Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)
Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after weeks of global exploitation planting webshells.
Citrix patched eight NetScaler ADC and Gateway flaws, including actively exploited zero-days CVE-2026-88771 and CVE-2026-88772 used for weeks to plant webshells. CVE-2026-88771 is unauthenticated remote command execution on default configurations; CVE-2026-88772 is a memory overflow leading to RCE or denial of service when DTLS is enabled. CISA added both to the KEV catalog and ordered US federal civilian agencies to remediate and triage by September 30, 2026. Citrix says customer-managed 14.1 and 13.1 builds, FIPS variants, and Secure Private Access Hybrid deployments are affected.
- CVE-2026-88771 allows unauthenticated remote command execution on default NetScaler configurations.
- CVE-2026-88772 is a memory overflow enabling RCE or DoS when DTLS is enabled.
- Attackers planted unique webshells and deleted artifacts with anti-forensics commands.
- CISA added both flaws to KEV with a September 30, 2026 federal deadline.
- Affected versions include 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus FIPS builds.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1059 Command and Scripting InterpreterT1070.004 File Deletion
- Vendors
- Citrix
- Countries
- NetherlandsUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88778 | Predictable-value flaw in Citrix NetScaler ADC and Gateway | 8.8 | — |
From the original article
3 min read at helpnetsecurity.com
Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.