# Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)

> Citrix has released fixes (security bulletin CTX697096, 2026-09-27) for the two NetScaler ADC and NetScaler Gateway zero-days exploited in the wild: CVE-2026-88771, an unauthenticated remote code execution flaw caused by improper input validation that affects default configurations (CVSS 4.0 9.5), and CVE-2026-88772, a memory overflow leading to remote code execution or denial of service when DTLS is enabled, as it is by default on VPN virtual servers (CVSS 4.0 9.5). The same bulletin fixes six further flaws, CVE-2026-88773 through CVE-2026-88778. The zero-days first surfaced through a leaked NCSC-NL pre-notification before any vendor advisory; administrators should upgrade to 14.1-73.37 or 13.1-64.23 immediately and hunt for prior compromise, since exploitation predates the patch.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-10-13T12:24:05.516Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2703
- **ID:** TL-2026-2703
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 135 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778

## Description

Update (2026-09-27): Citrix published security bulletin CTX697096 with fixes for the two exploited zero-days, now tracked as CVE-2026-88771 (unauthenticated remote code execution through improper input validation, CWE-20, CVSS 4.0 9.5, all deployments in default configuration) and CVE-2026-88772 (memory overflow leading to remote code execution or denial of service, CWE-119, CVSS 4.0 9.5, when DTLS is enabled, which is the default on VPN virtual servers). Citrix marks both as exploited in the wild. The bulletin also fixes CVE-2026-88773 (HTTP request smuggling, CVSS 9.3), CVE-2026-88774 (policy bypass through HTTP URL expressions, CVSS 7.0), CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777 (memory overflows causing denial of service in Gateway/AAA, Oracle load-balancing and non-HTTP layer-7 configurations, CVSS 8.8 each) and CVE-2026-88778 (TCP initial sequence number prediction, CVSS 8.8). Fixed builds are NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23, NetScaler ADC 14.1-73.37 FIPS, and NetScaler ADC 13.1-37.279 FIPS/NDcPP. The original reporting below describes the pre-patch disclosure.

On 2026-09-25, a post to Reddit's r/Citrix community surfaced the contents of a pre-notification reportedly issued by the Dutch National Cyber Security Centre (NCSC-NL) to its partners under Traffic Light Protocol AMBER+STRICT restrictions, describing two unpatched, unauthenticated remote-code-execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. Public reporting indicates NCSC-NL itself received the underlying intelligence from a European partner CERT before issuing its own pre-notification -- one link in a cross-border information-sharing chain that predates any Citrix confirmation. According to the leaked notification, Citrix itself discovered the flaws while conducting incident-response investigations inside customer environments, and exploitation had already been identified at multiple Citrix customers worldwide before any patch existed. On 2026-09-26, security firm watchTowr and independent researcher Kevin Beaumont independently corroborated that the in-the-wild exploitation was credible, with watchTowr stating plainly: "Two vulnerabilities - both RCE. Unpatched, 0days. Exploited in-the-wild - discovered during forensics." Kevin Beaumont added: "The Netscaler zero day thing is real, being used in active attacks. No patch yet, if sensitive to Netscaler vulns switch it off." watchTowr and multiple outlets explicitly distinguish this pair from the previously disclosed and already-patched CVE-2026-19490 and CVE-2026-19489, cautioning against conflating them.

Of the technical mechanics, only one detail has been confirmed through the NCSC-NL notification: one of the two flaws allows an unauthenticated attacker with external HTTPS reachability to "place shellcode directly into memory" on the appliance -- a technique that bypasses file-based antivirus and most endpoint detection because no malicious file ever touches disk. Technical detail on the second flaw remains undisclosed. As of 2026-09-27, Citrix has not published a formal security advisory, has not assigned CVE identifiers, has not disclosed affected build ranges, and has not released indicators of compromise -- a gap that multiple outlets (Tenable, Cyber Kendra, shattered.io, CyberSecurityNews) explicitly flag as leaving defenders to act on largely unverified secondary reporting; CyberSecurityNews notes vulnerability scanners cannot even flag exposed appliances without a published build range. Some administrators report inconsistent notification: several told reporters they received no NCSC-NL alert or Citrix communication directly, despite the public reporting. Critically, NCSC-NL's original warning states that because the flaws were exploited before any patch existed, simply shutting down or eventually patching an appliance will not remove an attacker who is already inside it -- prior NetScaler compromises in this same product line have involved intruders maintaining access post-patch via backdoors, so incident responders should assume compromise and hunt for persistence rather than treating a future patch as remediation on its own.

This is the latest in a recurring pattern of pre-authentication memory-safety weaknesses in NetScaler's edge-facing code paths, a lineage that traces back to the original CitrixBleed (CVE-2023-4966, 2023), a pre-auth memory-overread flaw that enabled session-token theft and was widely exploited before its own patch existed, and includes CVE-2025-6543, a NetScaler zero-day exploited against Dutch critical infrastructure -- a fact that helps explain NCSC-NL's central, recurring role in NetScaler zero-day response. Citrix patched CVE-2026-3055 ("CitrixBleed 3"), a SAML IdP memory-overread flaw enabling unauthenticated extraction of session data and credentials from process memory (repeated crafted requests can return different memory segments over time, enabling session hijacking and lateral movement), on 2026-03-23, after which CISA added it to the Known Exploited Vulnerabilities catalog within a week. Citrix patched a second pre-auth memory-overread flaw, CVE-2026-8451, on 2026-06-30, in the same disclosure batch as CVE-2026-8452, which watchTowr's own research notes was initially classified only as a denial-of-service issue before later analysis showed it was in fact a root-level pre-auth RCE -- underscoring how this vendor's own initial severity triage in this product line has previously understated real-world impact. Most recently, Citrix patched CVE-2026-19490 -- an authentication bypass via an alternate path or channel affecting AAA virtual servers handling SSL VPN, ICA Proxy, CVPN, and RDP Proxy functions -- on 2026-08-19; Singapore's Cyber Security Agency observed exploitation attempts against it by 2026-09-07, and CISA added it to the KEV catalog on 2026-09-09 with a federal remediation deadline of 2026-09-12. NetScaler 13.1 separately reached End of Maintenance on 2026-09-15, days before this newest pair of zero-days surfaced, complicating remediation options for organizations still running that branch.

Pending a Citrix advisory, published guidance is a mix of defensive best practice and community-sourced compensating controls rather than vendor-issued fix instructions: take internet-exposed NetScaler ADC/Gateway instances offline or restrict access to trusted networks, never expose the NetScaler Management Service to the public internet, verify the current build via the `show ns version` command so remediation can be triaged the moment Citrix publishes affected ranges, and -- absent any published IOCs -- monitor appliances for behavioral indicators of compromise: unexplained log gaps, unfamiliar or unexpected administrative sessions, unusual outbound connections from the appliance, and anomalous activity in crash-dump folders. Per Citrix's standing guidance for suspected NetScaler compromise, responders should also preserve VPX snapshots, remote syslog, tech-support bundles, and core dumps, isolate any suspect appliance, and reset service-account credentials and revoke/reissue certificates and private keys if compromise is suspected. Citrix and watchTowr indicate formal communications, CVE assignment, and patches are expected early in the week of 2026-09-28.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1505.003 Web Shell
- T1136 Create Account
- T1055 Process Injection
- T1055 Process Injection
- T1539 Steal Web Session Cookie
- T1071 Application Layer Protocol
- T1588.005 Exploits
- T1059.006 Command and Scripting Interpreter: Python
- T1037.004 Boot or Logon Initialization Scripts: RC Scripts
- T1053.003 Scheduled Task/Job: Cron
- T1620 Reflective Code Loading
- T1003 OS Credential Dumping
- T1558 Steal or Forge Kerberos Tickets
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1071.001 Application Layer Protocol: Web Protocols
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1583.004 Acquire Infrastructure
- T1059.004 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1210 Exploitation of Remote Services
- T1105 Ingress Tool Transfer
- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1552.004 Unsecured Credentials: Private Keys
- T1033 System Owner/User Discovery
- T1557 Adversary-in-the-Middle
- T1136.001 Local Account
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.002 Clear Linux or Mac System Logs
- T1556 Modify Authentication Process
- T1211 Exploitation for Stealth
- T1132.001 Data Encoding: Standard Encoding
- T1070.004 Indicator Removal: File Deletion
- T1059 Command and Scripting Interpreter
- T1027.010 Command Obfuscation
- T1592.002 Gather Victim Host Information: Software

## Sources

- [Citrix admins warned to shut down NetScalers over 2 exploited zero-days](https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/)
- [Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation](https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html)
- [Citrix NetScaler Zero-Day RCE vulnerabilities: FAQ](https://www.tenable.com/blog/frequently-asked-questions-about-reported-citrix-netscaler-zero-day-vulnerabilities)
- [Citrix NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attacks](https://cybersecuritynews.com/citrix-netscaler-0-day-rce-2/)
- [Citrix NetScaler 2 Zero-Days: No CVE Yet](https://shattered.io/citrix-netscaler-2-zero-days-no-cve-2026/)
- [Unpatched NetScaler Zero-Days Exploited, watchTowr Says](https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html)
- [CISA Known Exploited Vulnerabilities Catalog: CVE-2026-19490](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490)
- [Citrix Security Bulletin CTX696939 (NetScaler ADC/Gateway Authentication Bypass, CVE-2026-19490)](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939)
- [CVE-2026-3055: Citrix NetScaler Memory Overread ("CitrixBleed 3")](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-3055/)
- [CVE-2026-3055 Threatens Citrix NetScaler SAML IDP](https://thecyberexpress.com/cve-2026-3055-citrix-netscaler-saml-idp/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2703