NetScaler Zero-Days: Citrix Patches Two Exploited RCE Flaws

What happened

Citrix confirmed that attackers exploited two critical remote code execution flaws in NetScaler ADC and NetScaler Gateway before any fix existed. The company published security bulletin CTX697096 on September 27, 2026, with patches for both bugs, tracked as CVE-2026-88771 and CVE-2026-88772.2 The same bulletin fixed six more NetScaler flaws, for a total of eight CVEs numbered CVE-2026-88771 through CVE-2026-88778.34

The wording of the advisory was short. Citrix said exploits of the two flaws had been observed against unmitigated NetScaler deployments. It did not say how widespread the attacks were, who was behind them, or when they began.1 Because the bulletin was Citrix's first public notice of the bugs, attackers had them before defenders had a fix. The advisory also listed no workaround for either flaw.1

Weeks later, this looks less like a single patch event and more like a campaign that kept growing. A third exploited flaw followed within a week. Analysts also say the exploitation started well before Citrix said anything publicly.

The two flaws

CVE-2026-88771 is the worse of the two. It is an improper input validation bug that lets an unauthenticated attacker run arbitrary commands. It affects every NetScaler ADC and Gateway deployment on a vulnerable build, including those in default configuration, and needs no extra feature turned on.2 Exploitation also requires no user interaction.3

CVE-2026-88772 is a memory overflow that can lead to code execution or denial of service on appliances with DTLS enabled.2 That condition does little to narrow the exposure, because DTLS is on by default for VPN virtual servers. In practice, a NetScaler Gateway is vulnerable unless an administrator has explicitly turned DTLS off.17 Both flaws carry a CVSS 4.0 score of 9.5.4

The fixed builds are 14.1-73.37 and 13.1-64.23. There are separate FIPS and NDcPP builds for regulated deployments.14 One detail in the coverage matters for teams that thought they were current. Appliances on builds 14.1-73.32 and 13.1-63.21, which were the August fixes for an earlier exploited authentication bypass, CVE-2026-19490, still fall in the vulnerable range and need this update too.14

Among the other six flaws, the most serious is CVE-2026-88773, an HTTP request smuggling bug rated 9.3. CVE-2026-88778, a predictable TCP sequence number issue, is not fixed by upgrading alone. Administrators also have to enable Enhanced ISN Generation.49

The disclosure timeline

The most consistent theme in the reporting is that word of these flaws spread through informal channels before Citrix spoke. According to one detailed timeline, the Dutch NCSC-NL privately warned organizations in the Netherlands, including central government, on the afternoon of Friday, September 25. The warning followed a tip from a European partner CERT.8 Copies of that notice circulated online. It reportedly described two flaws that could each lead to remote code execution, one of which allowed shellcode to be placed directly in memory. It also said Citrix had found the bugs while investigating incidents in customer environments.2

Security firm watchTowr then went public on September 26. It said it was responding to credible rumors of several unpatched NetScaler RCE vulnerabilities, and later said two flaws had been found during forensic investigations.1 Some outlets were cautious at that stage. One noted that watchTowr had not published exploitation paths, payloads or forensic artifacts, so the claims were hard to verify independently.6 Another stressed that no CVE, CVSS score or advisory yet existed.10 In the meantime, administrators were taking appliances offline.1 One tracker reports that governments and companies across Europe disconnected NetScalers while waiting for a patch.8

Citrix's bulletin arrived the next day.2 It did not formally tie its CVEs to watchTowr's findings, but the details matched.1 Our reading is that the private-warning system worked, but unevenly. Organizations in the Netherlands and others connected to European CERTs reportedly had about two days' notice. Everyone else learned from social media posts and news coverage.

Weeks of exploitation before the patch

The biggest gap in the reporting is how long the flaws were exploited before disclosure. Citrix gave no start date.1 Threat intelligence firms have filled in much of that gap. A compiled timeline cites eSentire seeing CVE-2026-88771 exploited from September 5, more than three weeks before disclosure. Unit 42 traced version fingerprinting back to August 21 and requests for .deb webshells from September 4. Google GTIG and Mandiant report CVE-2026-88772 exploitation since at least early September.8 CrowdSec's exploit tracker logged matching requests from September 22.15

Help Net Security summarized the situation as exploitation "globally for weeks" and said the attackers were planting webshells on compromised devices.3 Other reporting adds tunneling tools to the list of post-exploitation payloads.11

Breach and ransomware risk

The most important practical point is that patching a NetScaler does not remove an attacker who is already on it. These appliances handle VPN access, load balancing and user authentication at the network edge.1 That puts credentials, session data and an entry point into internal networks on the same box. One threat-research write-up sketches a likely attack path: credential and certificate theft on the appliance, lateral movement using compromised VPN access, and data exfiltration. That analysis describes a plausible chain, not confirmed incidents.7

Regulators have treated compromise as a breach-level event. Luxembourg's financial regulator, the CSSF, told supervised firms that unauthenticated code execution counts as unauthorized access and therefore a major ICT incident that must be reported under DORA.8 CISA added both flaws to its Known Exploited Vulnerabilities catalog. It gave federal civilian agencies until September 30 to remediate and required forensic triage to look for signs of compromise.3 CISA's emphasis on forensics as well as patching tells defenders where the risk lies.

On ransomware, the evidence does not support a link yet. CISA's catalog entries list ransomware use as "Unknown."8 The early assessments point to espionage more than extortion. Mandiant's CTO has said advanced and likely state-sponsored actors were probably behind the first targeted CVE-2026-88772 intrusions, and researcher Kevin Beaumont has called the attackers probably nation-state aligned. Neither has made a formal attribution.15 That can change. NetScaler flaws have often moved from a small number of targeted attackers to mass exploitation, and one outlet has described "CitrixBleed" as now being a whole category of NetScaler vulnerability rather than a single incident.10

A third zero-day and a second round of patches

The situation got worse within a week. Citrix patched CVE-2026-88779, a memory overflow in NetScaler deployments that use SAML authentication with Gateway or AAA functionality. It was exploited in targeted zero-day attacks.11 Citrix rated it 8.7 and called it a denial-of-service flaw. The fixed builds are 14.1-73.41 and 13.1-64.28. Citrix told customers who had already installed the September fixes to upgrade again if their SAML setup meets the preconditions.12 CISA added the flaw to its catalog on October 4 with an October 7 deadline. SecurityWeek counted it as the sixth exploited NetScaler flaw CISA had listed in 2026.

Outlets differed on whether this third bug can do more than crash appliances. Some administrators and researchers reported activity suggesting it could allow code execution.12 watchTowr later told SecurityWeek it had reproduced the flaw and found it could only crash systems. watchTowr also suggested a more troubling use: attackers may be crashing appliances on purpose to speed up exploitation of CVE-2026-88771.13 The watchTowr account is the most specific one available, so we take it as the best current reading. On that reading, CVE-2026-88779 is dangerous because it helps the main remote code execution exploit, even though it cannot take over a device by itself.

The list kept growing after that. By mid-October, trackers were also following CVE-2026-107406, a critical SAML code execution flaw. Citrix says it knows of no exploitation of that bug, and it is not in CISA's catalog.15 Researchers have also reported a Sliver command-and-control implant compiled for FreeBSD, the operating system NetScaler runs on, and delivered through a domain tied to the SAML-related activity. No vendor or CERT has published its own analysis of that implant.15

What defenders should take from it

The reporting points to a few clear steps. Upgrading to the September builds is not enough for SAML-enabled appliances, which need the October builds.1218 Any NetScaler that was exposed to the internet during September should be investigated as possibly compromised. CISA has published a SIGMA detection rule for exploitation and post-exploitation activity.15 watchTowr has released indicators of compromise drawn from thousands of exploitation attempts against its honeypot appliances.15

The broader lesson concerns Citrix's own communications. The company's first advisory gave no indicators of compromise, no workaround and no exploitation timeline.1 It also declined to tell reporters how many instances were affected by the follow-on bug.13 For devices that sit at the edge of so many networks, that left customers to piece together the threat picture from CERT notices, vendor blogs and posts on X. Citrix has fixed the code. What remains open is how many organizations were compromised in the weeks before disclosure and have not yet found out.