Two Citrix NetScaler Zero-Day Vulnerabilities Actively Exploited
Critical RCE flaws affect all deployments on vulnerable versions with no workaround available.
1Critical RCE flaws in production
Citrix confirmed two actively exploited zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and Gateway on September 27. These allow remote code execution on all deployments of affected versions, including default configurations. The bulletin came after security firm watchTowr reported unpatched RCE flaws being exploited, prompting some administrators to take appliances offline. No workarounds or compromise indicators were provided.
2Vulnerable versions identified
All appliances running builds 14.1-73.32 and 13.1-63.21 are affected, including those recently patched for August's CVE-2026-19490 authentication bypass. The 13.1 branch had already reached End of Maintenance on September 15, complicating patch management. Citrix urged immediate updates to fixed versions for customer-managed appliances, covering hybrid Secure Private Access deployments. Cloud services and Citrix-managed Adaptive Authentication receive automatic updates.
3Pre-disclosure exploitation confirmed
Attacks occurred before Citrix's public disclosure, meaning compromised systems may already harbor persistent threats. The Dutch NCSC's 2025 response to similar NetScaler zero-days showed patching alone doesn't remove pre-existing access. Their forensic scripts for live appliances, core dumps and full images remain available but carry effectiveness limitations. The live-appliance script detects compromise indicators non-specifically, with its last update in September 2025.
4Enterprise network exposure
As perimeter devices handling VPN, load balancing and authentication, compromised NetScalers provide attackers deep network access. The bulletin covers customer-managed instances but excludes details about exploitation scope or attackers. Security teams face challenges detecting intrusions since the flaws were exploited before fixes existed. This mirrors 2025 incidents where Dutch organizations required additional forensic checks post-patching to ensure threat eradication.
5Administrator response patterns
Some organizations preemptively shut down NetScalers after unverified warnings from IT suppliers, as reported on r/Citrix. The source of these supplier alerts remains unclear. watchTowr's September 26 posts cited credible rumors of multiple unpatched RCEs before confirming two found during forensics. Their timeline anticipated Citrix communications and patches by September 28 week's start, aligning with the eventual bulletin.
6Six additional vulnerabilities patched
Alongside the two exploited flaws, Citrix fixed six other vulnerabilities not currently under active attack. The bulletin didn't detail these, focusing instead on the critical RCEs. This follows Citrix's August update addressing CVE-2026-19490, showing recurring security challenges in NetScaler's authentication systems. The concentration of perimeter device vulnerabilities creates disproportionate risk given their network positioning.
7Detection limitations persist
Citrix's existing compromise guidance and the Dutch NCSC's scripts provide partial detection capabilities. The live-appliance script's README explicitly states it offers no effectiveness guarantees and wasn't updated for these specific flaws. Without built-in compromise indicators in the bulletin, security teams must rely on external forensic tools or network monitoring to identify potential breaches stemming from pre-patch exploitation.
8Perimeter security implications
The recurrent NetScaler vulnerabilities highlight systemic risks in edge security devices handling critical functions. The 2025 Dutch incident and current exploits demonstrate how perimeter flaws enable persistent access even after patching. Organizations must now weigh the operational impact of taking appliances offline against the risk of undetected compromises, with no definitive detection method available for these specific attacks.
Original article: The Hacker News — Two Citrix NetScaler Zero-Day Vulnerabilities Actively Exploited