NetScaler ADC (Organization): news timeline & CVEs

Citrix Urges Immediate Patching of Critical NetScaler Vulnerability

Citrix urges immediate patching of critical NetScaler ADC/Gateway memory-overflow flaw CVE-2026-107406 (CVSS 9.5) enabling RCE; no known exploits yet.

Citrix disclosed CVE-2026-107406, a critical memory overflow (CVSS 9.5) that can lead to remote code execution or denial of service. The flaw affects NetScaler ADC and NetScaler Gateway appliances configured as SAML SP or SAML IdP, plus Secure Private Access Hybrid deployments using NetScaler. Fixes shipped in versions 14.1-73.46, 13.1-64.29, and FIPS variants 14.1-73.46 FIPS and 13.1-37.283. Citrix states it is not aware of unmitigated exploitation, but the disclosure follows three recently exploited NetScaler zero-days (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779).

SecurityWeekupdated Oct 9, 13:31 UTC · 1d agofirst Oct 9, 06:53 UTC · 1d agoVulnerability 29 sources CVE-2026-107406 CVE-2026-88779 CVE-2026-88771+1 CVEs2· 1 read

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

Actively exploited Citrix NetScaler zero-days CVE-2026-88772/88771 give attackers root access; Mandiant uncovers WHIPSHOT web shells and SLAPSHOT tunneler in ongoing campaign.

In late September 2026, Mandiant and Google Threat Intelligence identified active in-the-wild exploitation of zero-day CVE-2026-88772 in Citrix NetScaler ADC and NetScaler Gateway, ongoing since at least early September. The flaw bypasses authentication and triggers unhandled termination of the NetScaler Packet Processing Engine to achieve root-level shellcode execution on the underlying FreeBSD platform. Impacted organizations span North America and Europe across government, financial services, education, legal, and professional services sectors. The actor deploys the custom WHIPSHOT PHP web shell, which disguises Base64-encoded C2 payloads in HTTP headers, and the SLAPSHOT Python tunneler for internal reconnaissance and credential theft; a second zero-day, CVE-2026-88771, is also actively exploited per vendor disclosure.

Google Threat IntelligenceSep 29, 05:00 UTC · 12d agoExploit / PoC in the wildCVE-2026-88772 CVE-2026-88771

NetScaler ADC

Timeline2 articles

Related CVEsby mentions

Appears with

Citrix Urges Immediate Patching of Critical NetScaler Vulnerability

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances