Citrix NetScaler Zero-Day: Third Flaw Follows Patch Scramble

Another NetScaler warning, days after the last one

Citrix is again asking NetScaler customers to patch. Only days earlier, administrators were working through a batch of fixes that included two actively exploited zero-days. The company has now disclosed a further memory overflow vulnerability in NetScaler ADC and NetScaler Gateway, and some deployments will need another round of updates. 34 The Cybersecurity and Infrastructure Security Agency (CISA) followed on Friday with a call for organizations to patch their Citrix systems. 4

The sequence matters because defenders are still cleaning up a mass-exploitation campaign. A third urgent bulletin in quick succession squeezes teams that are already short on time.

How the crisis started

On September 27, 2026, Citrix published security bulletin CTX697096, which listed eight vulnerabilities across NetScaler ADC and NetScaler Gateway. 12 CISA amplified the disclosure to its constituencies. 5 Two of the eight, CVE-2026-88771 and CVE-2026-88772, were confirmed as exploited and carry severity scores of 9.5 out of 10. 12

CVE-2026-88771 is the more alarming of the two:

• No login needed. It is a pre-authentication remote code execution flaw caused by improper input validation. 12
• Default settings are exposed. It affects all versions of both products, including default configurations. 1
• It runs as root. The attack path runs through a maintenance script that parses NetScaler log data without proper sanitization. An attacker can poison the logs with commands that later run as root. 2

CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service. It requires Datagram Transport Layer Security (DTLS) to be enabled, which narrows the exposure somewhat. However, DTLS is on by default for VPN virtual servers, so in practice that condition is often met. 1

Weeks of quiet access before disclosure

Researchers at Google's Threat Intelligence Group (GTIG) trace the activity back to at least September 3, more than three weeks before Citrix's bulletin. 1 According to reporting on the campaign, exploitation spread across the internet within minutes of a proof-of-concept appearing publicly. More than 100 organizations have been compromised. 2

The most important practical detail is that patching does not evict attackers who are already inside. Intruders have planted WHIPSHOT web shells that survive the update. 2 Organizations that patched without checking for compromise may still be exposed.

The new flaw: conflicting details

Accounts of the latest disclosure do not fully agree.

	CSO Online 3	Cybersecurity Dive 4
CVE identifier	CVE-2026-88779	CVE-2026-107406
Severity score	8.7 (CVSS 4.0)	9.5 out of 10
Impact	Denial of service, repeatable to keep appliances unavailable	Remote code execution or denial of service
Exploitation	Citrix has observed targeted attacks on unmitigated deployments	No successful exploitation publicly reported

CSO Online also reports that Citrix has not attributed the attacks to any actor or explained how the flaw is being exploited. Citrix says the issue affects customer-managed deployments on supported versions when certain preconditions are met. 3

In the Cybersecurity Dive report, Rapid7 senior security researcher Stephen Fewer called the flaw worrying and urged customers to update urgently. He added that, as a memory corruption bug, it is less likely than CVE-2026-88771 to see broad successful exploitation across unpatched appliances. 4

The two reports may describe separate advisories issued close together, or differing accounts of the same disclosure. The available reporting does not settle that question. Either way, the response is the same: apply Citrix's latest updates.

Why NetScaler keeps drawing fire

NetScaler sits at the network edge, handling application delivery and remote VPN access for large enterprises. 2 That position makes it a high-value entry point. One flaw that is pre-authentication and exploitable in default configurations can open the door to a very large number of targets at once.

Fewer's caution is reasonable. Memory corruption flaws usually need more precise, version-specific work to turn into reliable code execution. That is a different risk profile from a log-poisoning command injection that runs as root.

Still, the timeline argues for urgency over comfort. The first two zero-days were exploited for weeks before anyone disclosed them, then spread widely within minutes of public exploit code. 12 If CSO Online's account is right, the newest flaw is already being used against appliances, even if only to knock them offline. 3

What defenders should do now

1. Treat this as an incident, not a patch cycle. Assume any NetScaler appliance exposed since early September may have been compromised.
2. Hunt for persistence. Look specifically for web shells such as WHIPSHOT. 2
3. Patch everything. Apply Citrix's fixes for both the original eight flaws and the newest memory overflow issue. 34
4. Plan for more. A third NetScaler warning in under two weeks makes further disclosures plausible.