Article
NetScaler exposed edge: questions to ask your team
What a NetScaler ADC or Gateway owner does first: list appliances, check for compromise before patching, and keep management services off the internet.
Read more
Significant cyber incident
Citrix NetScaler zero-day exploitation
On 27 September 2026 Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of them critical zero-days already being exploited.
In short
On 27 September 2026 Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of them critical zero-days already being exploited. Government agencies in the US, UK and Canada say attackers are using them against customer-managed appliances. The flaws allow remote code execution, and CISA and the Canadian Cyber Centre warn that patching alone may not remove access if an appliance was already compromised.
What happened
On 27 September 2026 Citrix published a security bulletin for eight NetScaler ADC and Gateway vulnerabilities. Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited. CISA added both to its Known Exploited Vulnerabilities catalog.
CISA says it received reports and partner intelligence confirming global exploitation. The Canadian Cyber Centre says exploitation was seen across several customer environments worldwide, but the full extent is unknown.
On 2 October 2026 Citrix published guidance on a separate SAML-related denial-of-service issue. CISA later listed a further NetScaler flaw, CVE-2026-88779, on 4 October 2026.
Timeline
-
2026-09-27
Citrix publishes its security bulletin and blog for CVE-2026-88771 to CVE-2026-88778.
-
2026-09-27
CVE-2026-88771 and CVE-2026-88772 are published as CVE records and added to the CISA KEV catalog.
-
2026-09-27
CISA and the Canadian Cyber Centre (AL26-024) issue alerts naming active exploitation.
-
2026-09-28
NCSC UK publishes its alert and says two of the eight CVEs are confirmed as exploited.
-
2026-09-30
KEV due date for CVE-2026-88771 and CVE-2026-88772.
-
2026-10-02
CISA updates its alert with a SIGMA detection rule resource.
-
2026-10-02
Citrix publishes guidance on a SAML-related denial-of-service issue.
-
2026-10-03
The Cyber Centre updates AL26-024 with the SAML issue and a warning about persistence.
-
2026-10-04
CISA adds CVE-2026-88779, a NetScaler denial-of-service flaw, to the KEV catalog.
How the attack worked
The two exploited flaws
CVE-2026-88771 is an improper input validation flaw. An unauthenticated attacker over the network can run arbitrary commands. NVD scores it 9.8 (critical).
CVE-2026-88772 is a memory buffer overflow that can lead to remote code execution or denial of service. NVD scores it 8.1 (high), with high attack complexity.
Affected products
Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23 are affected, plus FIPS and NDcPP builds. The other six CVEs cover request smuggling, a policy bypass, memory overflows and a predictable value flaw.
What attackers can do
The Cyber Centre says exploitation of CVE-2026-88771 could mean full appliance compromise, credential theft, lateral movement and further compromise of internal systems. It also says persistence may remain after patching. Public sources do not describe the exact exploit chain or tools used.
Who says who was behind it
No public attribution. CISA, NCSC UK and the Canadian Cyber Centre refer to "threat actors" without naming a group as of 9 October 2026.
Impact
CISA says threat actors are actively exploiting the flaws globally. The Canadian Cyber Centre says exploitation was observed across multiple customer environments worldwide, and that the full extent is unknown. NCSC UK says it is still working to understand the effect on UK organizations. No victim names, counts or data loss figures are given in the sources.
Government and regulator response
- 27 September 2026: Citrix published a bulletin and a blog with indicators of compromise; CISA added CVE-2026-88771 and CVE-2026-88772 to the KEV catalog with a 30 September due date and a forensic triage requirement.
- 27 September 2026: The Canadian Cyber Centre issued alert AL26-024. Updated 3 October 2026.
- 28 September 2026: NCSC UK urged isolating and replacing affected systems where possible, checking for compromise with the IoCs, then installing updates.
- 2 October 2026: CISA added a SIGMA detection rule resource to its alert. Citrix published SAML guidance.
- Citrix guidance for suspected compromise: take the device off the network, change stored secrets, revoke certificates, rebuild, and monitor for at least 90 days.
Lessons
-
Edge devices are prime targets
The exploited flaws sit in appliances that face the internet and hold credentials, so one weakness can reach internal systems.
-
Patching is not cleanup
The Cyber Centre warns that persistence may remain after updates, so a patched appliance may still be compromised.
-
Collect evidence first
CISA and the Cyber Centre both say to preserve forensic evidence before updating or rebooting.
-
Fixes can lag exploitation
The Cyber Centre notes suspicious activity may predate the release of vendor fixes, so look back in time.
-
Management ports stay private
Citrix says NetScaler Management Services should never be exposed to the public internet.
-
Stored secrets need rotation
Citrix guidance says passwords, service accounts, certificates and keys held on a suspect device should be changed or revoked.
What to check in your own organization
-
Find every NetScaler
List all customer-managed NetScaler ADC and Gateway appliances, including FIPS builds, and their versions.
-
Compare versions
Check each against 14.1-73.37 and 13.1-64.23 (and the FIPS and NDcPP builds named in the Citrix bulletin).
-
Run the IOC check
Use the NetScaler Console indicators of compromise tool before patching, as CISA and NCSC UK advise.
-
Preserve evidence
Keep logs, remote syslog and support bundles before you reboot or patch.
-
Look for persistence
Review startup scripts, scheduled tasks, web directories and crash dumps, as the Cyber Centre suggests.
-
Rotate secrets
If an appliance is suspect, change service account passwords, revoke certificates and keys, and review connected systems.
-
Early warning
Threat intelligence monitoring could help by flagging new vulnerability alerts and KEV additions for products you run, and by showing exposed credentials that might follow an edge-device compromise. No outcome is promised.
Questions
Which Citrix NetScaler flaws are exploited?
CVE-2026-88771 and CVE-2026-88772, according to CISA, NCSC UK and the Canadian Cyber Centre.
How many vulnerabilities did Citrix disclose?
Eight, CVE-2026-88771 to CVE-2026-88778, on 27 September 2026.
Who is affected?
Organizations running customer-managed NetScaler ADC or Gateway builds before the fixed versions, such as 14.1-73.37 and 13.1-64.23.
Is patching enough?
Not always. The Cyber Centre says persistence may remain on appliances already compromised, so run the IOC check and follow Citrix guidance.
Who is behind the attacks?
No public attribution as of 9 October 2026.
Are there later NetScaler issues?
Yes. Citrix published SAML-related guidance on 2 October, and CISA listed CVE-2026-88779 (denial of service) on 4 October 2026.
In our research
Sources
- Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway CISA
- Exploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway NCSC UK
- AL26-024 Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772 Canadian Centre for Cyber Security
- Steps to Take if NetScaler ADC is Suspected to be Compromised (CTX694799) Cloud Software Group (Citrix)
- NVD record CVE-2026-88771 NIST NVD
- NVD record CVE-2026-88772 NIST NVD
- CVE record CVE-2026-88771 CVE Program
- Known Exploited Vulnerabilities Catalog (JSON feed) CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.