Citrix has disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them, CVE-2026-88771 and CVE-2026-88772, are being exploited as zero-days and can each lead to remote code execution. If you run NetScaler in front of VPN or SSO traffic, check for compromise first, then patch.
What happened
CISA published an alert on September 27, 2026 covering eight CVEs (CVE-2026-88771 through CVE-2026-88778) in Citrix NetScaler ADC and Gateway. It added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities catalog and said threat actors are exploiting them globally. CISA updated the alert on October 2 to point to a SIGMA detection rule in its GitHub repository.
Rapid7's analysis gives the technical detail:
- CVE-2026-88771 (CVSS 9.5, CWE-20): improper input validation that allows remote code execution in the default configuration, with low attack complexity. Rapid7 dates the earliest exploitation attempts to September 20, 2026, a week before disclosure.
- CVE-2026-88772 (CVSS 9.5, CWE-119): a memory overflow leading to remote code execution. Rapid7 says exploitation has been confirmed. It requires the DTLS feature to be enabled and has high attack complexity.
- Six more CVEs: HTTP request smuggling (CVE-2026-88773, 9.3, no special configuration), a policy bypass via URL expressions (CVE-2026-88774, 7.0), memory overflows tied to Gateway/AAA (CVE-2026-88775), the Oracle load-balancing type (CVE-2026-88776) and LB/CS or CGNAT-LSN/NAT64 configurations (CVE-2026-88777), and predictable TCP sequence numbers (CVE-2026-88778). The last four are each rated 8.8.
According to Rapid7, the fixed releases are 14.1-73.37 and later and 13.1-64.23 and later. For FIPS builds they are 14.1-73.37 FIPS and later, and for 13.1-FIPS and 13.1-NDcPP they are 13.1.37.279 and later. Rapid7 also reports two organizations compromised through CVE-2026-88771. In one case the attackers used command injection to pull configuration files. In the other they deployed a webshell under /var/netscaler/logon/LogonPoint/custom/. Citrix's bulletin is CTX697096.
Why it matters
NetScaler Gateway is the front door for remote access and, in many environments, the place where SSO and AAA policy is enforced. An attacker with unauthenticated code execution on that box is sitting on the authentication path. From there they can see what passes through, and the stolen configuration files can expose secrets used to talk to back-end identity systems. Patching closes the hole. It does nothing about credentials or sessions that were already taken.
That is why CISA's order of operations matters. It tells organizations to check for indicators of compromise using NetScaler Console before patching and to preserve forensic evidence first, because applying the update may remove forensic visibility. Citrix's guidance for suspected compromise (CTX694799) covers what to do next, including rotating stored secrets, user passwords, certificates and keys. This follows the same pattern as earlier NetScaler incidents and other edge-appliance zero-days. The perimeter device in front of identity keeps being the way in.
What to check in your environment
- Inventory every customer-managed NetScaler ADC and Gateway appliance, including FIPS and NDcPP builds, and record the running version against the fixed releases listed above.
- Before upgrading, run the compromise checks CISA references in NetScaler Console and capture forensic images or logs, since the update may erase evidence.
- Look for unexpected files under
/var/netscaler/logon/LogonPoint/custom/, where Rapid7 found a webshell. Also look for signs that configuration files were read or exported. - Find out whether DTLS is enabled on your Gateway virtual servers. It is a precondition for CVE-2026-88772. Note any Gateway/AAA, Oracle LB, LB/CS or CGNAT-LSN/NAT64 configurations affected by the other memory overflow CVEs.
- Add CISA's SIGMA rule to your SIEM and hunt back to at least September 20, the earliest exploitation date Rapid7 observed.
- If you find signs of compromise, follow Citrix CTX694799. Treat credentials and secrets held in the appliance configuration as exposed, and plan the credential, certificate and key rotation it covers.
- Patch outside your normal change window, and tell your IAM and remote-access owners so that credential rotation is coordinated.