Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
Attackers are exploiting critical Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 for unauthenticated remote code execution.
On September 27, 2026, Citrix disclosed eight NetScaler ADC and Gateway flaws, including two critical unauthenticated RCEs scored CVSS 9.5. CVE-2026-88771 yields remote code execution in the default configuration with low attack complexity, while CVE-2026-88772 is a DTLS memory-corruption RCE with high complexity. CISA confirmed both were exploited as zero-days before disclosure and added them to the KEV catalog; CVE-2026-88773 through CVE-2026-88778 are not confirmed exploited. Patches are in 14.1-73.37, 13.1-64.23, and corresponding FIPS and NDcPP builds.
- CVE-2026-88771 enables unauthenticated RCE on default NetScaler configurations with low complexity.
- CVE-2026-88772 is a DTLS memory-corruption RCE rated high attack complexity.
- CISA confirmed pre-disclosure zero-day exploitation and added both flaws to KEV.
- Six other NetScaler bugs were fixed but are not confirmed exploited.
- Fixed in 14.1-73.37, 13.1-64.23, and corresponding FIPS and NDcPP releases.
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
2 min read at rapid7.com
Overview On September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution (RCE) vulnerabilities: CVE-2026-88771 and CVE-2026-88772. Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9. 5, and both have been confirmed as being actively exploited in the wild as zero-days prior to the vendor disclosure.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.