Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Mandiant links weeks-long NetScaler ADC/Gateway zero-day exploitation to suspected state actors, hitting 100+ government, finance, and legal organizations.
95
CVE-2026-88771
Unauthenticated RCE in Citrix NetScaler ADC and Gateway
CISA: Citrix NetScaler Improper Input Validation Vulnerability
- CVSS 4.0
- 9.5 critical
- EPSS
- 82%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-88771 is an improper input validation flaw (CWE-20) in Citrix NetScaler ADC and NetScaler Gateway that allows an unauthenticated remote attacker to execute arbitrary commands. It is reachable over the network with low complexity, though the CVSS vector notes a precondition, and successful exploitation has high impact on confidentiality, integrity, and availability of the appliance and of systems beyond it. Affected ADC builds are those before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; affected Gateway builds are those before 14.1-73.37 and before 13.1-64.23. Related reporting says Citrix confirmed NetScaler RCE flaws were exploited as zero-days. No public proof-of-concept is known, and the CVE is not listed in CISA KEV.
What to do: Upgrade NetScaler ADC and NetScaler Gateway to 14.1-73.37 or 13.1-64.23 or later, and move FIPS and NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP or later. Because active exploitation is reported, treat unpatched internet-facing appliances as potentially compromised: review logs for unexpected commands or configuration changes, rotate credentials and session material, and restrict Gateway and management exposure until patched.
| Product | Affected |
|---|---|
| Citrix NetScaler ADC | before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP |
| Citrix NetScaler Gateway | before 14.1-73.37 and before 13.1-64.23 |
Estimated exposure
largeon the order of tens of thousands of internet-exposed appliances — Historical public internet scans of Citrix NetScaler ADC and Gateway have typically shown on the order of low tens of thousands of exposed appliances; this is an estimate for the product family, not a census of hosts vulnerable to this…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
KEVCISA Known Exploited Vulnerability
- Affected
- Citrix NetScaler
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- citrix
- Products
- netscaler application delivery controller, netscaler gateway
- Weakness
- CWE-20
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
20 storiesAttackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Suspected state-sponsored actors mass-exploited Citrix NetScaler zero-day CVE-2026-88772 undetected for over three weeks, hitting dozens of organizations.
95
Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
Unknown attackers exploited critical Citrix NetScaler zero-days CVE-2026-88771/88772 since early September, deploying custom WHIPSHOT and SLAPSHOT malware for persistence and tunneling.
95
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
Attackers are exploiting critical Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 for unauthenticated remote code execution.
95
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
Citrix patched two actively exploited NetScaler zero-days (CVE-2026-88771/88772, CVSS 9.5); CISA added both to KEV amid global attacks.
94
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
CISA says attackers are globally exploiting critical Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772.
94
Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
Citrix confirms two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are actively exploited for remote code execution.
94
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Citrix NetScaler zero-day CVE-2026-88779 is exploited in the wild against patched appliances, causing DoS with possible RCE; CISA added it to KEV.
93
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
LevelBlue details post-exploitation of actively exploited Citrix NetScaler flaw CVE-2026-88771: superuser account creation, PHP web shells, and configuration theft.
93
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Attackers exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunnel into networks.
93
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Citrix NetScaler zero-day CVE-2026-88771 is under mass exploitation after a public proof of concept.
93
US, UK warn of exploited Citrix NetScaler zero-day bugs
Agencies warn exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 require immediate patching and forensic triage.
93
Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)
Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after weeks of global exploitation planting webshells.
93
Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.
Suspected state hackers exploited two Citrix NetScaler zero-days; about 50,000 devices may remain exposed.
92
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
Actively exploited Citrix NetScaler zero-days CVE-2026-88772/88771 give attackers root access; Mandiant uncovers WHIPSHOT web shells and SLAPSHOT tunneler in ongoing campaign.
92
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Citrix reports NetScaler ADC and Gateway zero-days CVE-2026-88771/88772 (CVSS 9.5) exploited in the wild, with over 50,000 exposed instances.
92
NetScaler admins told to patch critical zero-days in ADC and Gateway now
Citrix and CISA warn NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 are under active attack.
92
Citrix Patches Critical Zero Days Under Active Exploitation
Citrix patched two actively exploited critical NetScaler zero-days enabling unauthenticated remote code execution.
92
CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA ordered federal agencies to patch two exploited critical Citrix NetScaler RCE flaws by September 30.
92
Citrix Confirms NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attack
Citrix confirms attackers are exploiting two critical unauthenticated NetScaler RCE zero-days, CVE-2026-88771 and CVE-2026-88772.
92