Citrix NetScaler RCE Zero-Days Exploited — Patch Now

Two actively exploited RCE zero-days in Citrix NetScaler ADC and NetScaler Gateway were patched on September 27, 2026 — after attackers had been planting webshells on unpatched appliances for weeks. CVE-2026-88771 is unauthenticated, requires no special configuration, and grants full shell access to your gateway. CVE-2026-88772 hits VPN virtual servers where DTLS is on by default. CISA added both to the Known Exploited Vulnerabilities catalog the same day Citrix shipped the fix. If you run NetScaler in your stack, the only acceptable response right now is to patch.

What These Two CVEs Actually Do

CVE-2026-88771 (CVSS v4.0: 9.5) is an improper input validation flaw. It requires no authentication, no user interaction, and no non-default configuration to trigger. Every NetScaler ADC and NetScaler Gateway running an affected build is exposed. The Dutch National Cyber Security Centre put it plainly: “This vulnerability gives attackers full control of the gateway, providing direct access to the internal corporate network behind it.” There is no configuration workaround — patching is the only fix.

CVE-2026-88772 (CVSS v4.0: 9.5) is a memory overflow that can produce remote code execution or a denial-of-service condition. It requires DTLS to be enabled, which it is by default on VPN virtual servers. If your NetScaler Gateway config does not explicitly contain -dtls OFF on every VPN virtual server, you are exposed. Disabling DTLS is a temporary mitigation for this specific CVE, but it does nothing for CVE-2026-88771 — so disabling DTLS without patching leaves you only halfway defended.

Assume Compromise If You Have Not Patched Yet

Citrix released the fix on September 27. Exploitation started weeks earlier. That gap matters. If your appliance ran a vulnerable build during September, treat it as potentially compromised, not just vulnerable.

Post-exploitation activity has included webshell deployment, credential harvesting, and lateral movement. Attackers also ran anti-forensic commands to delete artifacts, which means your logs may not tell the full story. Citrix’s own detection tool, available through NetScaler Console 14.1-73.36 and later, acknowledges it “might fail to identify actual compromises.” That is a significant admission.

If you need to check logs manually, look for:

• Base64 strings immediately following a User-Agent field with no space separator
• Log lines containing pitboss followed by IFS
• Patterns matching pitboss*b64decode

If you cannot rule out exploitation, bring in forensic investigators. The detection limitations here are real, and Citrix has said so explicitly.

Patch Steps: Do This Now

Check your current build from the NetScaler CLI:

show ns version -installedversion

The fixed builds are:

• NetScaler ADC / Gateway 14.1: 14.1-73.37 or later
• NetScaler ADC / Gateway 13.1: 13.1-64.23 or later
• NetScaler ADC FIPS 13.1: 13.1-37.279 or later

Download the fixed build from the Citrix ADC downloads page, run ./installns, and restart. For HA pairs, upgrade the passive node first, fail over, then upgrade the formerly active node. Full procedure is in the NetScaler upgrade documentation.

The Deadline and the Pattern

CISA’s Binding Operational Directive 26-04 puts federal civilian agencies on a three-day clock for KEV-listed vulnerabilities with active exploitation. These two CVEs qualified the moment they hit the catalog. The deadline for federal agencies is September 30. Private-sector organizations have no legal obligation to that date, but active exploitation of a CVSS 9.5 zero-day is not a situation that benefits from waiting for the next maintenance window.

This is not a one-off. CitrixBleed (CVE-2023-4966) was exploited by LockBit affiliates in broad ransomware campaigns. CVE-2023-3519 dropped webshells on critical infrastructure as a zero-day. CVE-2026-8451 hit earlier this year. NetScaler keeps landing on this list because it is one of the most widely deployed internet-facing edge devices in enterprise environments — and the reward for exploiting it is a direct line into a corporate network, usually before any endpoint detection fires. The industry should be demanding better from edge-device vendors at this point.

Three Actions to Take Today

1. Check your build. Run show ns version -installedversion on every NetScaler appliance in your environment.
2. Patch before September 30. Target 14.1-73.37 or 13.1-64.23 depending on your release line. Reference Citrix bulletin CTX697096 for the full affected version list and FIPS builds.
3. Review for compromise. If any appliance ran a vulnerable build during September, check logs for the indicators above and consider forensic review — especially for appliances with external access. The CISA advisory is the authoritative reference.