~/f4n6 $ grep -r "Active exploitation of Citrix NetScaler CVE-2026-88771 allows unauthenticated command execution" ./investigations/ --include="*.md"

Active exploitation of Citrix NetScaler CVE-2026-88771 allows unauthenticated command execution

Jeff Davies 19 Oct 2026 9 min read

1. Executive summary

Citrix disclosed eight NetScaler ADC and Gateway vulnerabilities on 2026-09-27, two of which are under active exploitation as zero-days: CVE-2026-88771 (CVSS 9.5, critical, CWE-20) and CVE-2026-88772 (CVSS 9.5, critical, CWE-119). Both are in CISA KEV, added 2026-09-27, with a remediation due date of 2026-09-30; EPSS for each is 1%. CVE-2026-88771 permits unauthenticated command execution on appliances in their default configuration, which puts every internet-facing NetScaler Gateway that has not been updated since late September in scope. EMEA financial services clients running NetScaler for remote desktop or application access should treat any such appliance as potentially compromised, not merely exposed, and should prioritise forensic triage over patching alone.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 19: reporting of major ICT-related incidents to competent authorities NetScaler Gateway is an internet-facing authentication boundary for remote access; unauthenticated command execution on it is a candidate major ICT-related incident, and CISA records confirmed exploitation in the wild If triage finds evidence of exploitation, the incident classification under Art. 18 and the reporting timeline under Art. 19 start from detection, not from patch completion
DORA Art. 28: ICT third-party risk, general principles The affected component is vendor-supplied gateway software, and the fix depends on a Citrix release plus the client's own deployment cycle Contractual and monitoring arrangements with the NetScaler supplier and any managed-service provider need to cover emergency out-of-band patching and vendor notification
NIS2 Art. 21(2)(d): supply chain security measures Exploitation of a supplier product in its default configuration, where the supplier's patch must be identified, tested and deployed by the client Entities in scope need evidence that supplier vulnerability notifications reach the team that owns the appliance, and that emergency change is possible outside the normal cycle

3. Technical analysis & attack chain

The exploited path is the public authentication surface of NetScaler Gateway. In a standard Citrix deployment the user authenticates at the Gateway, which uses a secure ticket authority to pass the session to StoreFront, which lists the published applications and desktops; the native Citrix client then opens a separate connection over the Independent Computing Architecture (ICA) protocol, and the Gateway validates the ticket before proxying that connection. The Gateway has to be reachable from the internet for users to start a session, and that reachability is what the exploit uses.

  1. The attacker reaches the NetScaler Gateway login interface directly over the internet. No prior authentication is required for CVE-2026-88771.
  2. Against CVE-2026-88771, the attacker sends input that the appliance fails to validate (CWE-20). Citrix rates attack complexity as low and the flaw applies in the default configuration, so no optional feature needs to be enabled for the appliance to be vulnerable.
  3. Successful exploitation gives command execution on the appliance. CISA records the impact as an unauthenticated attacker executing arbitrary commands.
  4. Against CVE-2026-88772, the attacker targets DTLS handling. The flaw is a memory overflow (CWE-119) reachable only where the DTLS feature is enabled; Citrix rates its attack complexity as high, and CISA records remote code execution or denial of service as the outcome.
  5. Citrix's later advisories on 2026-10-03 and 2026-10-08 covered additional SAML configuration vulnerabilities, which the Cloudflare post describes as allowing attackers to execute arbitrary scripts on target machines and to run denial of service attacks.

CVE-2026-88771 is the urgent one. Default-configuration applicability and low attack complexity mean reliable remote code execution is likely against any unpatched appliance, regardless of how it is configured. CVE-2026-88772 is narrower: DTLS must be enabled, and reliable exploitation is harder. Both are confirmed exploited and both are in CISA KEV.

The eight vulnerabilities patched in the 2026-09-27 release, per Rapid7, are: CVE-2026-88771 (improper input validation leading to RCE, default configuration, CWE-20, exploited); CVE-2026-88772 (memory overflow leading to RCE in a DTLS configuration, CWE-119, exploited); HTTP request smuggling (CWE-444, not known exploited); policy bypass involving URL expressions (CWE-16, not known exploited); memory overflow in Gateway or AAA configuration (CWE-119, not known exploited); memory overflow in load balancer of type Oracle configuration (CWE-119, not known exploited); memory overflow in LB/CS or CGNAT-LSN/NAT64 configuration (CWE-119, not known exploited); predictable TCP initial sequence numbers (CWE-342, not known exploited). Rapid7's table does not print CVE identifiers for the six non-exploited entries, and this advisory does not supply them.

Separately, The Register reports CVE-2026-107406, a CVSS 9.5 memory overflow (CWE-119) in SAML service provider and identity provider configurations, disclosed around 2026-10-09, with older builds affected in both roles and some newer builds affected only as identity provider. Citrix has not identified that flaw as exploited. The Register also reports CVE-2026-88779, an exploited SAML memory overflow at CVSS 8.7. Neither CVE appears in the KEV data available here, so neither carries a verified exploitation state in this advisory.

Attribution and campaign detail are thin and single-sourced. The Register, citing Google researchers, reports a campaign exploiting CVE-2026-88772 running since at least early September 2026, with organisations in government, finance, legal and education across North America and Europe likely affected. No actor is named in any source provided, and no MITRE ATT&CK profile is available for an actor in this item, so attribution is unconfirmed. CISA records known ransomware campaign use for both KEV entries as unknown; nothing in the sources indicates ransomware, data theft or extortion. The Cloudflare post refers to a CISA alert and a Mandiant technical investigation but does not link or reproduce either, so their content is not reflected here.

4. Mitigation & containment

P1, within 24 hours:

  • Inventory every NetScaler ADC and Gateway instance, including FIPS and NDcPP builds and any Secure Private Access Hybrid deployment, and establish which are reachable from the internet. Patch all of them to Citrix NetScaler ADC and Gateway 14.1-73.37 or later, 13.1-64.23 or later on the 13.1 branch, 14.1-FIPS 14.1-73.37 FIPS or later, or 13.1-FIPS and 13.1-NDcPP 13.1.37.279 or later. These are the vendor-supplied fixed releases listed by Rapid7; confirm against the current Citrix advisory before deployment.
  • Where an instance cannot be updated immediately, apply the vendor mitigation guidance and put a WAF rule in front of the Gateway. Cloudflare published an emergency WAF rule for CVE-2026-88771 on 2026-10-01. A WAF rule buys time; it does not remove the vulnerability.
  • Treat every appliance that was internet-facing and unpatched before 2026-09-30 as potentially compromised. Follow Citrix's suspected-compromise guidance: preserve evidence, revoke credentials and certificates, investigate connected systems, and rebuild or restore from a known-good state. Patching a compromised appliance does not evict an attacker.
  • Review DTLS listeners specifically. CVE-2026-88772 requires DTLS to be enabled, and Cloudflare notes that protections placed in front of the web authentication path do not automatically extend to DTLS-enabled listeners. Those interfaces need their own exposure review and the applicable updates.

P2, within 72 hours:

  • Put an independent access decision ahead of the Gateway so unauthenticated requests never reach the appliance. Cloudflare Access is the example in the source; any equivalent identity-aware proxy serves the same purpose. The Citrix environment continues to decide which desktop a user may launch and to validate the session ticket.
  • Close direct-to-origin reachability. Changing a DNS record is not sufficient: if the appliance is reachable by IP address or an alternative hostname, the access policy in front of it can be bypassed. Use an outbound-only tunnel (Cloudflare Tunnel is the source's example) and remove inbound public IP reachability, or restrict the origin firewall to dedicated egress addresses and add mutual TLS origin pulls. Where the origin supports it, validate the Access JSON Web Token, including signature, issuer, expiry and intended audience.
  • Check policy, firewall and origin logs rather than relying on what the browser shows, and repeat the check whenever routing, identity or failover settings change.

P3, within 7 days:

  • Patch the SAML configuration flaws covered by the 2026-10-03 and 2026-10-08 advisories, and assess CVE-2026-107406 and CVE-2026-88779 against the Citrix advisory for your build. CVE-2026-107406 is not reported as exploited, but it is a 9.5 memory overflow in SAML configurations and the same class of flaw as the exploited CVE-2026-88779.
  • Apply the same exposure review to other internet-facing authentication pages: remote desktop portals, administrative consoles and management interfaces. The question to answer for each is whether the intended audience needs unrestricted internet reachability, and whether the authentication check can be bypassed to reach the server behind it.
  • For workloads that only need a desktop to open web applications, consider replacing the virtual desktop path rather than defending it. Cloudflare describes browser-based remote desktop access over Cloudflare Tunnel for supported Windows workloads, and Access with Browser Isolation for web-only use cases. This is an architectural change with its own routing and policy design, not a drop-in control.

5. Indicators of compromise

No indicators of compromise available in the source material. None of the sources provided publish file hashes, network indicators, filenames, paths or command lines. Rapid7 states that indicators are tracked in its Intelligence Hub but does not reproduce them; the CISA alert and Mandiant investigation referenced by Cloudflare were not available for this advisory.

Behavioural indicators:

behaviour where to observe confidence
Unauthenticated requests reaching the Gateway authentication interface from sources with no prior session NetScaler Gateway access logs, WAF logs, identity-aware proxy logs Medium; derived from the exploitation mechanism, not from a published IOC set
Command execution or unexpected process activity on the appliance itself NetScaler shell and system logs, configuration change history Medium; CISA records arbitrary command execution as the impact of CVE-2026-88771
Inbound traffic to DTLS listeners from unexpected sources Network flow logs for DTLS ports on the appliance Medium; CVE-2026-88772 requires DTLS to be enabled
Direct connections to the origin IP or an alternative hostname that bypass the access proxy Origin firewall logs, web server logs Medium; Cloudflare describes this as the bypass path around access controls

6. Detection

Insufficient indicators to author detection rules. The sources describe the exploitation mechanism and the affected component but publish no distinctive strings, command-line flags, filenames, paths, registry keys or hard-coded values that appear in the exploit or the post-exploitation activity. A rule built on the CVE identifiers or the product name would match reporting about the vulnerability, not the exploitation.

Detection effort should go into the behavioural indicators in §5: alert on unauthenticated requests reaching the Gateway from sources that never complete authentication, on inbound traffic to DTLS listeners from addresses outside the expected user population, and on any connection to the origin that did not arrive through the access proxy.

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-88771 9.5 Critical ⚠ KEV 2026-09-27 1% Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 1…
CVE-2026-88772 9.5 Critical ⚠ KEV 2026-09-27 1% Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.…

7. Sources

  • Cloudflare, "Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities", https://blog.cloudflare.com/protect-your-netscaler-gateway/, 2026-10-19
  • Rapid7, "Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772", https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772, 2026-09-28
  • ANSSI, "Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway", https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/, 2026-09-28
  • The Hacker News, "Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution", https://thehackernews.com/2026/09/citrix-netscaler-cve-2026-88772-exploit.html
  • NVD / CISA KEV, CVE-2026-88771, https://nvd.nist.gov/vuln/detail/CVE-2026-88771
  • NVD / CISA KEV, CVE-2026-88772, https://nvd.nist.gov/vuln/detail/CVE-2026-88772
  • The Register, "Citrix gives NetScaler admins another critical reason to patch", https://www.theregister.com/security/2026/10/09/citrix-gives-netscaler-admins-another-critical-reason-to-patch/5302212, 2026-10-09

8. Adverse Trace position

Adverse Trace assesses CVE-2026-88771 as the priority: CVSS 9.5 critical, in CISA KEV since 2026-09-27 with a 2026-09-30 remediation due date, EPSS 1%, default-configuration applicability and low attack complexity. CVE-2026-88772 carries the same CVSS and KEV status but needs DTLS enabled and is rated high complexity, so it ranks below CVE-2026-88771 for most estates. The EPSS figure of 1% understates the position for a KEV-listed flaw that is confirmed exploited; we treat KEV status as the governing signal here, not EPSS. Client impact is concentrated in firms that expose NetScaler Gateway to the internet for remote desktop or application access, which is the normal deployment. Attribution is unconfirmed: no actor is named in the sources and no MITRE ATT&CK profile is available, and the campaign reporting from Google researchers is single-sourced through The Register. We will track the Citrix advisories of 2026-10-03 and 2026-10-08 and the SAML flaws CVE-2026-107406 and CVE-2026-88779, and will issue a follow-up if CISA or Mandiant publish atomic indicators that support detection content. Clients who have not confirmed the patch state of every internet-facing NetScaler instance should do that before anything else in this advisory.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies