cyber.hendryadrian.com
Vulnerability & Exploit · fieldeffect.com

Citrix NetScaler Flaws Exploited Before Patches Were Available

· Original article ↗

Summary

Citrix disclosed eight NetScaler flaws, including two remotely exploitable vulnerabilities used before patches were available. CISA added both to its KEV catalogue; organizations should patch and assess exposed appliances for compromise.

Key points

  • Two NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, were reportedly exploited before Citrix released patches and were added to CISA’s KEV catalogue.
  • CVE-2026-88771 allows remote unauthenticated command execution and affects vulnerable NetScaler ADC and Gateway deployments, including default configurations.
  • CVE-2026-88772 is a DTLS memory-overflow flaw that could enable remote code execution or denial of service; exposure depends on DTLS being enabled.
  • Citrix released fixed versions, indicators of compromise, and compromise-assessment guidance. IOC scan results alone cannot confirm or rule out compromise.
  • Organizations should patch affected appliances and review logs, administrative activity, and authentication records for signs of access during the pre-patch exposure period.
  • The article recommends centralizing NetScaler logs, enabling available file-integrity monitoring, and assessing systems and credentials reachable through potentially compromised appliances.

Article Details

Vulnerability Types
  • Improper input validation
  • Memory overflow
Severity
Both actively exploited vulnerabilities have a CVSS v4 score of 9.5.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-88771The two actively exploited vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, each received a CVSS v4 score of 9.5.CVE-2026-88772The two actively exploited vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, each received a CVSS v4 score of 9.5.

Vendors

CitrixCitrix disclosed eight NetScaler vulnerabilities on September 27, 2026, including two actively exploited flaws that were added to the CISA KEV catalogue.

Products

NetScaler ADCNetScaler ADC and NetScaler Gateway are attractive targets because they sit at the network edge and often provide access to VPN, authentication, and business-critical applications.NetScaler ConsoleOrganizations using NetScaler Console can run IOC scans directly from the Security Advisory workflow.NetScaler GatewayNetScaler ADC and NetScaler Gateway are attractive targets because they sit at the network edge and often provide access to VPN, authentication, and business-critical applications.

Related Articles