Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772

1. Executive summary

Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway on 2026-09-27, two of which are critical remote code execution flaws that were exploited as zero-days before the vendor advisory published. CVE-2026-88771 (CVSS 9.5, CWE-20) and CVE-2026-88772 (CVSS 9.5, CWE-119) are both in the CISA KEV catalog, added 2026-09-27, with a CISA remediation due date of 2026-09-30. CVE-2026-88771 works against default configurations with low attack complexity, so every unpatched internet-facing NetScaler appliance is a candidate target; CVE-2026-88772 needs DTLS enabled and carries high attack complexity. NetScaler sits at the perimeter of most EMEA financial services networks, terminating TLS and brokering remote access, so a successful exploit gives an unauthenticated attacker a position inside the DMZ from which to reach internal systems. Help Net Security reports the flaws were exploited for weeks before disclosure and used to plant webshells, which means patching alone is not sufficient: any appliance that was internet-facing during the exposure window needs compromise assessment.

2. Regulatory framing

3. Technical analysis & attack chain

The two exploited flaws are distinct in reachability and in exploitation difficulty. CVE-2026-88771 is an improper input validation flaw (CWE-20) that reaches RCE in a default NetScaler configuration with no additional features enabled; Citrix rates the attack complexity as low, so reliable exploitation is expected against any vulnerable appliance regardless of how it is configured. CVE-2026-88772 is a memory buffer flaw (CWE-119) that requires the DTLS feature to be enabled, and Citrix rates its attack complexity as high, so reliable exploitation is harder. Both allow an unauthenticated attacker to execute arbitrary code remotely. ANSSI's CERT-FR alert of 2026-09-28 describes both as allowing remote arbitrary code execution by an unauthenticated attacker, which corroborates the unauthenticated RCE characterisation across two national CERTs and the vendor.

Confirmed sequence, from the sources:

1. An unauthenticated attacker reaches a vulnerable NetScaler ADC or Gateway appliance over the network. No credentials and no user interaction are required.
2. For CVE-2026-88771, the attacker sends crafted input that passes improper input validation and reaches code execution; the appliance needs no special configuration. For CVE-2026-88772, the attacker targets the DTLS path, which must be enabled on the appliance.
3. Code execution on the appliance gives the attacker a foothold on a perimeter device that terminates TLS and brokers remote access.
4. Help Net Security reports the attackers planted webshells on compromised devices, giving persistent access that survives the initial exploit.
5. CISA reports the exploitation is occurring globally. Multiple national CERTs, including ANSSI, issued alerts.

The exposure window is the part that changes the response. Help Net Security reports the flaws were exploited for weeks before the 2026-09-27 disclosure, and that rumours of their existence and active exploitation surfaced on Reddit on the Friday before, driven by warnings from IT suppliers who had the information from the Dutch National Cyber Security Center (NCSC-NL). Security researcher Kevin Beaumont is cited saying European government sources had been warning of the activity. That account is single-sourced to Help Net Security and the pre-disclosure timeline rests on it; treat the "weeks" figure as reported rather than confirmed, but treat the possibility of pre-disclosure compromise as the working assumption for any appliance that was internet-facing.

The remaining six vulnerabilities in the same Citrix release are not reported as exploited: HTTP request smuggling (CWE-444), policy bypass involving URL expressions (CWE-16), memory overflow in Gateway or AAA configuration (CWE-119), memory overflow in load balancer of type Oracle configuration (CWE-119), memory overflow in a LB/CS or CGNAT-LSN/NAT64 configuration (CWE-119), and predictable TCP initial sequence numbers (CWE-342). The same vendor updates remediate all eight.

No malware family, no threat actor and no MITRE ATT&CK profile is named in any source for this activity. There is no attribution to report. The webshell detail is the only post-exploitation capability described, and it comes from a single source.

A note on the CVSS figure: the source and the verified reference data agree on 9.5 CRITICAL for both CVEs. The source describes the score as CVSSv4; the verified reference data records 9.5 for both without a version qualifier. No conflict in the value.

4. Mitigation & containment

P1, within 24 hours:

• Update every NetScaler ADC and NetScaler Gateway appliance to a fixed release, outside the normal patch cycle. Fixed versions: 14.1-73.37 and later; 13.1-64.23 and later releases of 13.1; 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS; 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later releases of 13.1-FIPS and 13.1-NDcPP. The CISA KEV due date is 2026-09-30, which leaves two days from this advisory.
• Where an appliance cannot be updated inside that window, remove it from internet exposure or take it out of service. CISA's required action for both CVEs is to apply vendor mitigations or discontinue use of the product where mitigations are unavailable.
• Treat every appliance that was internet-facing before the update as potentially compromised and start triage. Help Net Security reports webshells were planted, so look for attacker-added files and configuration on the appliance itself, not only for the exploit traffic.
• Hunt for webshell artefacts on NetScaler appliances and on any host the appliance can reach. The sources do not name webshell filenames or paths, so this is a behavioural hunt: unexpected files in web-accessible directories, new or modified configuration objects, and outbound connections from the appliance to hosts it has no business contacting.

P2, within 72 hours:

• Rotate credentials and certificates that terminate on or pass through the appliance, including any authentication material the appliance holds for back-end services. An attacker with code execution on a TLS-terminating perimeter device can reach material the appliance handles.
• Review NetScaler logs for the exposure window back to at least the point the pre-disclosure warnings began, not just from 2026-09-27. The reported "weeks" of exploitation means a 24-hour log window will miss it.
• Confirm whether DTLS is enabled on each appliance. Appliances with DTLS enabled were exposed to CVE-2026-88772 in addition to CVE-2026-88771; appliances without it were exposed to CVE-2026-88771 only. This does not change the patch requirement, but it scopes the CVE-2026-88772 hunt.

P3, within 7 days:

• Reconcile the asset inventory against all four fixed product lines, including the FIPS and NDcPP builds. FIPS and NDcPP appliances are frequently tracked separately from general-purpose estate and are the ones most likely to be missed.
• If Rapid7 tooling is in use, Exposure Command, InsightVM and Nexpose authenticated checks for all eight CVEs were expected in the 2026-09-28 content release. Run them to confirm remediation rather than relying on change records.
• Update the third-party risk record for Citrix to reflect the emergency update and record any appliance that remained unpatched past 2026-09-30 with the compensating control applied.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. Rapid7 states that indicators are being tracked in its Intelligence Hub but does not publish any in the blog post, and no other source in this set provides hashes, domains, IP addresses or file paths.

The sources do describe observable behaviour. Those are listed separately below and are not machine-pivotable atomic indicators.

Behavioural indicators

6. Detection

The sources do not provide distinctive strings, filenames, command-line flags, mutex names, registry keys or hard-coded values for this activity. The only post-exploitation artefact named is "webshell", with no filename, path or content. There is nothing to build a YARA rule from that would detect the threat rather than reporting about it.

Insufficient indicators to author detection rules.

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV), 2 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7, "ETR: Zero-Day Exploitation of Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772)", https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772, 2026-09-28.
• Help Net Security, "Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)", https://www.helpnetsecurity.com/2026/09/28/citrix-netscaler-rce-zero-days-exploited-for-weeks-cve-2026-88771-cve-2026-88772/, 2026-09-28.
• ANSSI CERT-FR, "Multiples vulnérabilités dans Citrix NetScaler ADC et Gateway", https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/, 2026-09-28.
• CISA Known Exploited Vulnerabilities, CVE-2026-88772, https://nvd.nist.gov/vuln/detail/CVE-2026-88772, KEV added 2026-09-27.
• CISA Known Exploited Vulnerabilities, CVE-2026-88771, https://nvd.nist.gov/vuln/detail/CVE-2026-88771, KEV added 2026-09-27.
• The Hacker News, "CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally", https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html, 2026-09-28.
• Rapid7, "CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway", https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway, 2026-08-19. Background only; CVE-2026-19490 is a separate August 2026 authentication bypass and is not part of this event.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-88771 as the urgent item: CVSS 9.5 CRITICAL, in CISA KEV since 2026-09-27, low attack complexity, exploitable in a default configuration, and confirmed exploited in the wild. CVE-2026-88772 is also CVSS 9.5 CRITICAL and in CISA KEV, but its high attack complexity and DTLS requirement narrow the exposed population. The CISA remediation due date of 2026-09-30 gives clients two days, and the reported weeks of pre-disclosure exploitation mean patching is the floor, not the ceiling: any appliance that was internet-facing before the update should be treated as a candidate for compromise assessment, with the caveat that the pre-disclosure timeline and the webshell detail rest on a single source and should be verified against your own logs. No actor is attributed in any source, so we make no attribution. We will track the Citrix advisory and the Rapid7 Intelligence Hub for indicators as they are published, and we will issue a follow-up if atomic IOCs or a named actor emerge. Clients who cannot complete the update by 2026-09-30 should contact us to scope compensating controls and the incident-reporting assessment under DORA Art. 19.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.