Citrix NetScaler Zero-Days Actively Exploited, Threatening Critical Infrastructure
Two unpatched zero-day remote code execution vulnerabilities in Citrix NetScaler are reportedly being actively exploited in the wild, prompting urgent warnings from security researchers.
Security professionals are on high alert following reports of two undisclosed zero-day remote code execution (RCE) vulnerabilities actively being exploited in Citrix NetScaler appliances. The intelligence, initially flagged by threat intelligence firm watchTowr, indicates that these flaws are unpatched and have been identified during forensic investigations. While Citrix has yet to release official confirmation, technical details, or specific CVE identifiers, the company is expected to provide communications and fixes early next week.
The scarcity of verified information presents a significant challenge for defenders, who must make critical security decisions based on limited, albeit credible, intelligence. watchTowr described the situation as a serious warning, emphasizing that while exploitation is believed to be occurring, the full scope and technical details remain unconfirmed by the vendor. This ambiguity forces organizations to consider drastic measures, such as taking internet-exposed NetScaler appliances offline, which could disrupt essential services like VPN access, application delivery, and authentication.
It is crucial to distinguish these emerging reports from previously disclosed vulnerabilities. The current alert is not to be confused with Citrix's August 19 bulletin concerning CVE-2026-19490 and CVE-2026-19489. CVE-2026-19490, an authentication bypass flaw, and CVE-2026-19489, a memory overflow issue, have already seen active exploitation and were addressed by Citrix with specific patches. The new reports specifically point to two distinct RCE vulnerabilities that are separate from these earlier disclosures.
For the August vulnerabilities, Citrix recommended upgrading NetScaler ADC and Gateway versions 14.1 to 14.1-73.32 or later, and 13.1 to 13.1-63.21 or later. Specific fixed baselines were also provided for specialized editions. However, no workarounds were offered for these particular flaws, and the guidance applied to customer-managed appliances, not cloud services.
In the absence of immediate vendor clarification on the new zero-days, organizations are strongly advised to take proactive steps. This includes conducting a thorough inventory of all NetScaler instances, verifying their exact builds and internet exposure, and strictly limiting management access. Implementing compensating controls before public interfaces is also recommended. Security teams should preserve logs and forensic images, meticulously review authentication events, new sessions, configuration changes, and any unusual process activity or network connections.
For organizations unable to tolerate the potential risk associated with these unpatched vulnerabilities, the most prudent course of action may be to isolate or completely shut down exposed appliances. This decision should be made within an approved business-continuity framework to minimize operational impact. Continuous monitoring of Citrix's official security bulletin channels for patches and deployment guidance is essential, rather than relying solely on fragmented social media reports.
This incident underscores the persistent challenges in securing internet-facing remote access infrastructure. It highlights the critical need for rapid asset discovery, robust emergency patching capabilities, centralized logging, and well-rehearsed incident-response procedures, especially when security teams must act decisively even before complete technical disclosures are available.
This new report from The Hacker News details two previously unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and Gateway appliances, both allowing for remote code execution. Unlike previous disclosures, these flaws are reportedly being actively exploited in the wild, and Citrix has not yet released a fix, leading some administrators to take affected appliances offline as a precautionary measure.
This Tenable blog post provides a FAQ addressing the reported zero-day vulnerabilities in Citrix NetScaler, clarifying that these are distinct from previously disclosed CVEs like CVE-2026-19490 and CVE-2026-19489. While official confirmation and patches from Citrix are still pending, the article compiles information from early researcher reports and a pre-notification by the Dutch NCSC-NL, noting that the scale of exploitation remains undetermined.
Citrix has confirmed that two critical zero-day RCE vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway, are being actively exploited. The company has released emergency updates, with patches available for versions 14.1-73.37 and 13.1-64.23 and later. In addition to these two critical flaws, Citrix also addressed six other vulnerabilities, including CVE-2026-88773 (request smuggling) and several memory overflow issues.
CISA has officially added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active global exploitation by threat actors. The agency's alert emphasizes the complexity of patching NetScaler appliances, advising organizations to prioritize mitigation and assess exposure before applying updates. CISA also encourages checking for indicators of compromise prior to patching, as updates may impact forensic visibility.
CISA has officially added CVE-2026-88771 and CVE-2026-88772, both affecting Citrix NetScaler, to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion mandates federal agencies to prioritize remediation of these vulnerabilities on publicly exposed assets due to confirmed active exploitation, reinforcing the urgency highlighted by earlier security researcher warnings.
Citrix has now released security patches for the two zero-day vulnerabilities affecting its NetScaler ADC and NetScaler Gateway appliances, identified as CVE-2026-88771 and CVE-2026-88772. The company confirmed the existence of these flaws after administrators took affected systems offline, indicating a proactive response to the ongoing exploitation.
This new report from The Register highlights that the exploitation of Citrix NetScaler vulnerabilities is not a new phenomenon, but rather a recurring certainty. It details eight disclosed CVEs, including two critical remote code execution flaws (CVE-2026-88771, CVE-2026-88772) and a critical HTTP request smuggling flaw (CVE-2026-88773), all of which are already being actively exploited globally. The article also notes a concerning allegation that a Citrix partner was aware of these flaws a day before the official disclosure, underscoring the urgency for organizations to manage NetScaler updates despite their complexity.
Citrix has released patches for eight vulnerabilities affecting NetScaler ADC and Gateway, including two critical zero-days, CVE-2026-88771 and CVE-2026-88772, which are under active exploitation and allow for remote code execution. Additionally, CVE-2026-88773, a critical HTTP request smuggling flaw, has also been addressed. The vendor strongly urges customers to apply the updates immediately, as exploitation of the zero-days has been observed in the wild, prompting alerts from CISA, ACSC, and NCSC-NL.
CISA has officially added two critical Citrix NetScaler vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities (KEV) catalog. This designation mandates that federal agencies apply mitigations by September 30, 2026, under BOD 26-04, and conduct forensic triage due to active exploitation. The vulnerabilities allow unauthenticated remote attackers to execute arbitrary code or cause denial-of-service conditions on NetScaler ADC and Gateway appliances.
The article provides further technical details on the exploited vulnerabilities, CVE-2026-88771 and CVE-2026-88772, noting that CVE-2026-88771 allows for remote, unauthenticated arbitrary command execution due to improper input validation, while CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or DoS. It also highlights that these vulnerabilities affect customer-managed deployments of NetScaler ADC and Gateway, specifically versions prior to v14.1-73.37 and v13.1-64.23, and that attackers are deploying unique webshells on compromised devices, necessitating thorough forensic investigation beyond patching.
The UK's National Cyber Security Centre (NCSC) has issued an urgent advisory detailing eight vulnerabilities affecting Citrix NetScaler ADC and Gateway, with CVE-2026-88771 and CVE-2026-88772 confirmed as actively exploited. The advisory provides specific affected versions and recommends immediate mitigation steps, including isolation of affected systems and investigation for compromise, in addition to applying vendor updates.
Citrix has issued patches for multiple vulnerabilities in its NetScaler ADC and Gateway products, including CVE-2026-88771 and CVE-2026-88772, which are now confirmed to be under active exploitation by threat actors globally. CISA has urged federal agencies to apply these patches urgently, highlighting the critical nature of these flaws which could lead to arbitrary command execution and remote code execution or denial-of-service.
This updated report from Unit 42 provides specific technical details on the two zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems. It clarifies that CVE-2026-88771 is a remote code execution vulnerability due to improper input validation, while CVE-2026-88772 is a memory overflow leading to RCE or DoS in DTLS configurations. Both flaws carry a CVSS v4.0 base score of 9.5, and the report also offers interim guidance for customers, including steps to determine exposure, isolate systems, preserve evidence, and hunt for signs of compromise.
The UK's National Cyber Security Centre (NCSC) has now issued a strong advisory, urging organizations to patch eight vulnerabilities affecting customer-managed Citrix NetScaler ADC and Gateway appliances. This includes the two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which carry a CVSS score of 9.5 and allow unauthenticated command execution and remote code execution/DoS respectively. The advisory also details six additional vulnerabilities, including HTTP request smuggling and policy bypass flaws, and provides specific guidance on mitigation and evidence preservation for affected systems.
The new article confirms that the U.S., U.K., and Dutch agencies have issued advisories regarding these exploited zero-day vulnerabilities in Citrix NetScaler Gateway products. Citrix itself has acknowledged eight new vulnerabilities, with incident responders raising alarms over the weekend. This broad warning underscores the active exploitation and the urgent need for remediation.
CISA has officially added both Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies patch these flaws and investigate their networks for signs of compromise. This action underscores the severity and widespread threat posed by these zero-day exploits, particularly the one allowing unauthenticated command execution on factory-default appliances.
The article highlights significant criticism directed at Citrix for a prolonged communication delay regarding the active exploitation of CVE-2026-88771 and CVE-2026-88772. While unofficial warnings circulated over the weekend, Citrix remained publicly silent for nearly two days, leaving customers and security professionals without official guidance. This delay, compounded by the critical nature of the vulnerabilities and the availability of a proof-of-concept exploit, led to accusations of irresponsibility and raised questions about Citrix's incident response protocols, especially given its history with similar issues.
Mandiant's analysis provides critical technical details on the exploitation of CVE-2026-88772, including the mechanism of heap memory boundary corruption during the DTLS handshake and the specific log artifacts generated. The report also details the threat actor's post-exploitation toolkit, featuring custom PHP web shells like WHIPSHOT and a Python tunneler named SLAPSHOT, which are used for establishing persistence and facilitating lateral movement within compromised networks.
Exploitation of the NetScaler zero-day vulnerability, CVE-2026-88771, has escalated significantly following the public release of a root-cause analysis and proof-of-concept exploit. Researchers are observing widespread "spray and pray" attacks, moving beyond stealthy targeting, with threat actors attempting to gain admin access and deploy webshells. Analysis indicates that fewer than 10% of exposed NetScaler hosts have been patched, with over 100 victim organizations already identified, each employing unique webshells that are difficult to detect remotely.
Citrix has officially disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler Application Delivery Control (ADC) and Gateway products. These flaws, impacting default configurations, have been observed under active exploitation, with evidence suggesting attacks began at least a week prior to the official advisory. The company strongly urges customers to update their software immediately to mitigate the risks.
This new reporting details the specific custom malware, WHIPSHOT (a PHP web shell) and SLAPSHOT (a Python TCP tunneling tool), used by attackers to exploit the Citrix NetScaler Gateway vulnerabilities. It also provides further context on the timeline of exploitation, with activity observed since early September, and highlights the vendor's delayed disclosure of the flaws. The article emphasizes that patching alone may not be sufficient to remove threat actors from compromised environments.
This new report from CyberScoop details that attackers exploited two Citrix NetScaler zero-day vulnerabilities, CVE-2026-88772 and CVE-2026-88771, for at least three weeks before detection. Mandiant researchers attribute these attacks to advanced, suspected state-sponsored threat actors who utilized novel tools, including tunneler malware, to gain privileged access and exfiltrate data from dozens of compromised organizations across government, finance, and education sectors in North America and Europe.
Google's Mandiant and Threat Intelligence Group (GTIG) have published further details on the ongoing exploitation of NetScaler zero-days CVE-2026-88771 and CVE-2026-88772. Their investigation indicates that the campaign has been active since at least early September, predating the official patches released by Citrix. Mandiant identified previously unseen malware, including the WHIPSHOT PHP web shell and SLAPSHOT Python tunneling tool, used by attackers to gain root access, plant web shells, and facilitate internal reconnaissance, lateral movement, and credential theft.
Mandiant and Google Threat Intelligence Group (GTIG) have released new findings detailing the exploitation of CVE-2026-88772, a zero-day vulnerability in NetScaler devices. Their analysis indicates exploitation began as early as September 2026, bypassing authentication and achieving root-level access by corrupting heap memory within the NetScaler Packet Processing Engine. Attackers have been observed modifying configuration files to disguise web shells or using stealthier methods disguised as image requests, and employing a TCP tunneling tool to pivot into internal networks.
This new report from Google details the specific tactics, techniques, and procedures (TTPs) employed by attackers exploiting the two Citrix NetScaler zero-day vulnerabilities, CVE-2026-88772 and CVE-2026-88771. It highlights the deployment of custom web shells like WHIPSHOT and tunneling tools such as SLAPSHOT, which enable attackers to gain root access, bypass authentication, and establish internal network access. The article also provides detailed Indicators of Compromise (IOCs) and specific configuration checks for administrators to identify and mitigate the ongoing threat.
This new analysis details specific post-exploitation techniques observed after initial compromise via CVE-2026-88771. Threat actors are deploying web shells mapped to CSS-like URLs, creating superuser accounts for elevated privileges, and exfiltrating NetScaler configuration data. The observed payloads include Python and Perl scripts designed to establish reverse shells and modify system configurations to maintain persistence.
This new article confirms that the two critical RCE zero-day vulnerabilities in Citrix NetScaler, CVE-2026-88771 and CVE-2026-88772, are indeed being exploited globally. It also notes that Citrix has patched eight critical and high-severity vulnerabilities in addition to these zero-days.
This new report details CVE-2026-88779, a SAML zero-day vulnerability affecting NetScaler ADC and Gateway appliances configured as SAML service or identity providers. While the previous article focused on two unpatched RCE zero-days, this update specifies the SAML flaw as a memory overflow (CWE-119) with a CVSS score of 8.7, primarily causing denial of service. Citrix has confirmed targeted attacks exploiting this specific SAML vulnerability against unmitigated deployments, with low attack complexity and no user interaction required.
This new report specifies that the vulnerability, CVE-2026-88779, is a memory overflow flaw with a CVSS score of 8.7. It has been actively exploited in targeted attacks, with a particular impact on SAML authentication deployments, potentially causing service disruptions.