Citrix Patches Critical Zero Days Under Active Exploitation
Citrix patched two actively exploited critical NetScaler zero-days enabling unauthenticated remote code execution.
On 27 September Citrix released fixes for eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway, with CVSS scores from 7.0 to 9.5. CVE-2026-88771 is an unauthenticated remote code execution flaw from improper input validation on default configurations, and CVE-2026-88772 is a memory overflow that can cause RCE or denial of service when DTLS is enabled. Citrix said exploitation of both has been observed. CVE-2026-88773 is an HTTP request-smuggling flaw scored 9.3. Australia’s ACSC issued a critical alert, and CISA ordered US federal agencies to patch by 30 September. The actor behind the current exploitation is unknown.
- CVE-2026-88771 allows unauthenticated RCE on default NetScaler ADC and Gateway.
- CVE-2026-88772 is a memory-overflow RCE or DoS when DTLS is enabled.
- Citrix confirmed exploitation of both zero-days on unpatched deployments.
- CISA ordered US federal agencies to patch by 30 September.
- CVE-2026-88773 is critical HTTP request smuggling scored CVSS 9.3.
Vulnerabilities mentionedAll →
- CVE-2026-887729.51%Unauthenticated RCE/DoS in Citrix NetScaler ADC and Gatewaypublished · Citrix NetScaler ADC KEV PoC ×2+1 related
Full article420 words · extracted from infosecurity-magazine.com · click to collapse
Citrix has published updates for eight new vulnerabilities, including two critical zero-day CVEs that had been under active exploitation.
In a bulletin on September 27 the vendor confirmed eight new flaws in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). They have CVSS scores ranging from 7 to 9.5.
The two most urgent are:
- CVE-2026-88771: a remote code execution (RCE) flaw due to improper input validation, enabling an unauthenticated attacker to execute arbitrary commands. It affects all NetScaler ADC and NetScaler Gateway deployments with default configuration
- CVE-2026-88772: a memory overflow vulnerability leading to RCE or denial of service. It affects any deployment with DTLS configuration enabled (which it is by default on VPN vServers)
“Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed,” Citrix said in a blog post. “Citrix strongly urges affected customers to install the relevant updated versions as soon as possible.”
Also noteworthy is CVE-2026-88773, a critical HTTP request smuggling flaw which is present when the HTTP configuration is enabled on NetScaler ADC or NetScaler Gateway. It has a CVSS score of 9.3.
Reports had been circulating before the Citrix bulletin of exploitation of the zero-day bugs.
The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) issued a critical alert on September 28 urging organizations to patch.
Reports online also suggested the Dutch National Cyber Security Center (NCSC-NL) had issued alerts to local organizations in the country.
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch by Wednesday, 30 September.
It’s not clear who is behind the exploitation attempts but in 2025, a cyber intrusion linked to China-based group Salt Typhoon targeted a Citrix zero day.
The Remaining Five Vulnerabilities
The rest of the CVEs published by Citrix include:
- CVE-2026-88774: a feature policy bypass due to improper HTTP URL based expression usage (CVSS 7)
- CVE-2026-88775: a memory overflow vulnerability leading to unpredictable or erroneous behavior or denial of service (CVSS 8.8)
- CVE-2026-88776: a memory overflow vulnerability leading to unpredictable or erroneous behavior or denial of service (CVSS 8.8)
- CVE-2026-88777: a memory overflow vulnerability leading to unpredictable or erroneous behavior or denial of service (CVSS 8.8)
- CVE-2026-88778: a TCP Initial Sequence Number (ISN) prediction flaw with a (CVSS 8.8)
“This bulletin only applies to customer-managed Citrix NetScaler ADC and Citrix NetScaler Gateway,” the vendor confirmed. “Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates.”