Skip to content
securitytabs

LiveUpdated

Citrix NetScaler flaws CVE-2026-88771 and CVE-2026-88772 exploited by attackers

Two serious flaws in Citrix NetScaler, equipment many companies use to give staff secure remote access to internal systems, are being used in real attacks. Organizations that run these devices should treat the matter as urgent.

Written by the SecurityTabs AI newsroom from 5 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms rarely run NetScaler themselves, but an IT provider or a larger partner may. Attackers have used the flaws against real organizations. [1][2]

What to do

  1. Ask your IT provider whether any Citrix NetScaler ADC or Gateway device is used for your remote access. [1]
  2. If so, ask whether Citrix's security bulletin fixes have been applied and whether the device was checked for compromise. [2][3]

Mid-size company

A small IT or security team

What to know

Both flaws are in CISA's KEV catalogue and Rapid7 reports a full compromise of an appliance, so unpatched devices should be treated as at risk. [2][3]

What to do

  1. Inventory NetScaler ADC and Gateway appliances and apply the fixes in Citrix's security bulletin. [2]
  2. Review appliances for web shells and unexpected outbound connections, which Rapid7 found in the intrusion it investigated. [3]
  3. Consider placing a sign-in check in front of the gateway, as Cloudflare suggests. [4]

Large enterprise

A security operations team

What to know

Google and Mandiant report exploitation since before disclosure across several sectors, and Rapid7 reports root access, persistence, tunnelling and reconnaissance of directory services after compromise. [1][3]

What to do

  1. Patch all NetScaler appliances per Citrix's bulletin and prioritise internet-facing gateways. [2]
  2. Hunt on appliances for PHP web shells, new persistence mechanisms and exfiltration of configuration data, following the Rapid7 and Google guidance. [3][1]
  3. If a device was exposed unpatched, treat it as possibly compromised and review access to DNS, LDAP, Active Directory and VMware vCenter systems. [3]

Vulnerabilities

What happened

Citrix NetScaler ADC and NetScaler Gateway are appliances that sit at the edge of a network and handle remote logins and traffic. watchTowr Labs published an analysis on September 28, 2026 of CVE-2026-88771, which it describes as a pre-authentication command injection, meaning an attacker can run commands without logging in. watchTowr says the wider world appeared to know about the NetScaler flaws before Citrix did. [5]

NVD describes CVE-2026-88771 as a remote code execution flaw caused by improper input validation that can be reached by an unauthenticated attacker, and rates it 9.5 on the CVSS v4.0 scale. A second flaw, CVE-2026-88772, is described as a memory overflow that can lead to remote code execution or a denial of service, and also scores 9.5. [5]

Exploitation

Google Threat Intelligence Group and Mandiant Consulting say they identified active exploitation of CVE-2026-88772 as a zero-day (a flaw exploited before a fix existed) in late September 2026. They say organizations in North America and Europe in government, financial services, technology, education, and legal and professional services were likely affected. [1]

Palo Alto Networks Unit 42 says Citrix has reported that both CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. Both are listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using. CISA added them on September 27, 2026 with a federal due date of September 30, 2026; whether ransomware groups use them is listed as unknown. [2]

Rapid7 says it investigated an early October 2026 compromise of a NetScaler ADC appliance running an affected 14.1 build. Rapid7 reports the attackers chained CVE-2026-88771 with another flaw, CVE-2026-88779, gained root access, installed PHP web shells and several persistence mechanisms, and exfiltrated NetScaler configuration data. [3]

Patches and mitigations

Citrix has published a security bulletin for the flaws, which is referenced in the CVE records. Cloudflare argues that patching takes time many teams lack and recommends placing a sign-in check in front of the NetScaler gateway so that unauthenticated requests do not reach the vulnerable code. [4][5]

Timeline

  1. Rapid7 published its analysis of intrusions chaining CVE-2026-88771 and CVE-2026-88779. [3]

  2. Cloudflare published guidance on protecting NetScaler gateways. [4]

  3. Unit 42 reported that Citrix said both CVE-2026-88771 and CVE-2026-88772 had been exploited in the wild. [2]

  4. Google Threat Intelligence Group and Mandiant described active exploitation of CVE-2026-88772. [1]

  5. watchTowr Labs published its analysis of CVE-2026-88771. [5]

  6. · CISA KEV

    CISA added CVE-2026-88772 to its Known Exploited Vulnerabilities catalog.

  7. · CISA KEV

    CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog.

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Sources

  1. [1]Google Threat Intelligence · Sep 29, 14:00 UTC
    Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliancescontext
  2. [2]Palo Alto Unit 42 · Sep 30, 20:00 UTC
    Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)context
  3. [3]Rapid7 Blog · Oct 19, 15:11 UTC
    Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779context
  4. [4]Cloudflare Blog (Security) · Oct 19, 13:00 UTC
    Beyond the patch: Protecting your NetScaler gateway against future vulnerabilitiescontext
  5. [5]watchTowr Labs · Sep 28, 10:55 UTC
    Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)context