Citrix patches two exploited NetScaler RCE flaws; CISA adds both to KEV

What happened

Citrix published security bulletin CTX697096 on 27 September 2026, confirming two critical remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway and releasing fixes for them. They are tracked as CVE-2026-88771 and CVE-2026-88772, and Citrix states that exploitation of both has been observed against unmitigated deployments [2].

The same day, CISA added both CVEs to the Known Exploited Vulnerabilities catalog on the basis of evidence of active exploitation [1]. CISA lists CVE-2026-88771 as an improper input validation issue and CVE-2026-88772 as an improper restriction of operations within the bounds of a memory buffer [1]. For Federal Civilian Executive Branch agencies, Binding Operational Directive 26-04 requires prioritised remediation of KEV-listed flaws on publicly exposed assets where exploitation grants total control of the asset, and sets expectations for checking whether a system was compromised before the patch was applied [1].

The public disclosure followed private warnings that began over the weekend. Administrators reported on Reddit that IT suppliers, law enforcement, CERTs and national agencies were contacting them and advising that NetScaler appliances be shut down, without giving details [2]. Security firm watchTowr then said publicly that it was reacting to credible reports of multiple unpatched NetScaler RCE vulnerabilities circulating in the wild [2]. Citrix’s bulletin arrived the following day [3].

Separately, the Dutch NCSC reportedly sent a pre-notification to organisations in the Netherlands before public disclosure, based on information from a European partner CERT, describing two vulnerabilities that could each independently lead to remote code execution [2]. According to copies shared online, one allowed an attacker to place shellcode directly in memory; the second was still being analysed, and no CVE IDs had been assigned at that point [2]. The notice said Citrix found the flaws while investigating incidents in customer environments and filed a notification under the EU Cyber Resilience Act, and that exploitation had been identified at multiple Citrix customers worldwide — though the agency said it did not know whether the attacks were widespread [2]. NCSC-NL declined to confirm the document to BleepingComputer, citing its constituency [2].

Who is affected

Citrix lists the following as affected [2]:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
• NetScaler ADC FIPS before 14.1-73.37 FIPS
• NetScaler ADC FIPS and NDcPP before 13.1-37.279

One note on that last line: the reporting gives the FIPS/NDcPP build as 13.1-37.279 [2], while the NVD CVE records write it as 13.1.37.279. The two forms almost certainly refer to the same build, but check the exact string in CTX697096 before you match it against what is running in production.

Secure Private Access hybrid deployments that use NetScaler instances are also affected and must be moved to the recommended builds [2]. The bulletin covers customer-managed appliances only; Cloud Software Group is handling upgrades for Citrix-managed cloud services and Citrix-managed Adaptive Authentication [2].

Exposure is broad because of where these devices sit. NetScaler appliances are commonly deployed as internet-facing edge devices providing remote access and application delivery into internal networks, so compromising one can give an attacker a perimeter foothold without first compromising an internal endpoint [2].

How it works

CVE-2026-88771 is an improper input validation flaw that allows an unauthenticated attacker to execute arbitrary commands. Citrix says it affects all NetScaler ADC and Gateway deployments on an affected version, including default configurations, and requires no additional feature to be enabled [2]. Its CVSS v4.0 vector records a network attack vector, low attack complexity, no privileges and no user interaction, with attack requirements present.

CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service. It is exploitable when DTLS is enabled, and Citrix notes DTLS is on by default on VPN virtual servers [2]. Its vector also records a network attack vector, no privileges and no user interaction, but with high attack complexity and no attack requirements.

Both carry a score of 9.5 [2]. The bulletin also fixes six further NetScaler vulnerabilities, for eight in total [2].

The sources do not describe exploitation chains, indicators of compromise, or any attribution, and they do not say whether applying the update removes attacker persistence established before patching. Treat patching and compromise assessment as separate tasks.

What to do

• Upgrade affected NetScaler ADC and NetScaler Gateway appliances to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS or the FIPS/NDcPP 13.1 build listed in CTX697096, as applicable, ahead of routine change windows [2].
• If you cannot patch immediately, reduce internet exposure of the appliance where operations allow, until the update is applied [2].
• Assume pre-patch compromise is possible on any internet-facing appliance that ran an affected build. Review authentication logs, configuration changes, new or modified accounts and outbound connections from the appliance, and preserve evidence before rebuilding.
• Rotate credentials, session tokens and certificates that the appliance handled or stored, and terminate active sessions after upgrading.
• Confirm whether DTLS is enabled on your VPN virtual servers when assessing CVE-2026-88772 exposure; it is on by default there [2].
• Check Secure Private Access hybrid deployments separately — they use NetScaler instances and need the recommended builds [2].
• If you run Citrix-managed cloud services or Adaptive Authentication, confirm the provider-side upgrade status rather than assuming action is needed on your side [2].
• FCEB agencies: apply BOD 26-04 timelines and its pre-patch compromise check requirements for both KEV entries [1].