Citrix NetScaler Zero-Days Exploited in the Wild; Updates Available

Summary

Rapid7 reports active exploitation of three Citrix NetScaler vulnerabilities, including two critical RCE flaws, and identifies two organizations compromised. Citrix updates are available, and Rapid7 urges emergency patching and investigation.

Key points

CVE-2026-88771 and CVE-2026-88772 were confirmed as zero-days; both have a critical CVSSv4 score of 9.5. The first affects default configurations, while the second requires DTLS.
CVE-2026-88779, disclosed October 4, is also exploited in the wild. It affects appliances configured with a SAML service provider or identity provider and can cause service crashes and a reboot.
CISA added all three exploited vulnerabilities to its Known Exploited Vulnerabilities catalog.
Rapid7 observed exploitation attempts for CVE-2026-88771 as early as September 20 and identified two organizations compromised, including one where attackers placed a webshell.
One observed command-injection payload could create a publicly accessible archive of NetScaler configuration files, including certificates, private keys, and account or service credentials.
Citrix updates are available for affected NetScaler versions. Rapid7 recommends emergency patching and checking vulnerable appliances for signs of compromise.

Article Details

Vulnerability Types: Improper input validation leading to remote code execution
Memory overflow leading to remote code execution
HTTP request smuggling
Policy bypass involving URL expressions
Predictable TCP initial sequence numbers
Memory corruption
Memory overflow in SAML processing
Severity: Critical (CVSSv4 9.5) for CVE-2026-88771 and CVE-2026-88772; High to Critical (CVSSv4 7.0–9.3) for the other listed vulnerabilities.
Affected Versions: NetScaler ADC and NetScaler Gateway versions before 14.1-73.37 and 13.1-64.23; FIPS and NDcPP variants are also affected as described in the vendor update guidance.
CVE-2026-88779: NetScaler ADC and NetScaler Gateway versions before 14.1-73.41 and 13.1-64.28; FIPS and NDcPP variants are also affected as described in the vendor update guidance.
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available

Indicators of compromise

Type	Indicator	Context
IPV4	`149[.]104[.]78[.]208`	Source IP of an observed command-injection exploitation attempt against a NetScaler appliance.
SHA256	`ed082f744f035035900f67edf438f2f7d0528ac501234f63d476d65273cdb9a1`	SHA-256 hash of a webshell found on a compromised NetScaler appliance.