Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild
Citrix reports NetScaler ADC and Gateway zero-days CVE-2026-88771/88772 (CVSS 9.5) exploited in the wild, with over 50,000 exposed instances.
Unit 42 warns that CVE-2026-88771, an unauthenticated remote code execution flaw from improper input validation, and CVE-2026-88772, a memory overflow enabling RCE or DoS in the DTLS configuration, are being exploited in the wild against NetScaler ADC and NetScaler Gateway. Both carry CVSS v4.0 base scores of 9.5. Palo Alto Networks Cortex Xpanse identified over 50,277 potentially vulnerable exposed instances as of September 27, 2026. Unit 42 urges immediate patching, exposure confirmation, isolation, and evidence preservation, noting patching will not evict attackers with established persistence.
- CVE-2026-88771 allows unauthenticated RCE on NetScaler ADC and Gateway
- CVE-2026-88772 is a DTLS memory overflow enabling RCE or denial of service
- Both vulnerabilities scored CVSS v4.0 9.5 and reported exploited in the wild
- Over 50,277 exposed instances identified via Cortex Xpanse telemetry
- Patching does not remove persistence from already-compromised appliances
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Organizations
- CitrixPalo Alto NetworksUnit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
2 min read at unit42.paloaltonetworks.com
Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild appeared first on Unit 42.
By Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.