Citrix patches two actively exploited NetScaler zero-days enabling unauthenticated remote code execution

On 27 September 2026, Citrix confirmed that two critical zero-day vulnerabilities in its NetScaler ADC and NetScaler Gateway appliances — tracked as CVE-2026-88771 and CVE-2026-88772 — had been exploited in the wild before fixes were available. The company published patched builds in security bulletin CTX697096 the same day, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog, warning that "threat actors are actively exploiting these vulnerabilities globally."

Both bugs are rated critical, with a CVSSv4 score of 9.5, and each can independently enable remote code execution on an affected appliance. CVE-2026-88771 stems from improper input validation and lets an unauthenticated attacker run arbitrary commands; CVE-2026-88772 similarly enables remote code execution or denial of service. Researchers at watchTowr, who discovered the issues during a forensic investigation, and vendors including Rapid7 warned that exploitation of CVE-2026-88771 works against NetScaler deployments in their default configuration with low attack complexity, making reliable exploitation likely against any exposed, unpatched appliance.

Emergency response

The zero-days first surfaced on 26 September, when NetScaler administrators reported being told by suppliers and security teams to shut their appliances down following a confidential pre-notification from the Dutch National Cyber Security Centre (NCSC-NL). Citrix released fixed builds — NetScaler ADC and Gateway 14.1-73.37 and later, and 13.1-64.23 and later — on 27 September. CISA urged defenders to check for indicators of compromise before patching, because applying updates can erase the forensic evidence needed to determine whether an appliance was already breached.

Why it matters

NetScaler gateways sit at the network edge and broker remote access, making them a perennial, high-value target for both espionage crews and ransomware affiliates who prize a durable foothold. A pre-authentication remote-code-execution flaw on such a device is close to a worst case, and by 29 September security firms reported that exploitation had escalated into mass, opportunistic attacks against internet-exposed appliances. With unpatched systems still being targeted and compromise assessments ongoing, the incident's status was recorded as ongoing.