Skip to content
securitytabs

Updated

Citrix NetScaler Zero-Day Flaws Exploited in Attacks on Gateways

Attackers have broken into Citrix NetScaler network gateway and load-balancing devices using two serious flaws that were exploited before fixes existed. Organizations running these devices should check with their IT provider that Citrix's fixes are installed.

Written by the SecurityTabs AI newsroom from 5 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Vulnerabilities

What happened

Google Threat Intelligence Group and Mandiant say they identified active exploitation in the wild of a zero-day (a flaw exploited before a fix existed), CVE-2026-88772, in Citrix NetScaler ADC and NetScaler Gateway appliances in late September 2026. They say the campaign has been ongoing since at least early September. [1]

Palo Alto Networks Unit 42 says Citrix reported that both CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. watchTowr Labs published an analysis of CVE-2026-88771, describing it as a pre-authentication command injection, and wrote that the wider world appeared to know of the flaws before Citrix did. [2][3]

Severity and official listings

Both flaws are rated 9.5 on the CVSS severity scale. CVE-2026-88771 is described as a remote code execution flaw that lets an unauthenticated attacker run code. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service. CISA lists both in its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, from September 27, with a federal due date of September 30. [1][2]

Who is affected and what attackers did

Google says organizations in North America and Europe in government, financial services, technology, education, and legal and professional services were likely affected. [1]

Rapid7 describes an early October 2026 investigation of a compromised NetScaler ADC running an affected 14.1 build. It says the intruders gained root code execution, installed several persistence mechanisms and PHP web shells, set up outbound command-and-control and internal tunnelling, scouted DNS, LDAP/Active Directory, management services and VMware vCenter, and exfiltrated NetScaler configuration data. Rapid7's title refers to chaining CVE-2026-88771 with a further flaw, CVE-2026-88779. [4]

Mitigations

Citrix has published a security bulletin covering the flaws. Cloudflare argues that because patching takes time many teams lack, the sign-in decision should be moved in front of the vulnerable gateway code, and has published guidance on doing so. [5][1]

Timeline

  1. Cloudflare published guidance on protecting NetScaler gateways beyond patching. [5]

  2. Rapid7 published an analysis of a NetScaler intrusion it investigated in early October. [4]

  3. Unit 42 updated its threat brief saying Citrix reported both flaws exploited in the wild. [2]

  4. Google Threat Intelligence Group and Mandiant reported zero-day exploitation of NetScaler appliances ongoing since at least early September. [1]

  5. watchTowr Labs published its analysis of the pre-authentication command injection flaw. [3]

  6. · CISA KEV

    CISA added CVE-2026-88772 to its Known Exploited Vulnerabilities catalog.

  7. · CISA KEV

    CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog.

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms rarely run NetScaler themselves, but an IT provider or hosted service they use may. Google reports exploitation across several sectors. [1]

What to do

  1. Ask your IT provider whether it uses Citrix NetScaler ADC or Gateway and whether Citrix's security bulletin fixes are installed. [2]
  2. Ask the provider whether it has checked the devices for signs of compromise, since exploitation began before fixes existed. [1]

Mid-size company

A small IT or security team

What to know

Exposed NetScaler appliances were exploited from early September, so patching alone may not show whether a device was already compromised. Rapid7 found web shells and stolen configuration data on an affected device. [1][4]

What to do

  1. Inventory NetScaler ADC and Gateway appliances and apply the fixes in Citrix's security bulletin. [2]
  2. Review appliances for web shells, unexpected outbound connections and persistence, as described in Rapid7's analysis. [4]
  3. Consider whether the credentials and configuration held on the appliance need to be reviewed after a possible compromise. [4]

Large enterprise

A security operations team

What to know

Attackers in the Rapid7 case moved from the appliance to reconnaissance of Active Directory, DNS and VMware vCenter, so a compromised gateway can be a route to core systems. [4]

What to do

  1. Identify all NetScaler ADC and Gateway instances, including those run by third parties, and confirm Citrix's fixes are applied. [2]
  2. Hunt for indicators from the Google Threat Intelligence and Rapid7 reports, covering exploitation dating back to early September. [1][4]
  3. Monitor for lateral movement from the appliance toward LDAP/Active Directory and vCenter. [4]
  4. Evaluate placing an authentication layer in front of the gateway, as Cloudflare describes. [5]

Sources

  1. [1]Google Threat Intelligence · Sep 29, 14:00 UTC
    Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliancescontext
  2. [2]Palo Alto Unit 42 · Sep 30, 20:00 UTC
    Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)context
  3. [3]watchTowr Labs · Sep 28, 10:55 UTC
    Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)context
  4. [4]Rapid7 Blog · Oct 19, 15:11 UTC
    Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779context
  5. [5]Cloudflare Blog (Security) · Oct 19, 13:00 UTC
    Beyond the patch: Protecting your NetScaler gateway against future vulnerabilitiescontext