Citrix Confirms NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attack

Citrix has released emergency security updates for NetScaler ADC and NetScaler Gateway after confirming that attackers are exploiting two critical remote code execution vulnerabilities against unmitigated appliances.

The flaws, CVE-2026-88771 and CVE-2026-88772, each carry a CVSS v4.0 score of 9.5 and can let remote, unauthenticated adversaries execute code, placing internet-facing gateways at immediate risk. Because these appliances sit at the network edge and broker trusted traffic, successful exploitation may provide a powerful foothold for lateral movement and credential theft.

The confirmation validates warnings covered yesterday by Cyber Security News, when watchTowr reported two previously undisclosed NetScaler RCE zero-days found during forensic investigations.

At that time, Citrix had not released CVE identifiers, affected builds, indicators of compromise, or patches, forcing some organizations to consider isolating exposed appliances while awaiting authoritative guidance.

NetScaler 0-Day RCE Exploited

CVE-2026-88771 results from improper input validation and can permit arbitrary command execution. Its exposure is unusually broad: every NetScaler ADC and NetScaler Gateway deployment is affected, including default configurations, with no optional feature required. CVE-2026-88772 is a memory-overflow flaw capable of causing RCE or denial of service when DTLS is enabled; DTLS is enabled by default on VPN virtual servers.

The bulletin addresses six additional vulnerabilities. CVE-2026-88773, rated 9.3, enables HTTP request smuggling in deployments using HTTP configurations.

CVE-2026-88774, scored 7.0, involves policy bypass through improper HTTP URL-based expressions, potentially allowing non-normalized URLs to evade WAF or security rules.

Three 8.8-rated memory-overflow flaws—CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777—affect Gateway or AAA virtual servers, Oracle load-balancing virtual servers, and LB/CS or CGNAT-LSN/NAT64 devices using non-HTTP Layer 7 features, respectively.

CVE-2026-88778, also rated 8.8, permits TCP initial sequence number prediction when Enhanced ISN Generation is disabled on relevant TCP configurations.

Administrators should upgrade immediately to NetScaler ADC and Gateway 14.1-73.37 or later, or 13.1-64.23 or later. Fixed specialized builds are 14.1-73.37 FIPS and 13.1-37.279 for FIPS and NDcPP deployments.

Because CVE-2026-88771 affects default installations, configuration-based exposure reduction cannot replace patching. Teams should still inspect configurations for DTLS, HTTP or SSL virtual servers, Gateway and AAA services, Oracle load balancing, non-HTTP Layer 7 protocols, and disabled Enhanced ISN Generation.

Citrix is providing generic indicators of compromise through NetScaler Console’s Security Advisory workflow. The capability requires telemetry and is available through the Console service and on-premises Console with Cloud Connect, beginning with version 14.1-73.36.

Citrix cautions that these checks cannot cover every attacker technique and may miss compromises; organizations finding suspicious activity should preserve evidence and engage qualified forensic responders. Logs should be forwarded to an external SIEM, while File Integrity Monitoring can help identify unauthorized changes.

A deployment running 13.1-64.23 may enter a reboot loop during upgrade when NetScaler variables are configured. Administrators can run show ns variable; if variables are returned, Citrix advises planning for 13.1-64.24. The Console may also temporarily mislabel 13.1-64.23 as vulnerable.

Given confirmed exploitation, defenders should treat the update as an incident-response priority, not routine patch management. Patch every node, verify the running build, scan for compromise, review authentication and network activity, and investigate unexpected files, processes, configuration changes or outbound connections.

Updating closes the vulnerabilities, but it does not remove persistence or other artifacts left by attackers who exploited an appliance before remediation.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC