Exploited NetScaler flaws allow command execution before login
Original title: Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
CVE-2026-88771 works without authentication, including on default configurations; CVE-2026-88772 involves DTLS.
Cloudflare says Citrix's September 27, 2026 bulletin reported observed exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler gateways. The first allows unauthenticated command execution, including in the default configuration, while the second affects DTLS configurations. Citrix released software updates, and Cloudflare added an emergency WAF rule on October 1. Advisories on October 3 and October 8 addressed further SAML-configuration flaws that the post says enabled arbitrary script execution and denial of service.
Unconfirmed: Fixed versions are not named, and the later SAML flaws are described without CVE identifiers.
- Cloudflare tells unpatched NetScaler customers to patch before reading further.
- The emergency Cloudflare WAF rule was deployed on October 1.
- October 3 and October 8 advisories covered additional SAML-configuration flaws.
- Web access controls do not automatically cover separate DTLS-enabled listeners.
Impact: Unauthenticated command execution on exposed NetScaler gateways
| Product | Affected |
|---|---|
| Citrix NetScaler Gateway | — |
- 1.Patch every NetScaler instance before relying on added controls.
- 2.Place public login pages behind an independent access policy.
- 3.Review DTLS-enabled listeners separately from the web authentication path.
- Vendors
- CitrixCloudflare
- Products
- NetScaler Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
8 min read at blog.cloudflare.com
CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code.
By Grant Bourzikas · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.