Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks
Mandiant links weeks-long NetScaler ADC/Gateway zero-day exploitation to suspected state actors, hitting 100+ government, finance, and legal organizations.
95
CVE-2026-88772
Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gateway
CISA: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- CVSS 4.0
- 9.5 critical
- EPSS
- 77%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV.
What to do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.
| Product | Affected |
|---|---|
| Citrix NetScaler ADC | before 14.1-73.37; before 13.1-64.23; before 14.1-73.37 FIPS; before 13.1.37.279 FIPS and NDcPP |
| Citrix NetScaler Gateway | before 14.1-73.37; before 13.1-64.23 |
Estimated exposure
largetens of thousands of internet-exposed appliances (vulnerable subset unknown) — NetScaler ADC and Gateway are widely deployed enterprise load-balancer and VPN appliances; historical public internet scans have typically shown on the order of tens of thousands of exposed instances, though the share still on these…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
KEVCISA Known Exploited Vulnerability
- Affected
- Citrix NetScaler
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- citrix
- Products
- netscaler application delivery controller, netscaler gateway
- Weakness
- CWE-119
- Vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
20 storiesAttackers exploited Citrix NetScaler zero-day for at least three weeks undetected
Suspected state-sponsored actors mass-exploited Citrix NetScaler zero-day CVE-2026-88772 undetected for over three weeks, hitting dozens of organizations.
95
Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services
Unknown attackers exploited critical Citrix NetScaler zero-days CVE-2026-88771/88772 since early September, deploying custom WHIPSHOT and SLAPSHOT malware for persistence and tunneling.
95
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
Attackers are exploiting critical Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 for unauthenticated remote code execution.
95
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
Citrix patched two actively exploited NetScaler zero-days (CVE-2026-88771/88772, CVSS 9.5); CISA added both to KEV amid global attacks.
94
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
CISA says attackers are globally exploiting critical Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772.
94
Citrix Confirms NetScaler Zero-Day RCE Flaws Actively Exploited in Attacks
Citrix confirms two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are actively exploited for remote code execution.
94
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Citrix NetScaler zero-day CVE-2026-88779 is exploited in the wild against patched appliances, causing DoS with possible RCE; CISA added it to KEV.
93
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
LevelBlue details post-exploitation of actively exploited Citrix NetScaler flaw CVE-2026-88771: superuser account creation, PHP web shells, and configuration theft.
93
Hackers exploit Citrix NetScaler zero-day to deploy web shells
Attackers exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunnel into networks.
93
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)
Citrix NetScaler zero-day CVE-2026-88771 is under mass exploitation after a public proof of concept.
93
US, UK warn of exploited Citrix NetScaler zero-day bugs
Agencies warn exploited Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 require immediate patching and forensic triage.
93
Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)
Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after weeks of global exploitation planting webshells.
93
Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.
Suspected state hackers exploited two Citrix NetScaler zero-days; about 50,000 devices may remain exposed.
92
Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances
Actively exploited Citrix NetScaler zero-days CVE-2026-88772/88771 give attackers root access; Mandiant uncovers WHIPSHOT web shells and SLAPSHOT tunneler in ongoing campaign.
92
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Citrix reports NetScaler ADC and Gateway zero-days CVE-2026-88771/88772 (CVSS 9.5) exploited in the wild, with over 50,000 exposed instances.
92
NetScaler admins told to patch critical zero-days in ADC and Gateway now
Citrix and CISA warn NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 are under active attack.
92
Citrix Patches Critical Zero Days Under Active Exploitation
Citrix patched two actively exploited critical NetScaler zero-days enabling unauthenticated remote code execution.
92
CISA orders feds to patch exploited Citrix flaws by Wednesday
CISA ordered federal agencies to patch two exploited critical Citrix NetScaler RCE flaws by September 30.
92
Citrix Confirms NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attack
Citrix confirms attackers are exploiting two critical unauthenticated NetScaler RCE zero-days, CVE-2026-88771 and CVE-2026-88772.
92