Summary

Citrix has confirmed two critical remote code execution vulnerabilities, CVE-2026-88771 and CVE-2026-88772, in its NetScaler ADC and NetScaler Gateway appliances, both exploited in the wild as zero-days before any fix was available. CVE-2026-88771 comes from improper input validation and lets an unauthenticated attacker run arbitrary commands on the appliance, affecting every deployment on an affected version, including the default configuration. CVE-2026-88772 is a memory overflow that can lead to code execution or a denial-of-service condition when DTLS is enabled, which is the default state for VPN virtual servers.

Because NetScaler devices sit at the network edge and handle VPN, remote access, load balancing, and user authentication, a compromised appliance hands an attacker a foothold at the perimeter and a path toward internal systems. Citrix published security bulletin CTX697096 with fixed builds on September 27, 2026. No threat actor or malware family has been publicly attributed.

Vulnerability Details

Technical summary

Vulnerabilities

Recommendations

1. 01
   Preserve Forensic Evidence First

   Before making any changes, capture the logs, a system snapshot, a technical support bundle, and a core dump from every exposed appliance. Because the attacks happened before a fix existed, patching can overwrite the very traces that would show whether you were breached, so collecting evidence up front is essential for any later investigation.
2. 02
   Update to the Fixed Builds Without Delay

   Upgrade every NetScaler ADC and NetScaler Gateway to the fixed build for its branch (14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279), and update Secure Private Access hybrid deployments to the recommended builds. There is no workaround, so upgrading is the only fix. On 13.1, run show ns variable first; if it returns any variables, use 13.1-64.24 to avoid a known reboot loop during the upgrade.
3. 03
   Assume Compromise and Hunt for It

   Run the IOC scan available on the NetScaler Console Security Advisory page, or request the indicators from Citrix Support, and consider the Dutch NCSC check scripts as an additional pass. Treat any internet-facing appliance as potentially compromised until proven otherwise, and remember that a clean scan is not proof of safety, because the published indicators do not cover every technique.
4. 04
   Rotate Credentials, Secrets, and Certificates

   Reset the passwords of every service account and user that authenticated through the appliance, replace any secrets stored on it, and revoke and reissue its certificates and private keys. A compromised NetScaler can expose everything it holds or brokers, so rotating credentials limits what an attacker can reuse after you patch.
5. 05
   Reduce Internet Exposure of the Management Plane

   Keep NetScaler management interfaces off the public internet, and where you cannot patch immediately, isolate or limit the exposure of affected appliances until you can. Forward NetScaler logs to your SIEM so that exploitation attempts and post-exploitation activity are captured centrally.

MITRE ATT&CK TTPs

References & Patch Links

Patch link

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
• https://watchtowr.com/intelligence/citrix-netscaler-adc-citrix-netscaler-gateway-remote-code-execution-cve-2026-88771/