Citrix Patches Critical Zero Days Under Active Exploitation
Citrix patched two actively exploited critical NetScaler zero-days enabling unauthenticated remote code execution.
On 27 September Citrix released fixes for eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway, with CVSS scores from 7.0 to 9.5. CVE-2026-88771 is an unauthenticated remote code execution flaw from improper input validation on default configurations, and CVE-2026-88772 is a memory overflow that can cause RCE or denial of service when DTLS is enabled. Citrix said exploitation of both has been observed. CVE-2026-88773 is an HTTP request-smuggling flaw scored 9.3. Australia’s ACSC issued a critical alert, and CISA ordered US federal agencies to patch by 30 September. The actor behind the current exploitation is unknown.
- CVE-2026-88771 allows unauthenticated RCE on default NetScaler ADC and Gateway.
- CVE-2026-88772 is a memory-overflow RCE or DoS when DTLS is enabled.
- Citrix confirmed exploitation of both zero-days on unpatched deployments.
- CISA ordered US federal agencies to patch by 30 September.
- CVE-2026-88773 is critical HTTP request smuggling scored CVSS 9.3.
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CISAAustralian Cyber Security CentreNCSC-NL
- Countries
- United StatesAustraliaNetherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
2 min read at infosecurity-magazine.com
Citrix has confirmed exploitation of two critical zero-day RCE bugs
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.