Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day
Citrix confirmed exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 allow unauthenticated remote code execution.
Citrix confirmed that CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, were exploited as zero-days in NetScaler ADC and NetScaler Gateway before patches on September 27, 2026. CVE-2026-88771 is improper input validation that lets an unauthenticated attacker run arbitrary commands on every affected deployment. CVE-2026-88772 is a memory overflow enabling remote code execution or denial of service when DTLS is enabled, the default on Gateway VPN virtual servers. Fixes are in 14.1-73.37, 13.1-64.23, and later FIPS builds; August releases that fixed CVE-2026-19490 remain vulnerable, and these flaws are unrelated to CVE-2026-19489 and CVE-2026-19490.
- CVE-2026-88771 (CVSS 9.5) allows unauthenticated arbitrary command execution on all affected deployments.
- CVE-2026-88772 (CVSS 9.5) is a DTLS memory overflow that can yield remote code execution.
- Citrix observed exploitation on unmitigated appliances before the September 27 patches.
- August builds 14.1-73.32 and 13.1-63.21 do not fix these new flaws.
- NetScaler Console indicators may miss compromises; the 13.1 branch is end of maintenance.
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- watchTowrDutch National Cyber Security Centre
- Countries
- Netherlands
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19489 | Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway | 8.8 | <1% | ||
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
4 min read at securityaffairs.com
Citrix confirmed two critical NetScaler zero-days were exploited before patches were available, with attackers able to remotely execute code. Citrix confirmed that two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway were exploited before the company released patches. The flaws allow remote code execution, meaning attackers can potentially take control of affected appliances.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.