citrix

Citrix NetScaler Zero-Days: Preserve the Evidence, Then Patch

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share
A Ghibli-style illustration of two cartoon robots in a misty green forest clearing, with no visible held shield.
Two cartoon robots in a misty green forest clearing, standing in for the defensive patching work that follows the compromise check.

Two of the eight vulnerabilities Citrix disclosed for NetScaler ADC and NetScaler Gateway on September 27, 2026 are already in the wild. CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog that same day, after receiving reports and partner threat intelligence that confirmed active global exploitation. The federal remediation deadline is September 30, 2026. If you run NetScaler, this is the part of the bulletin that matters for operations.

What the two KEV-listed flaws do

CVE-2026-88771 is an unauthenticated remote code execution flaw caused by improper input validation (CWE-20). Citrix rates it 9.5 under CVSS v4.0, and the vendor notes it works on default configuration with no additional feature required. That combination, unauthenticated plus default-on, is the one you patch first.

CVE-2026-88772 is a memory overflow (CWE-119) that can lead to remote code execution or denial of service, also rated 9.5 by the vendor. Its precondition is a DTLS configuration, and Citrix says that configuration is enabled by default on VPN vServer. If you run a VPN vServer and have not explicitly checked the DTLS setting, assume you are exposed.

Both NVD records, published September 27, 2026, carry the vendor-assigned CVSS v4.0 score as a secondary value. NVD did not publish an independent primary score, so treat 9.5 as Citrix's number, not NIST's.

Version boundaries you can actually check

The affected and fixed versions, per the Citrix bulletin and matching NVD "before" strings:

  • 14.1: affected before 14.1-73.37, fixed in 14.1-73.37 and later
  • 13.1: affected before 13.1-64.23, fixed in 13.1-64.23 and later
  • ADC FIPS: affected before 14.1-73.37 FIPS
  • ADC FIPS/NDcPP: affected before 13.1.37.279

Run your inventory against those strings. If your fleet reports a build number at or above the fixed version, you have remediated the vulnerable versions for these two CVEs. That does not mean you are clear of prior compromise: if an unpatched window existed before you upgraded, the fix stops the flaw but does not tell you whether it was already used. Confirming that requires the IOC check in the next section.

The order of operations matters

Citrix published indicators of compromise and guidance to check for compromise before you patch, because the update may destroy forensic visibility. The practical sequence:

  1. Snapshot or preserve relevant logs and memory state on exposed appliances before applying the update.
  2. Work through Citrix's IOC guidance against that preserved state to determine whether you were hit.
  3. Apply the fixed build.

Skipping the check is the common mistake: the patch can erase the evidence you would need to answer the question "were we hit, and when?", and preserving the logs alone does not answer it. Work through the IOC guidance before you patch.

Two additional notes from the bulletin. CVE-2026-88778, one of the six non-KEV CVEs in this disclosure, has a specific TCP configuration change, enhanced ISN generation, as an additional mitigation. And keep your claims precise: only CVE-2026-88771 and CVE-2026-88772 have confirmed exploitation in the sources retrieved. The other six, CVE-2026-88773 through CVE-2026-88778, should not be described as exploited.

Sources

  • CISA alert, "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway" (event date 2026-09-27, page revised 2026-10-02): https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
  • Citrix security bulletin CTX697096 (2026-09-27, severity Critical): https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html
  • NVD record CVE-2026-88771 (published 2026-09-27): https://nvd.nist.gov/vuln/detail/CVE-2026-88771
  • NVD record CVE-2026-88772 (published 2026-09-27): https://nvd.nist.gov/vuln/detail/CVE-2026-88772
  • CISA Known Exploited Vulnerabilities catalog (both CVEs added 2026-09-27, due 2026-09-30): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Transparency note: This article was AI/LLM-assisted. It was drafted with language model support and reviewed by a human before publication. See How we use AI for the full workflow.
Topics:

Read more