Citrix Patches Two NetScaler Zero-Days Already Used for Weeks

Citrix released patches on Sunday 27 September 2026 for eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, and confirmed that two of them had already been exploited. The company's security bulletin states that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." Attackers used them to plant webshells.

The US Cybersecurity and Infrastructure Security Agency added both to its Known Exploited Vulnerabilities catalogue the same day and ordered federal civilian agencies to fix them by Wednesday 30 September and to perform forensic triage for evidence of compromise. "CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally," the agency said.

Two different doors into the same appliance

NetScaler ADC handles application traffic and application firewalling. NetScaler Gateway is the remote access and VPN product that external users connect through to reach internal networks. The two exploited flaws can be used independently of one another, and Palo Alto Networks' Unit 42 gives both a CVSS v4.0 base score of 9.5.

• CVE-2026-88771 stems from improper input validation and lets a remote, unauthenticated attacker run arbitrary commands against a device in its default configuration, with no user interaction required.
• CVE-2026-88772 is a memory overflow that can produce remote code execution or denial of service, but only where DTLS is configured, which it is by default on virtual VPN servers.

The Dutch National Cyber Security Centre put the consequence of the first one plainly on 27 September: "This vulnerability gives attackers full control of the gateway, providing direct access to the internal corporate network behind it." NCSC-NL advised organisations to back up device memory and log files covering at least the previous month before installing the updates.

Patching is where this starts, not where it ends

Security researcher Kevin Beaumont, writing on Mastodon and quoted by Help Net Security, says European government sources spent the week warning organisations and that the attacks have been unfolding all month. "Probably nation state aligned as well resourced, espionage rather than teens," he wrote. He added that the webshells are unique to each box and that the attackers ran anti-forensic commands to delete artefacts, and that the detection script Citrix provides through the NetScaler Console only works if the logs on an affected device have not rotated since the attack. Given the timeline, on many devices they will have.

Citrix itself has conceded the limits of what it published, saying that because threat actors change tactics and infrastructure frequently the indicators of compromise it supplied "might fail to identify actual compromises," and advising customers to retain experienced forensic investigators. Unit 42 makes the same point more bluntly in its 28 September brief: updating and patching will not remove access for an attacker that has already established persistence.

The scale is genuinely unknown. Satnam Narang, senior staff research engineer at Tenable, said that "based on public reporting, it has not been determined whether exploitation has reached widespread scale," and that no details about the threat actors have been made public. He noted that across seven years of activity against Citrix NetScaler, roughly two-thirds involved advanced persistent threat groups and one-third ransomware operators and their affiliates. The honest reading is that the three-day CISA deadline is not really about patching, which takes an afternoon, but about forcing agencies to look for intruders who have had a month of quiet access and cleaned up after themselves.