Citrix Confirms Exploitation of Two Critical NetScaler Zero-Day Vulnerabilities
Attackers remotely executed code before patches were available, impacting unmitigated systems.
1Zero-Day Exploitation Confirmed
Citrix confirmed two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and Gateway were exploited before patches were released. These flaws allow remote code execution, enabling attackers to take control of affected systems. The vulnerabilities were discovered during forensic investigations, not through Citrix's initial warnings. Security researchers at watchTowr validated the credibility of early reports about the exploits.
2Early Warnings and Private Alerts
Before Citrix's official confirmation, IT providers and security teams privately advised administrators to take NetScaler systems offline as early as September 26. The Dutch National Cyber Security Centre also issued pre-notifications to organizations in the Netherlands. A European partner CERT shared details about the two critical flaws, one of which allowed shellcode injection directly into memory. These warnings preceded Citrix's public acknowledgment and patch release on September 27.
3Technical Details of the Flaws
CVE-2026-88771 involves improper input validation, allowing unauthenticated attackers to execute arbitrary commands on all affected NetScaler ADC and Gateway deployments. CVE-2026-88772 is a memory overflow flaw affecting systems with DTLS enabled, which is default for NetScaler Gateway VPN servers. Both vulnerabilities carry CVSS scores of 9.5, indicating critical severity. Patches are available in NetScaler ADC and Gateway versions 14.1-73.37 and later, as well as 13.1-64.23 and later.
4Patching Challenges and Misconceptions
Organizations that patched NetScaler last month for CVE-2026-19490 are still vulnerable to these new flaws, as builds 14.1-73.32 and 13.1-63.21 don't address them. The 13.1 branch, which reached End of Maintenance on September 15, still receives this security fix but requires upgrade planning. Citrix emphasizes that patching alone isn't sufficient and recommends using NetScaler Console's Indicators of Compromise (IoCs) to detect potential breaches, though these may not catch all attack techniques.
5NetScaler's Critical Network Position
NetScaler appliances occupy sensitive points in corporate networks, providing VPN access, load balancing, and authentication services. Compromising a NetScaler gives attackers a strategic foothold at network edges. The default enablement of DTLS for VPN virtual servers increases exposure to CVE-2026-88772 unless explicitly disabled. This positioning makes timely patching particularly crucial, as demonstrated by the active exploitation observed before fixes were available.
6Detection and Forensic Considerations
Citrix provides generic IoCs through NetScaler Console to help identify compromises, available for both cloud and on-premises deployments with Cloud Connect. The feature requires enabled telemetry and works from version 14.1-73.36 onward. Organizations without NetScaler Console must contact Citrix Support for assistance. Citrix cautions that IoCs may miss some attacker techniques, recommending involvement of experienced forensic investigators when breaches are suspected.
7Version-Specific Patch Requirements
The patches address eight security issues total, including the two exploited zero-days. Fixes are available for multiple branches: 14.1-73.37+, 13.1-64.23+, 14.1-FIPS, 13.1-FIPS, and 13.1-NDcPP. The vulnerabilities' impact varies by deployment configuration and enabled features, potentially causing RCE, denial of service, HTTP request smuggling, policy bypass, or TCP sequence number prediction under specific conditions. Citrix strongly urges immediate updates for all affected systems.
8Broader Implications for Enterprise Security
This incident highlights the challenges of securing critical network infrastructure against zero-day exploits. The gap between private warnings and public patches left organizations vulnerable, while the NetScaler's central role amplified potential damage. The case underscores the importance of proactive threat intelligence sharing and the limitations of patch-only security strategies, especially for systems like NetScaler that sit at network perimeters handling sensitive authentication functions.