizations were reportedly advised to isolate or temporarily shut down vulnerable systems while awaiting official remediation.

Citrix published CTX697096 on September 27, confirming that exploitation of both vulnerabilities had been observed on unmitigated deployments.

The exact private discovery dates have not been publicly disclosed, and Citrix has not identified the threat actors responsible for the attacks or provided a definitive start date for the exploitation campaign.

The attacks are significant because edge appliances provide an attractive initial foothold. Successful command or code execution on a NetScaler system could potentially allow attackers to deploy persistent payloads, access authentication material, inspect traffic, steal credentials, alter configuration, or pivot toward systems reachable from the appliance.

These are potential consequences of appliance compromise. Citrix has not publicly documented the complete post-exploitation chain used in every observed attack.

At present, there is no credible, independently verified fully weaponized public CVE-2026-88771 PoC referenced in Citrix’s advisory or the two requested reports. This does not lower the immediate risk: Citrix and CISA have already confirmed that attackers possess working exploitation capabilities.

Citrix has made generic compromise-detection capabilities available through the NetScaler Console Security Advisory workflow. The feature requires telemetry and is available through the Console service as well as supported on-premises Console deployments using Cloud Connect.

There is no comprehensive public set of attacker-specific CVE-2026-88772 IOCs such as IP addresses, malware hashes, domains, or command strings in the source material. Organizations should therefore avoid treating the absence of a known IOC match as evidence that an appliance is clean.

Citrix specifically warns that its available checks cannot cover every attacker technique and may fail to identify every compromise. External logs and forensic evidence are therefore important.

CVE-2026-88771 and CVE-2026-88772 Mitigation

Citrix strongly recommends upgrading every affected NetScaler ADC and Gateway appliance immediately.

The fixed builds are:

• NetScaler ADC / Gateway 14.1-73.37 or later
• NetScaler ADC / Gateway 13.1-64.23 or later
• NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS or later
• NetScaler ADC 13.1-FIPS / NDcPP 13.1-37.279 or later

Administrators running 13.1 should also review Citrix’s latest upgrade guidance. Citrix notes that some deployments using NetScaler variables may encounter a reboot-loop issue during upgrade to 13.1-64.23 and advises planning for 13.1-64.24 where applicable.

For CVE-2026-88771 there is no configuration prerequisite that administrators can simply disable. The vulnerability affects default configurations, so reducing exposure does not replace installation of the vendor update.

The primary CVE-2026-88772 mitigation is also upgrading to a fixed build. Administrators can additionally determine whether the vulnerable DTLS condition exists and, where operationally appropriate, explicitly disable DTLS on VPN virtual servers until patching is complete. This should be viewed only as exposure reduction for that CVE, not as a substitute for updating the appliance.

Because exploitation has already occurred, defenders should approach remediation as both a patching and incident-response exercise.

CVE-2026-88771 detection should start by identifying every customer-managed NetScaler ADC and Gateway appliance, determining its exact running build, and establishing whether it was

Key Takeaways

• Citrix has released emergency security updates for two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway, with CVSS v4.0 scores of 9.5 each.
• Both vulnerabilities enable unauthenticated remote code execution, with CVE-2026-88771 requiring no special configuration and CVE-2026-88772 exploiting DTLS enabled by default on VPN virtual servers.
• Because NetScaler appliances sit at the network edge handling authentication and remote access, successful exploitation can give attackers a strategic foothold between external users and internal infrastructure.