Two Citrix NetScaler Zero-Days Exploited Before Patches Existed — Patch and Check for Compromise Now
❓What:
Attackers are exploiting two critical flaws in Citrix NetScaler ADC and NetScaler Gateway, and both were exploited before a patch existed. thenextweb
CVE-2026-88771 lets an attacker run commands without logging in and affects all NetScaler ADC and Gateway deployments, including the default setup. thenextweb
CVE-2026-88772 is a memory overflow that can lead to remote code execution or a crash; it requires DTLS, which is enabled by default on VPN servers. thenextweb
Both flaws carry CVSS 4.0 scores of 9.5. bankinfosecurity
CISA added both to its KEV catalog Sunday, the same day Citrix parent Cloud Software Group published patches for eight NetScaler ADC and Gateway flaws. bankinfosecurity
watchTowr raised the alarm Saturday, a day before Citrix's disclosure, saying incident responders found the flaws while investigating breaches. GreyNoise reports exploitation attempts were first detected on Thursday. bankinfosecurityyahoo
Citrix has not said who is behind the attacks. thenextweb
⚠️Impact:
NetScaler devices give staff remote access to internal networks, so a compromised appliance is a direct path into the environment. thenextweb
Any appliance running an unpatched version can be hit, even if administrators never changed factory settings. bankinfosecurity
Because exploitation predated the fix, installing the update will not show whether an attacker got in first. thehackernews
Citrix has not disclosed how long the flaws were exploited before its bulletin. cisoplatform
The six other patched flaws, CVE-2026-88773 through CVE-2026-88778, range from CVSS 7.0 to 9.3 and have no confirmed exploitation. cisoplatform
💡Recommendations:
Check for signs of compromise before patching, since updates can erase forensic evidence. Citrix provides generic IoCs through NetScaler Console. thenextwebsecurityaffairs
Upgrade to NetScaler ADC and Gateway 14.1-73.37 or later, or 13.1-64.23 or later. securityaffairs
Plan off 13.1: that branch reached End of Maintenance on September 15. thehackernews
Patch the six additional flaws in the same cycle.
Don't treat "patched" as "clean." If compromise is suspected, follow Citrix's incident guidance in bulletin CTX697096.
Read the full story HERE