Citrix Patches Two Actively Exploited NetScaler Zero-Days

Summary

Citrix disclosed and patched two critical NetScaler ADC and Gateway zero-days after exploitation was reported. Researchers said attacks may have started in early September; exposed systems should be updated or disabled if they cannot be patched.

Key points

CVE-2026-88771 is a remote code execution flaw; CVE-2026-88772 is a memory overflow that can enable RCE and DDoS. Both have CVSS scores of 9.5.
The flaws affect default configurations of Citrix NetScaler ADC and Gateway, and Citrix confirmed exploitation on unmitigated deployments.
Citrix disclosed the vulnerabilities on Sept. 27 and released software updates, urging customers to upgrade promptly.
Google Threat Intelligence Group reported the campaign had been ongoing since at least early September; GreyNoise said it first detected exploitation on Sept. 24.
Palo Alto Networks scans found more than 50,000 NetScaler instances exposed to the Internet.
Organizations unable to install fixed versions were advised to consider disabling affected appliances. The article does not establish the scope or impact of attacks on specific victims.

Article Details

Vulnerability Types: Remote code execution (RCE) due to improper input validation
Memory overflow that can lead to RCE and distributed denial-of-service (DDoS) attacks
Severity: Both vulnerabilities are critical and have a CVSS score of 9.5.
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available
Workarounds: Disable NetScaler appliances if unable to update to fixed versions.