# CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog

> CISA added CVE-2026-88771 (unauthenticated arbitrary command execution via improper input validation) and CVE-2026-88772 (memory-overflow RCE/DoS on DTLS-enabled VPN virtual servers) to its Known Exploited Vulnerabilities catalog on 2026-09-27, both CVSS v4.0 9.5, after Citrix confirmed active exploitation on unmitigated NetScaler ADC and Gateway appliances. This is the third round of emergency NetScaler patches since June 2026, and the fixed builds for August's CVE-2026-19490 remain vulnerable to both new flaws.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-10-09T23:37:24.821Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2711
- **ID:** TL-2026-2711
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 123 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-88771, CVE-2026-88772, CVE-2025-5777, CVE-2026-88779, CVE-2026-19490

## Description

On 2026-09-26, security research firm watchTowr disclosed that it had identified two previously unknown NetScaler ADC and NetScaler Gateway remote-code-execution zero-days during forensic investigations, and several managed-service providers privately advised customers to take NetScaler appliances offline before any public advisory existed. On 2026-09-27, Citrix (Cloud Software Group) confirmed the findings, publishing security bulletin CTX697096 and stating plainly that 'exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.' CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog the same day and invoked Binding Operational Directive (BOD) 26-04, requiring Federal Civilian Executive Branch agencies to prioritize rapid remediation on publicly exposed assets.

CVE-2026-88771 (CWE-20, Improper Input Validation) is an unauthenticated, network-exploitable flaw (CVSS v4.0 9.5, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) that lets a remote, unauthenticated attacker execute arbitrary commands on the appliance. Citrix and multiple outlets emphasize that every NetScaler ADC and NetScaler Gateway deployment is affected, including default configurations with no optional feature enabled -- meaning configuration hardening cannot substitute for patching, and no workaround exists.

CVE-2026-88772 (CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer) is a memory-overflow flaw (CVSS v4.0 9.5, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reachable only when DTLS is enabled on a virtual server -- a setting on by default for VPN virtual servers on NetScaler Gateway -- and capable of producing remote code execution (described by reporting as able to 'inject shellcode directly into memory') or denial of service.

Both flaws affect NetScaler ADC and NetScaler Gateway builds before 14.1-73.37 and before 13.1-64.23, plus the FIPS/NDcPP variants before 14.1-73.37 FIPS and 13.1.37.279 FIPS/NDcPP. Citrix's CTX697096 bulletin patches six additional, non-exploited CVEs in the same release (CVE-2026-88773 HTTP request smuggling CVSS 9.3, CVE-2026-88774 policy-expression bypass CVSS 7.0, CVE-2026-88775/88776/88777 memory-overflow variants CVSS 8.8 each, and CVE-2026-88778 TCP ISN prediction CVSS 8.8), none of which Citrix has stated are under active exploitation. Notably, the builds that fixed August 2026's CVE-2026-19490 authentication bypass (14.1-73.32 and 13.1-63.21) remain fully vulnerable to both CVE-2026-88771 and CVE-2026-88772, meaning organizations that patched for the prior incident are still exposed.

No file hashes, IP addresses, domains, or other network indicators of compromise for this specific exploitation campaign have been publicly released by Citrix, watchTowr, or any reporting outlet as of this writing; Citrix states only that generic (non-specific) indicator checks are available through the NetScaler Console Security Advisory workflow (available from Console version 14.1-73.36 with Cloud Connect), explicitly cautioning that these checks 'cannot cover every attacker technique and may miss compromises.' No threat actor or campaign has been attributed to the exploitation.

This marks the third wave of actively exploited NetScaler zero-days disclosed in roughly three months: CTX696604 (2026-06-30) fixed six CVEs including CVE-2026-8451, a pre-authentication SAML-IdP memory overread described as 'CitrixBleed-style' because it can leak live session cookies (MITRE ATT&CK T1539, Steal Web Session Cookie), which was exploited within roughly two days of disclosure; CTX696939 (2026-08-19) fixed CVE-2026-19490 (authentication bypass, CVSS v4.0 9.3, letting an unauthenticated attacker circumvent authentication on NetScaler appliances configured as an SSL VPN/ICA Proxy/CVPN/RDP Proxy Gateway or an AAA virtual server) and CVE-2026-19489 (memory overflow, CVSS v4.0 8.8, reachable only when SIP ALG is enabled on a Large Scale NAT group), with CVE-2026-19490 added to the CISA KEV catalog on 2026-09-09; and now CTX697096 (2026-09-27) fixes CVE-2026-88771 and CVE-2026-88772. Citrix NetScaler ADC and Gateway appliances function as internet-facing VPN gateways, ICA proxies, AAA authentication servers, and application delivery controllers across enterprise and government networks, making each disclosure a high-value, broadly exposed target for opportunistic internet-scale exploitation.

Security-vendor technical breakdowns of CTX697096 (strix.ai) specify the exact configuration heuristic for CVE-2026-88772 exposure: any `add vpn vserver` or `add lb vserver` built with the DTLS service type, or a VPN vserver where the `-dtls` parameter is not explicitly set to `OFF`, is vulnerable -- and because DTLS defaults to enabled on VPN vservers, the large majority of Gateway deployments meet this condition with no explicit administrator action. Separately, Citrix's own CTX697096 remediation guidance is explicit that patching alone is insufficient for hosts exploited before the fix shipped: upgrading 'does not remove persistence or other artifacts left by attackers,' and Citrix directs defenders to review authentication and network-activity logs, hunt for unexpected files, processes, and configuration changes, monitor for unauthorized outbound connections, and deploy File Integrity Monitoring. That guidance -- consistent with watchTowr's own framing that exploitation of an internet-facing NetScaler appliance 'can create a strong foothold for lateral movement and credential theft' -- indicates attackers who exploited CVE-2026-88771/CVE-2026-88772 pre-patch are expected to have gone beyond initial command execution to drop tooling on the appliance (T1105, Ingress Tool Transfer) and establish outbound command-and-control channels (T1071, Application Layer Protocol) rather than exploiting and immediately withdrawing.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1046 Network Service Discovery
- T1620 Reflective Code Loading
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1539 Steal Web Session Cookie
- T1071 Application Layer Protocol
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1210 Exploitation of Remote Services
- T1078 Valid Accounts
- T1499 Endpoint Denial of Service
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505.003 Server Software Component: Web Shell
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1036.005 Masquerading: Match Legitimate Name or Location
- T1027 Obfuscated Files or Information
- T1070.004 Indicator Removal: File Deletion
- T1562.001 Impair Defenses: Disable or Modify Tools
- T1212 Exploitation for Credential Access
- T1071.001 Application Layer Protocol: Web Protocols
- T1132.001 Data Encoding: Standard Encoding
- T1059.006 Command and Scripting Interpreter: Python
- T1140 Deobfuscate/Decode Files or Information
- T1070.002 Indicator Removal: Clear Linux or Mac System Logs
- T1090.001 Proxy: Internal Proxy
- T1529 System Shutdown/Reboot
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1070 Indicator Removal
- T1071.004 Application Layer Protocol: DNS
- T1041 Exfiltration Over C2 Channel
- T1572 Protocol Tunneling
- T1036.008 Masquerading: Masquerade File Type
- T1552.001 Unsecured Credentials: Credentials In Files
- T1592.002 Gather Victim Host Information: Software

## Sources

- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778 (CTX697096)](https://support.citrix.com/external/article/CTX697096)
- [NVD - CVE-2026-88771 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-88771)
- [NVD - CVE-2026-88772 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-88772)
- [Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation](https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html)
- [Citrix Confirms NetScaler 0-Day RCE Vulnerabilities Actively Exploited in Attack](https://cybersecuritynews.com/citrix-confirms-netscaler-0-day/)
- [Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day](https://securityaffairs.com/199873/security/citrix-confirmed-two-new-netscaler-flaws-exploited-as-zero-day.html)
- [Security researchers warn: New zero-day exploits in Citrix Netscaler](https://www.heise.de/en/news/Security-researchers-warn-New-zero-day-exploits-in-Citrix-Netscaler-11467269.html)
- [Unpatched NetScaler Zero-Days Exploited, watchTowr Says](https://www.cyberkendra.com/2026/09/netscaler-shutdown-warning-unverified-rce-flaws.html)
- [Citrix Patches Two Exploited NetScaler RCE Zero-Days](https://www.cyberkendra.com/2026/09/cve-2026-88771-netscaler-zero-days-exploited.html)
- [CVE-2026-88771: ADC Input Validation Flaw (CVSS 9.5)](https://www.strix.ai/cve/CVE-2026-88771)
- [Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)](https://www.helpnetsecurity.com/2026/08/21/citrix-netscaler-gateway-cve-2026-19490/)
- [NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474 (CTX696604)](https://support.citrix.com/external/article/CTX696604/netscaler-adc-and-netscaler-gateway-secu.html)
- [CVE-2026-8451: Citrix NetScaler SAML Memory Overread Under Active Exploitation](https://www.crowdsec.net/vulntracking-report/cve-2026-8451-citrix-netscaler-saml-memory-overread)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2711