Two vital vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that enable distant code execution have been exploited within the wild, Citrix confirmed on September 27. It launched fixes for each, together with six different flaws. One of many two impacts each deployment on an affected model, together with these within the default configuration.
The bulletin got here a day after safety agency watchTowr mentioned two unpatched NetScaler RCE flaws had been exploited, and after some directors mentioned they’d taken home equipment offline. Citrix didn’t say whether or not its two flaws are those watchTowr described, however they match that account.
NetScaler ADC and NetScaler Gateway sit on the fringe of enterprise networks, the place they deal with VPN and distant entry, load balancing, and consumer authentication.
Citrix mentioned in its bulletin that the 2 exploited flaws are:
- CVE-2026-88771 (CVSS v4 rating: 9.5) – An improper enter validation flaw that lets an unauthenticated attacker run arbitrary instructions. It impacts all NetScaler ADC and NetScaler Gateway deployments, with no additional function required.
- CVE-2026-88772 (CVSS v4 rating: 9.5) – A reminiscence overflow that may result in distant code execution or denial-of-service (DoS). It impacts home equipment with DTLS enabled. DTLS is on by default for VPN digital servers, so a NetScaler Gateway is affected except DTLS has been explicitly turned off.
“Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been noticed,” the corporate mentioned. It didn’t say how extensively the failings have been exploited, by whom, or since when.
The bulletin is Citrix’s first public discover of the failings, so each had been attacked earlier than a repair was public. It lists no workaround for both and no indicators of compromise.
Home equipment on 14.1-73.32 and 13.1-63.21, the builds that fastened the exploited authentication bypass CVE-2026-19490 in August, fall contained in the affected vary and wish the brand new replace.
The fixes are within the following variations, which Citrix urged affected prospects to put in as quickly as doable:
- NetScaler ADC and NetScaler Gateway 14.1-73.37 and later releases
- NetScaler ADC and NetScaler Gateway 13.1-64.23 and later releases of 13.1
- NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later releases of 14.1-FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.279 and later releases of 13.1-FIPS and 13.1-NDcPP
The bulletin covers customer-managed home equipment, together with NetScaler cases utilized in Safe Personal Entry Hybrid deployments. Citrix upgrades its personal cloud providers and Citrix-managed Adaptive Authentication.
The 13.1 repair arrives after that department reached Finish of Upkeep on September 15 beneath Citrix’s launch schedule.
The six different flaws, which the bulletin doesn’t checklist as exploited, are:
- CVE-2026-88773 (CVSS v4 rating: 9.3) – An HTTP request smuggling flaw, on home equipment with load balancing, content material switching, VPN, or authentication digital servers of kind HTTP or SSL.
- CVE-2026-88774 (CVSS v4 rating: 7.0) – A coverage bypass, on home equipment the place any coverage makes use of an HTTP URL-based expression.
- CVE-2026-88775 (CVSS v4 rating: 8.8) – A reminiscence overflow that may trigger unpredictable conduct or DoS, on home equipment configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an authentication, authorization, and auditing (AAA) digital server.
- CVE-2026-88776 (CVSS v4 rating: 8.8) – A reminiscence overflow that may trigger unpredictable conduct or DoS, on load balancing digital servers of kind Oracle.
- CVE-2026-88777 (CVSS v4 rating: 8.8) – A reminiscence overflow that may trigger unpredictable conduct or DoS, on load balancing, content material switching, or CGNAT-LSN/NAT64 setups with a non-HTTP Layer 7 protocol function, equivalent to FTP, RTSP, or DNS64, enabled.
- CVE-2026-88778 (CVSS v4 rating: 8.8) – A TCP Preliminary Sequence Quantity (ISN) prediction flaw, on home equipment with TCP-based digital servers, equivalent to HTTP, SSL, or TCP, the place Enhanced ISN Technology is disabled. Citrix advises affected home equipment to use a TCP configuration change that turns it on.
watchTowr’s first put up on X on September 26 mentioned it was reacting to rumors of a number of unpatched NetScaler RCE vulnerabilities within the wild. “Whereas particulars are scarce, the data is credible,” it wrote. A follow-up put up at 22:19 UTC mentioned the 2 flaws had been found throughout forensic investigations and that Citrix communications and patches had been anticipated early within the week of September 28.
On September 26, an administrator posting on r/Citrix wrote that their IT provider’s safety workforce had phoned to advise shutting their NetScalers down instantly, with out giving particulars. Others within the thread mentioned their organizations had accomplished the identical. The place the suppliers’ warning got here from has not been established.
As a result of the failings had been exploited earlier than a repair was public, putting in the replace is not going to present whether or not an attacker bought in first.
In 2025, after a NetScaler flaw was exploited as a zero-day towards Dutch organizations, the Netherlands’ Nationwide Cyber Safety Centre mentioned that updating alone didn’t take away the danger, as a result of an attacker might maintain entry gained earlier than the patch, and advised directors to run its test scripts.
Citrix’s present steering for a suspected NetScaler compromise says to:
- Protect proof first: a snapshot of a VPX occasion, the logs held on distant syslog servers and NetScaler Console, a technical help bundle, and a core dump of the packet engine.
- Isolate the equipment from the community.
- Change each service account password and secret saved on it, reset the passwords of customers who signed in by means of it, and revoke its certificates and personal keys.
- Maintain the administration interface off the web. “The NetScaler Administration Companies ought to by no means be uncovered to the general public web,” the steering says.
The Dutch company’s 2025 test scripts, which cowl a dwell equipment, core dumps, and full NetScaler pictures, are an additional possibility, with limits.
The README for the live-appliance script says it appears to be like for recordsdata that point out compromise, will not be particular to 1 vulnerability, and comes with no assure of effectiveness. The code was final up to date in September 2025.
The Hacker Information has requested Cloud Software program Group, the corporate that owns Citrix and NetScaler, and watchTowr for remark, and can replace the story if it hears again.
