Two vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway were exploited as zero-days before Citrix disclosed them. After a public root-cause analysis and proof-of-concept appeared for one of them, attacks spread to unpatched appliances across the internet. The flaws are CVE-2026-88771 and CVE-2026-88772. Both are rated CVSS v4 9.5 and appeared in a September 27, 2026 advisory (CTX697096) that covers eight NetScaler issues, CVE-2026-88771 through CVE-2026-88778. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog that same day and set a due date of September 30, 2026. That federal deadline has passed: it was 19 days ago.

Responders have found more than scanning. Rapid7 has identified two compromised organizations. In one, a webshell was planted on the appliance. In the other, an attacker's command was built to pack the appliance's configuration directory into an archive in a path that anyone could download from without logging in.

The two flaws

CVE-2026-88771 is an improper input validation flaw (CWE-20). According to NVD, it lets an unauthenticated attacker execute arbitrary commands on NetScaler ADC and Gateway. Rapid7 reports that it affects appliances in their default configuration and that the vendor rates its attack complexity as low. CISA lists it as "Citrix NetScaler Improper Input Validation Vulnerability."

CVE-2026-88772 is a memory buffer flaw (CWE-119) that NVD says can lead to remote code execution or denial of service. Rapid7 says it requires the DTLS feature to be enabled and that the vendor rates its attack complexity as high. CISA's catalog name is "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability." Help Net Security reports that no public proof-of-concept exists for this one.

NVD lists the same affected versions for both CVEs:

  • NetScaler ADC before 14.1-73.37 and before 13.1-64.23
  • NetScaler ADC before 14.1-73.37 FIPS
  • NetScaler ADC before 13.1.37.279 FIPS and NDcPP
  • NetScaler Gateway before 14.1-73.37 and before 13.1-64.23

The September 27 fixes were builds 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP. Rapid7 notes that they have since been superseded. CVE-2026-88779, published October 4, is a SAML memory overflow (CVSS v4 8.7) that Rapid7 says was also exploited before disclosure. Its fixes are 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1.37.282 FIPS/NDcPP.

From quiet zero-day to broad exploitation

The exploitation came in two phases, and the order of events is the story.

  • Early September 2026, possibly earlier: Help Net Security reports that the initial, suspected state-sponsored attacks, which exploited CVE-2026-88772, started at this point. Mandiant has shared indicators of compromise for them.
  • September 20, 14:28 UTC: Rapid7 recorded its earliest exploitation attempt against CVE-2026-88771, seven days before public disclosure. Rapid7 counts this command-injection attempt as one of its two compromises. It saw only two attempts that day and said that did not indicate widespread exploitation at the time.
  • September 24: Rapid7 observed the webshell at one of the two compromised organizations. Help Net Security reports that GreyNoise saw an attacker attempt zero-day exploitation against a NetScaler Gateway sensor the same day. The attacker failed to gain a foothold on that sensor.
  • September 27: Citrix published its advisory, the CVE records were published, and CISA added both CVEs to KEV with a September 30 due date.
  • After disclosure: watchTowr Labs published a root-cause analysis and proof-of-concept for CVE-2026-88771. Help Net Security, in a report published September 29 and updated October 1, said exploitation then escalated into widespread "spray and pray" attacks. Lupovis CEO Xavier Bellekens said, according to Help Net Security, that his company's sensors recorded opportunistic exploitation attempts within minutes of the release.

Censys counted about 42,000 internet-facing hosts running NetScaler ADC or Gateway. Of those, 13,549, or 32 percent, are in the United States. Censys said it cannot tell whether these hosts are vulnerable or compromised.

Help Net Security also cited researcher Kevin Beaumont. Based on scanning firmware versions, he estimated that fewer than 10 percent of exposed hosts had been patched, and he said he was tracking more than 100 victim organizations. As quoted by Help Net Security, Beaumont said "each one has a unique webshell which can't be scanned for remotely unless you're the attacker." He believes the initial attackers are after espionage.

What the attackers took

In the September 20 compromise Rapid7 investigated, an unidentified attacker's command-injection attempt against CVE-2026-88771 was built to archive the appliance's /flash/nsconfig directory into /var/netscaler/gui/vpn/, which is served publicly. Once the command runs, Rapid7 says, anyone can retrieve the archive without logging in. Rapid7 does not say whether the archive was downloaded. The attempt came from 149.104.78[.]208. Rapid7 says such an archive can contain ns.conf, which holds encrypted administrator passwords and LDAP, RADIUS and TACACS bind passwords. It can also contain SSL certificates and private keys, SSH host keys, license files and HA sync settings. In the second organization, Rapid7 found a webshell at /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver.

Citrix has published a detection script, but the company cautioned that it "might fail to identify actual compromises," as reported by Help Net Security. A clean result from the script is therefore not proof that an appliance is clean.

What It Means for Defenders

  • Patch to the superseding builds. Move every ADC and Gateway instance, including FIPS and NDcPP variants, to the CVE-2026-88779 builds listed above. Patch on an emergency basis, outside normal patching cycles.
  • Investigate, don't just patch. Follow Citrix's guidance in CTX694799 for appliances suspected of compromise. CISA's KEV entries also require forensic triage under BOD 26-04. Look for the paths and IP above, for unexpected archives in web-served directories, and for webshells that won't match a known hash.
  • Treat exposed secrets as burned. If an appliance shows signs of intrusion, rotate the admin, LDAP, RADIUS and TACACS credentials configured on it, and replace its private keys and certificates.
  • Map DTLS exposure. Find which appliances have DTLS enabled, since those are the ones exposed to CVE-2026-88772.
  • Check downstream authentication. Review LDAP and RADIUS logs for unexpected use of NetScaler service accounts since early September.

Sources