Citrix NetScaler Zero-Days: Four Critical Flaws in Six Weeks

A bruising autumn for Citrix's edge appliances

Citrix, now part of Cloud Software Group, has spent the past several weeks responding to a series of security problems in NetScaler ADC and NetScaler Gateway. These products were formerly sold as Citrix ADC and Citrix Gateway. They handle application delivery and VPN access for many enterprises, and they sit directly between the public internet and corporate networks 21012.

The trouble started on September 27, 2026, when Citrix published security bulletin CTX697096. The bulletin confirmed that two flaws, CVE-2026-88771 and CVE-2026-88772, had been exploited against customer deployments before patches existed 312. The same day, CISA added both to its Known Exploited Vulnerabilities (KEV) catalog. The agency said partner threat intelligence showed attackers exploiting them globally 46. Both carry a CVSS score of 9.5 712.

How the September zero-days work

The two flaws differ in scope:

• CVE-2026-88771 is an unauthenticated remote code execution bug caused by improper input validation. It affects all deployments, including default configurations 39.
• CVE-2026-88772 is a memory overflow. It can lead to code execution or denial of service, but only on appliances with Datagram Transport Layer Security (DTLS) enabled 39.

Palo Alto Networks' Unit 42 said attackers used the bugs to plant web shells, which gave them initial access and persistence. One observed chain sent crafted DTLS traffic to a vulnerable device to drop a web shell 9.

The accounts differ on how many vulnerabilities the bulletin covered. Coverage of CTX697096 and one CISA alert cites eight new vulnerabilities 512. A later CISA version lists ten, running from CVE-2026-88771 through CVE-2026-88779 plus CVE-2026-107406 4. The likeliest explanation is that CISA updated its alert as Citrix disclosed more flaws.

From quiet espionage to mass exploitation

The situation changed sharply on September 29. Reporting from Tech Times describes what had been a covert, weeks-long espionage campaign turning into an internet-wide attack wave within minutes of a public proof-of-concept exploit appearing 12. The outlet put the number of compromised organizations at more than 100. It also warned that patching does not remove the WHIPSHOT web shells already planted on breached devices 12.

SecurityWeek reported that some customers took appliances offline entirely rather than wait 11. In practice, any organization that was exposed before September 27 should treat a patch as only the first step. It also needs to check for signs of compromise, and CISA's guidance points administrators to Citrix's instructions for exactly that 4.

The SAML flaw that hit patched boxes

A third exploited flaw followed in early October. Tenable dates the disclosure of CVE-2026-88779 to October 3, while another report puts the emergency patches on October 4 23. It is a memory overflow rated 8.7. It affects NetScaler instances configured as a SAML service provider or identity provider, and fixing it requires newer builds 31011.

What made this flaw especially damaging is that it hit appliances customers had only just updated. SecurityWeek noted that Reddit users first reported devices already patched against the September zero-days that kept rebooting 11. Citrix acknowledged targeted attacks causing denial of service and credited Bishop Fox and watchTowr with reporting the issue. watchTowr said it reproduced the flaw within hours of seeing honeypot activity 10.

Citrix describes CVE-2026-88779 as a denial-of-service bug. SecurityWeek, however, cites indications it could also enable remote code execution 11. That question remains open and is worth watching.

The disclosures had not finished. CybelAngel reports a separate urgent advisory for CVE-2026-107406. That brings the number of critical NetScaler advisories to four in roughly six weeks 1.

Why it matters

Citrix is not the only vendor in this position. Days after the SAML patches, Ivanti disclosed a three-flaw Connect Secure chain that gives attackers root access 2. Both companies have been repeat targets since 2023. In both cases, detailed guidance was thin and exploitation began before most customers could respond 2.

The target list is also growing. CISA's KEV catalog now includes AI infrastructure such as Langflow and LiteLLM next to the NetScaler entries. Ransomware crews have been pulling model-provider API keys from these tools 8. Attackers appear to be treating AI gateways the same way they treat VPN appliances: as places to collect credentials.

Assessment

The pattern of exploits arriving before fixes, one patch followed by another, and backdoors that survive updates suggests NetScaler's attack surface is still being mapped, by attackers as much as by defenders. Updating on schedule is no longer enough for these appliances. Organizations running them should assume compromise, look for persistence, and plan for further disclosures.