Exploit / PoCcriticalExploited in the wild

Citrix Confirms NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attack

Cyber Security Newsby Guru BaranSep 27, 2026 · 16:41 UTC (Sep 27, 2026)4 min read11 · 4 reads

AI summary · grok-4.7Summaries by Vani AI

Citrix confirms attackers are exploiting two critical unauthenticated NetScaler RCE zero-days, CVE-2026-88771 and CVE-2026-88772.

Citrix released emergency updates after confirming attackers are exploiting two critical unauthenticated remote code execution flaws in NetScaler ADC and NetScaler Gateway. CVE-2026-88771 (CVSS 9.5) is improper input validation enabling arbitrary command execution on all deployments, including defaults. CVE-2026-88772 (CVSS 9.5) is a memory overflow that can cause RCE or denial of service when DTLS is enabled, which is default on VPN virtual servers. Six more issues, including HTTP request smuggling CVE-2026-88773 (9.3), are patched in 14.1-73.37 and 13.1-64.23; updating does not remove artifacts from prior compromise.

Key facts

CVE-2026-88771 allows unauthenticated remote command execution on every NetScaler ADC and Gateway deployment.
CVE-2026-88772 is a memory-overflow RCE or DoS when DTLS is enabled, the VPN default.
Six additional flaws cover request smuggling, policy bypass, memory overflows, and TCP ISN prediction.
Upgrade to 14.1-73.37 or 13.1-64.23 or later; patching does not remove prior persistence.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-88771 CVE-2026-88772 CVE-2026-88773 CVE-2026-88774 CVE-2026-88775 CVE-2026-88776 CVE-2026-88777 CVE-2026-88778

ATT&CK: T1190 Exploit Public-Facing Application T1059 Command and Scripting Interpreter

Tags: citrix netscaler zero-day rce actively-exploited cve-2026-88771 gateway patch

Vendors: Citrix
Products: NetScaler ADC NetScaler Gateway NetScaler Console
Organizations: Citrix watchTowr

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-88771 +1 related CVE CVE-2026-88772	Unauthenticated RCE in Citrix NetScaler ADC and Gateway	9.5	82%	KEVPoC ×5	Sep 27, 2026 KEV Sep 27, 2026
CVE-2026-88773 +5 related CVEs CVE-2026-88776 CVE-2026-88775 CVE-2026-88777 CVE-2026-88778 CVE-2026-88774	HTTP request smuggling in Citrix NetScaler ADC and Gateway	9.3 group max	3%	PoC ×2	Sep 27, 2026

From the original article

4 min read at cybersecuritynews.com

Citrix has released emergency security updates for NetScaler ADC and NetScaler Gateway after confirming that attackers are exploiting two critical remote code execution vulnerabilities against unmitigated appliances. The flaws, CVE-2026-88771 and CVE-2026-88772, each carry a CVSS v4. 0 score of 9.

Cyber Security News

By Guru Baran · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.