Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway

1. Executive summary

Citrix has published a security bulletin covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771 and CVE-2026-88772) the NCSC states are confirmed as actively exploited. Both exploited flaws are remote and unauthenticated: CVE-2026-88771 is improper input validation leading to arbitrary command execution, and CVE-2026-88772 is an out-of-bounds memory operation leading to remote code execution or denial of service. Only customer-managed, on-premises ADC and Gateway deployments are affected, which is the deployment model most EMEA financial services firms run for remote access and application delivery. No CVSS scores, severities or CISA KEV entries were resolved for these CVEs in our verified reference data, so this advisory does not assign a numeric severity; the exploitation status is taken from the NCSC statement. The bottom line for clients: internet-facing NetScaler appliances are the entry point, and the exploited pair requires no credentials.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	Two CVEs in an internet-facing appliance are confirmed actively exploited, and the NCSC directs defenders to investigate for evidence of compromise using published IoCs.	Firms running affected NetScaler instances must run this through their incident management process now, not at the next patch window: detection, triage and containment steps are already defined by the vendor and NCSC.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	Confirmed in-the-wild exploitation of an unauthenticated RCE in a perimeter appliance is a candidate major incident if a firm confirms compromise.	If compromise is confirmed and the incident meets the major-incident classification, the reporting clock starts at detection, not at patch completion.
NIS2 Art. 23: incident reporting obligations	Same trigger: confirmed exploitation of an unauthenticated RCE on a network-facing device.	In-scope entities that confirm compromise face the NIS2 early-warning and notification timeline; the NCSC also asks UK victims to report.

3. Technical analysis & attack chain

The exploited pair sits on the same appliance class and both are reachable without authentication. The confirmed steps, from the NCSC bulletin:

An unauthenticated remote attacker sends crafted input to an exposed NetScaler ADC or Gateway interface.
CVE-2026-88771 (improper input validation) permits arbitrary command execution on the appliance.
CVE-2026-88772 (improper restriction of operations within the bounds of a memory buffer) permits remote code execution or denial of service.
The attacker operates from the appliance, which sits on the network edge and typically holds session and authentication context for the services behind it.

The NCSC does not describe post-exploitation behaviour, persistence, command-and-control or lateral movement in the material available to us, and we will not infer it. What the bulletin does establish is that Citrix published accompanying IoCs, and that the NCSC's priority actions assume defenders will hunt for compromise rather than treat this as a patch-only event.

Affected versions, per the NCSC:

NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
NetScaler ADC FIPS before 14.1-73.37 FIPS
NetScaler ADC FIPS and NDcPP before 13.1-37.279

The remaining six CVEs in the same bulletin are lower urgency but relevant to the same estate: CVE-2026-88773 (HTTP request/response smuggling, may allow manipulation or bypass of security controls), CVE-2026-88774 (improper HTTP URL-based expression usage, feature policy bypass), CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777 (memory overflow, unpredictable behaviour or denial of service), and CVE-2026-88778 (predictable exact value, may affect integrity or availability). None of these six is described as exploited.

Two discrepancies to note. First, the GitHub advisory (GHSA-8jq9-gg9v-58rv) gives affected ranges as ADC and Gateway "from 14.1 through 73.32 and from 13.1 through 63.21", which does not match the NCSC's fixed-version thresholds (14.1-73.37 and 13.1-64.23). Treat the NCSC and Citrix figures as authoritative for remediation and use the GitHub ranges only as a cross-check. Second, the Hacker News item, citing watchTowr on 26 September, describes two unpatched zero-days with no vendor fix available; the NCSC bulletin published 28 September describes a Citrix security bulletin with fixed versions. The two accounts are consistent with a fix landing between those dates, but we have not confirmed that sequence from a primary Citrix source.

Confidence caveats. The claim that CVE-2026-88771 and CVE-2026-88772 are actively exploited rests on the NCSC statement; we have not seen Citrix confirm exploitation independently. The watchTowr attribution of the initial discovery is single-sourced to The Hacker News and is unconfirmed. No threat actor is named in any source, and no MITRE ATT&CK profile applies, so there is no attribution to make. The IoC set referenced by the NCSC lives in the Citrix bulletin and blog, which we have not retrieved; we cannot reproduce those indicators here.

4. Mitigation & containment

P1, within 24 hours:

Inventory every customer-managed NetScaler ADC and Gateway instance and check the build against the four affected ranges above. Instances below 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS or 13.1-37.279 are in scope.
For any affected instance you cannot patch immediately, cut its exposure: block access at the upstream firewall, disable the vulnerable component, or restrict access to your own IP ranges. The NCSC notes isolation may cause a service outage and accepts that trade-off.
Hunt for compromise on affected instances using the IoCs in the Citrix bulletin and blog. Do not treat a clean vulnerability scan as evidence of no compromise.
If you confirm compromise and are in the UK, report it to the NCSC and to Citrix.

P2, within 72 hours:

Install the fixed builds: 14.1-73.37 or later, 13.1-64.23 or later, 14.1-73.37 FIPS or later, 13.1-37.279 or later, matching your platform.
Where a rebuild is feasible, replace the appliance with a new, fully up-to-date system rather than patching in place, then re-enable access.
Enable NetScaler Console File Integrity Monitoring on managed instances to catch unauthorised or unexpected file changes.

P3, within 7 days:

Re-enable and reintroduce isolated systems only after the fixed build is confirmed running and the compromise hunt is complete.
Keep monitoring the Citrix security bulletin and run continuous threat hunting against the appliance estate.
Review lateral-movement exposure from the appliance segment, since a compromised NetScaler sits inside the trust boundary for the services it fronts.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. The NCSC states that the Citrix security bulletin and accompanying blog include IoCs, but those documents were not retrieved for this advisory. Clients should obtain them directly from Citrix before hunting.

Behavioural indicators:

Behaviour	Where to observe	Confidence
Unauthenticated crafted input reaching NetScaler ADC or Gateway interfaces, followed by command execution on the appliance	NetScaler ADC/Gateway logs, upstream firewall and WAF logs, EDR on the appliance host if instrumented	Medium; derived from the NCSC description of CVE-2026-88771, not from a published detection rule
Unexpected or unauthorised changes to monitored files on managed NetScaler instances	NetScaler Console File Integrity Monitoring	Medium; NCSC recommends this control explicitly for this event
Memory-related faults or crashes on the appliance	NetScaler system logs, crash dumps	Medium; consistent with CVE-2026-88772 and the three memory overflow CVEs, but not confirmed as an exploitation signature

6. Detection

Insufficient indicators to author detection rules.

The sources give vulnerability descriptions and affected version ranges, not artefacts of the exploitation itself. No file hashes, command lines, mutexes, scheduled-task names, registry keys, file paths or ransom-note strings appear in the material provided. The CVE identifiers and product names are reporting about the threat, not threat artefacts, and a rule built on them would detect this advisory rather than an intrusion. Detection should be driven by the IoCs in the Citrix bulletin and blog once retrieved, and by the behavioural indicators in section 5.

7. Sources

NCSC, "Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway", https://www.ncsc.gov.uk/news/exploitation-of-vulnerabilities-affecting-citrix-netscaler-adc-and-citrix-netscaler-gateway, 28 September 2026.
ANSSI France CERT, "Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway", https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1235/, 28 September 2026.
The Hacker News, "Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation", https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html, September 2026.
BSI Germany, "[NEU] [kritisch] Citrix NetScaler ADC und Citrix NetScaler Gateway: Mehrere Schwachstellen", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3587.
GitHub Security Advisories, "Vulnerability in NetScaler ADC and NetScaler Gateway", https://github.com/advisories/GHSA-8jq9-gg9v-58rv.
SecurityWeek, "Recent Citrix NetScaler Vulnerability Exploited in the Wild", https://www.securityweek.com/recent-citrix-netscaler-vulnerability-exploited-in-the-wild/.
BSI Germany, "[NEU] [hoch] Citrix Systems NetScaler ADC und Gateway: Mehrere Schwachstellen", https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2147.

8. Adverse Trace position

We assess this as a high-urgency perimeter event for any EMEA financial services client running customer-managed NetScaler ADC or Gateway, on the strength of the NCSC's confirmed-exploitation statement for two unauthenticated remote flaws, not on any CVSS score: our verified reference data resolved no CVSS, severity or CISA KEV entry for these CVEs, so we are not assigning a numeric rating and clients should not read one into this note. The exploitation status is single-sourced to the NCSC and the IoC set sits in a Citrix document we have not retrieved, so treat the indicators as pending until you pull the bulletin directly. We will retrieve the Citrix bulletin and blog, extract the IoCs, and issue a follow-up with atomic indicators and detection rules; in the meantime we will track whether CISA adds these CVEs to KEV and whether Citrix confirms exploitation independently. Clients who cannot confirm their NetScaler build against the four affected ranges within 24 hours should treat the appliance as exposed and isolate it.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.