Citrix has confirmed that two of the eight NetScaler vulnerabilities disclosed in its September 2026 security bulletin are being actively exploited as zero-days, and the U.S. Cybersecurity and Infrastructure Security Agency moved fast in response. CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026, giving federal civilian agencies until September 30, 2026 to apply Citrix’s fix, according to reporting from SecurityWeek and Infosecurity Magazine. Both bugs carry a CVSS score of 9.5, and one of them lets an unauthenticated attacker run arbitrary commands on a default configuration.
For anyone running NetScaler at the edge of a corporate network, the timeline is the headline: Help Net Security reports the flaws were reportedly exploited in the wild for weeks before Citrix and CISA went public. That gap between silent exploitation and public disclosure is exactly what turns a patch-Tuesday footnote into a genuine incident-response scramble, and it’s why “Citrix NetScaler zero-day” spiked as a search term the same week CISA’s catalog update landed.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Citrix confirmed about the active exploitation
Citrix’s own security bulletin, tracked as CTX697096, lays out the affected builds and does not mince words about severity. SecurityWeek reported that Citrix confirmed exploitation of both vulnerabilities, a step vendors typically avoid unless the evidence is unambiguous. Infosecurity Magazine and The Hacker News carried the same confirmation on September 28, 2026, and BleepingComputer flagged the same-day coverage across multiple security outlets as a sign of how seriously the industry is treating this one.
What’s notably absent from the public record so far is a named discoverer. Unlike disclosures that come with a researcher or firm attached — the kind of writeup that doubles as a marketing moment for a security shop — this one reads more like an incident Citrix had to get ahead of after seeing exploitation in its own telemetry or customer reports. No specific victim organizations have been named in the reporting reviewed here, and no sector-specific targeting pattern has been confirmed. That’s consistent with how NetScaler compromises tend to surface: quietly, appliance by appliance, until enough incident responders compare notes.
Inside CVE-2026-88771: unauthenticated command execution
CVE-2026-88771 is the more dangerous of the pair on paper, because it doesn’t require a username, a password, or an active session. It’s described as an improper input-validation flaw that lets a remote, unauthenticated attacker execute arbitrary commands on a vulnerable NetScaler ADC or NetScaler Gateway instance. Reporting indicates it affects deployments running in their default configuration, meaning an organization doesn’t need to have flipped some obscure setting to be exposed. If the appliance is internet-facing and unpatched, it’s a target.
That default-configuration detail matters more than it might sound. A lot of high-severity CVEs turn out to require a specific feature to be enabled, which narrows the blast radius considerably. CVE-2026-88771 doesn’t offer that mercy, which is likely part of why CISA moved it into KEV within a day of the public disclosure rather than waiting for a fuller picture of exploitation.
Inside CVE-2026-88772: a DTLS memory-safety bug
The second flaw, CVE-2026-88772, is a memory-safety issue: an improper restriction of operations within the bounds of a memory buffer. Depending on exploitation conditions, it can be used for remote code execution or to knock an appliance offline with a denial-of-service condition. The catch that separates it from CVE-2026-88771 is that it requires DTLS to be enabled. On paper that sounds like a narrower attack surface, but DTLS is reported to be enabled by default on VPN virtual servers in NetScaler Gateway deployments — which is precisely the configuration most organizations use it for. In practice, the “requires a setting” caveat protects almost no one who’s using NetScaler Gateway the way it’s designed to be used.
Together, the two bugs cover both of the classic edge-appliance attack paths: one gets an attacker in the door with no credentials at all, and the other gives them a memory-corruption primitive to escalate or disrupt once they’re poking at the service. That combination is what tends to produce the kind of “exploited for weeks before disclosure” timeline Help Net Security described.
Affected versions and what Citrix has fixed
Citrix’s bulletin identifies four supported release lines as affected, each with a specific build that resolves the issue. SecurityWeek reports the September 2026 advisory actually spans eight distinct flaw types in total — including remote code execution, HTTP request smuggling, denial-of-service, and authentication-bypass issues — though CVE-2026-88771 and CVE-2026-88772 remain the only two confirmed to have been exploited as zero-days. Anything on an earlier build than the fixed version listed below remains vulnerable.
| Product / release line | Affected (before) | Fixed build |
|---|---|---|
| NetScaler ADC and Gateway 14.1 | 14.1-73.37 | 14.1-73.37 or later |
| NetScaler ADC and Gateway 13.1 | 13.1-64.23 | 13.1-64.23 or later |
| NetScaler ADC FIPS 14.1 | 14.1-73.37 FIPS | 14.1-73.37 FIPS or later |
| NetScaler ADC FIPS and NDcPP 13.1 | 13.1-37.279 | 13.1-37.279 or later |
Citrix’s bulletin doesn’t clarify whether every discontinued or end-of-life NetScaler branch received a backport, so any team still running an older, unsupported line should treat that appliance as permanently exposed rather than wait for a fix that may not be coming. If you’re not certain which build you’re on, that’s the first thing to check, ahead of anything else in this article.
CISA’s KEV listing and the September 30 deadline
CISA added both CVEs to the Known Exploited Vulnerabilities catalog on September 27, 2026. Under Binding Operational Directive 26-04, federal civilian executive branch agencies are required to remediate KEV-listed flaws by the deadline CISA sets, and reporting puts that deadline at September 30, 2026 for this pair — a three-day window that’s short even by KEV standards, and a strong signal of how CISA is weighing active-exploitation evidence against patch availability.
KEV deadlines are binding only on federal agencies, not private companies, but they function as an informal industry clock all the same. Security teams at banks, hospitals, and retailers routinely treat a KEV addition as the trigger to move a patch from “scheduled maintenance window” to “patch tonight.” The SharePoint CVE-2026-65660 disclosure earlier this year followed the same pattern: a KEV listing turned a routine advisory into an emergency change ticket across thousands of IT departments within days.
Why NetScaler keeps ending up on this list
NetScaler ADC and Gateway sit at the edge of the network by design — they’re the appliances that terminate VPN connections, handle load balancing, and broker access between the public internet and internal applications. That’s exactly the position ransomware crews and state-linked intrusion sets have prized for years, because compromising the appliance often means bypassing every other layer of network segmentation in one move. Edge devices like NetScaler, Ivanti Connect Secure, Fortinet FortiOS, and Cisco’s ISE platform have all had high-severity, actively-exploited flaws surface in the past two years, and the pattern is consistent: internet-facing, high-privilege, and rarely patched on the day a fix ships.
Reporting on this specific incident doesn’t establish a full history of prior NetScaler campaigns with named CVEs and years attached, so it’s worth being precise about what’s confirmed here versus what’s pattern-matching from the broader edge-device category. What is confirmed is that Citrix has, again, had to issue an emergency bulletin for internet-facing infrastructure with a CVSS score north of 9. That alone places NetScaler in the same conversation as the Cisco ISE zero-day patched earlier in 2026 and the WSO2 API flaw that was under active exploitation for nearly two weeks before it reached KEV.
How this compares with 2026’s other edge-device emergencies
2026 has not been a quiet year for perimeter infrastructure. Between record-breaking Patch Tuesday releases and a steady drumbeat of KEV additions for gateway, VPN, and identity appliances, security teams have had little room to breathe. The table below lines up this month’s NetScaler disclosure against other major 2026 edge and infrastructure vulnerabilities already covered on this site, to give a sense of where it sits on severity and urgency.
| Vulnerability | CVSS | Auth required? | KEV deadline |
|---|---|---|---|
| Citrix NetScaler (CVE-2026-88771) | 9.5 | No | Sept. 30, 2026 (3 days) |
| Citrix NetScaler (CVE-2026-88772) | 9.5 | No (DTLS-enabled deployments) | Sept. 30, 2026 (3 days) |
| Cisco ISE zero-day | 10.0 | No | Set at time of KEV listing |
| WSO2 API flaw | 10.0 | No | Added ~12 days after exploitation began |
| Microsoft SharePoint (CVE-2026-65660) | Not fully disclosed | Varies | Set at time of KEV listing |
The pattern across all of these: a top-of-scale CVSS score, no authentication requirement, and a KEV deadline measured in days rather than weeks. What sets the NetScaler pair apart slightly is the confirmed multi-week exploitation window before public disclosure, per Help Net Security’s reporting — a longer head start for attackers than some of the other entries in this table appear to have had.
Who’s exposed: the scale of NetScaler’s footprint
NetScaler ADC and Gateway are common infrastructure across large enterprises, universities, healthcare systems, and government networks, precisely the kind of internet-facing, application-delivery role that makes a successful exploit consequential well beyond a single compromised box. There’s now a number to attach to that footprint: scanning by Shadowserver identified more than 20,000 internet-facing NetScaler instances still running vulnerable builds as of September 2026, according to Cybersecurity Dive. No named victim organizations have surfaced yet in outlet coverage, so any claim pointing to a specific breached company should still be treated skeptically until CISA, Citrix, or a named research firm confirms it — but the Shadowserver count makes clear the exposed footprint is substantial.
What is reported: administrators at multiple organizations have taken systems offline as a precaution while patching, according to accounts cited by SecurityWeek. That’s the same defensive posture seen during prior edge-appliance emergencies — take the box down, patch, bring it back, then hunt for signs of prior compromise, because “patched” and “not previously compromised” are two different questions.
The business and market angle
Citrix’s parent company, Cloud Software Group, does not trade on public markets, so there’s no stock ticker for investors to watch the way there would be for a listed security vendor caught in a similar bind. That doesn’t mean there’s no financial exposure — it just moves the cost off a public balance sheet and onto customers’ incident-response budgets, cyber-insurance premiums, and the hours their IT teams spend patching on a three-day federal clock. For managed service providers and IT consultancies that run NetScaler for client environments, this is the kind of event that turns into unplanned billable hours fast, the same dynamic covered in this site’s look at what managed SOC services actually do during an incident like this one.
There’s also a compliance angle. Organizations subject to frameworks that reference the KEV catalog — and a growing number of state and sector-specific rules do — now have a concrete deadline attached to this pair of CVEs even if they’re not a federal agency themselves. Auditors increasingly ask whether a company was patched by the KEV due date, not just whether it’s patched now.
How NetScaler stacks up against rival remote-access platforms
NetScaler competes with Ivanti Connect Secure, Fortinet FortiGate/FortiOS, Cisco’s ASA and ISE lines, and increasingly with cloud-delivered zero-trust access brokers that don’t require an on-premises appliance at all. Every one of the appliance-based options in that list has had at least one critical, actively-exploited CVE in the past two years, which is turning into a genuine argument for the zero-trust vendors: no exposed management plane to exploit in the first place, because there’s no appliance sitting on the public internet.
That’s not a knock on NetScaler specifically so much as an observation about the category. Organizations that centralize identity and access through platforms like Keycloak alongside a cloud access broker, rather than routing everything through a single internet-facing VPN concentrator, tend to have a smaller blast radius when a flaw like this surfaces. That’s part of the case laid out in this site’s Keycloak SSO setup guide — reducing how much trust sits on one box at the network edge.
What security teams should do right now
The immediate playbook is straightforward, even if executing it under a three-day KEV deadline is not. First, identify every NetScaler ADC and Gateway instance in the environment and check its build number against the fixed versions in Citrix’s CTX697096 bulletin. Second, patch internet-facing instances first, since that’s where CVE-2026-88771’s unauthenticated path applies most directly. Third, for any NetScaler Gateway deployment using DTLS-enabled VPN virtual servers — which is most of them by default — treat CVE-2026-88772 as equally urgent rather than assuming it’s a lower priority because it “requires a setting.”
Because Help Net Security’s reporting indicates weeks of exploitation before disclosure, patching alone isn’t sufficient. Security teams should also review authentication logs, unexpected configuration changes, and outbound connections from NetScaler management interfaces for the weeks prior to the patch, not just from the day the CVEs became public. An appliance that’s patched today but was quietly compromised three weeks ago is still a compromised network.
# Quick build-version check on NetScaler CLI
show ns version
# Compare output against fixed builds:
# 14.1-73.37 or later
# 13.1-64.23 or later
# 14.1-73.37 FIPS or later
# 13.1-37.279 or laterPredictions: where this goes from here
A few things are likely to play out over the next few weeks — and one of them has already happened. First, expect follow-on reporting to name at least some affected sectors or organizations once incident responders and threat-intel firms compare notes publicly, even though none have been confirmed in the reporting reviewed for this article. Second, expect proof-of-concept exploit code for at least CVE-2026-88771 to circulate within days to a couple of weeks of the KEV listing, following the pattern set by prior unauthenticated-RCE edge-device flaws. Third, cyber-insurance underwriters will likely start asking policyholders directly about NetScaler patch status on renewal applications, the same way they now routinely ask about Ivanti and Fortinet exposure. The expectation that this wouldn’t be a one-time event proved true almost immediately: in October 2026, Citrix patched yet another zero-day, CVE-2026-88779, shipping the fix in build 14.1-73.41, according to BleepingComputer.
Fourth, this incident will almost certainly get cited in the next round of zero-trust-architecture sales pitches aimed at CISOs who are tired of patching internet-facing VPN concentrators under three-day federal deadlines. And fifth, given how quickly Citrix moved from confirmed exploitation to a full bulletin with fixed builds across four release lines, expect other vendors with similar edge appliances to face pressure to match that response speed the next time a comparable flaw surfaces — the bar for acceptable patch turnaround keeps dropping industry-wide.
The bigger picture: edge appliances remain the soft underbelly
Strip away the specific CVE numbers and this is a familiar story: a piece of infrastructure built to sit at the boundary between the public internet and a private network turns out to be reachable by an attacker with no credentials at all. It happened with SharePoint, it happened with WSO2’s API management platform, it happened with Cisco’s ISE, and now it’s happened again with NetScaler. The record-setting September Patch Tuesday earlier this month, which fixed 966 vulnerabilities including 20 rated wormable, is a reminder of just how much attack surface enterprises are managing simultaneously — and why a single unauthenticated-RCE bug in an edge appliance can jump the queue ahead of everything else on a security team’s list.
The organizations that come out of this cleanly won’t be the ones with the fanciest detection tooling. They’ll be the ones that already knew, without having to scramble to find out, exactly which build number every NetScaler box in their environment was running the morning this story broke.
Frequently asked questions
What is CVE-2026-88771?
It’s a critical, CVSS 9.5-rated improper input-validation flaw in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated remote attacker execute arbitrary commands on a default configuration, according to Citrix’s security bulletin and reporting from Infosecurity Magazine and The Hacker News.
What is CVE-2026-88772?
It’s a CVSS 9.5 memory-safety flaw involving improper bounds checking on a buffer, which can lead to remote code execution or denial of service on NetScaler deployments where DTLS is enabled — the default state for VPN virtual servers in NetScaler Gateway, per reporting from Help Net Security and The Hacker News.
When do federal agencies have to patch?
CISA added both CVEs to its Known Exploited Vulnerabilities catalog on September 27, 2026, with a remediation deadline of September 30, 2026 for federal civilian executive branch agencies under Binding Operational Directive 26-04, according to reporting cited by SecurityWeek and Infosecurity Magazine.
Which NetScaler versions are affected?
NetScaler ADC and Gateway 14.1 before build 14.1-73.37, 13.1 before build 13.1-64.23, plus the FIPS and NDcPP variants of those release lines, are affected according to Citrix’s bulletin CTX697096. Builds at or above those version numbers include the fix.
Has anyone confirmed being breached through these flaws?
Citrix has confirmed exploitation of both vulnerabilities, per SecurityWeek, and Help Net Security reports exploitation occurred globally for weeks before public disclosure. However, no specific victim organizations have been named in the reporting reviewed for this article, so any claim naming a particular breached company should be treated as unconfirmed until a named source verifies it.
Is a non-federal, private-sector organization required to patch by September 30?
No. The KEV deadline under BOD 26-04 is legally binding only on federal civilian executive branch agencies. Private companies aren’t obligated to meet it, but many security teams and compliance frameworks treat a KEV listing as the trigger for emergency patching regardless of sector.
Does disabling DTLS protect against CVE-2026-88772?
Reporting indicates the flaw requires DTLS to be enabled, and DTLS is on by default for VPN virtual servers in NetScaler Gateway. Disabling it where not strictly needed would narrow exposure to that specific CVE, but Citrix’s guidance is to apply the fixed build rather than rely on configuration workarounds, since the bulletin doesn’t detail a validated mitigation path independent of patching.
How does this compare to the Cisco ISE and WSO2 zero-days from earlier in 2026?
All three sit in the same category: unauthenticated, top-of-scale CVSS scores, and edge or identity infrastructure that’s internet-facing by design. The Cisco ISE and WSO2 flaws each carried a maximum CVSS of 10.0, slightly above NetScaler’s 9.5, but the NetScaler pair appears to have had a longer pre-disclosure exploitation window based on current reporting.
