CISA Warns of Hackers Exploiting Two Citrix NetScaler 0-Days to Execute Code Remotely

Threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, allowing them to execute code remotely on exposed systems.

The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, received a CVSS v4 severity score of 9.5 out of 10 and have been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.

CISA confirmed that it received reports and partner intelligence showing global exploitation activity. Citrix released emergency updates after confirming that exploitation had occurred against unpatched, customer-managed NetScaler deployments. The affected products are often placed at the network edge to provide application delivery, load balancing, VPN access, and secure remote access.

That position makes a compromised appliance highly valuable to threat actors because it can sit between internet users and internal company systems.

CVE-2026-88771 is an improper input validation issue that can allow an unauthenticated remote attacker to run arbitrary commands on a vulnerable NetScaler ADC or Gateway.

It affects all vulnerable deployments, including devices using the default configuration. No optional feature needs to be enabled for the flaw to be reachable, making it the broader of the two issues. Citrix said the vulnerability has a low attack complexity rating, meaning a threat actor does not need an account or user interaction to begin exploitation.

The second flaw, CVE-2026-88772, is a memory overflow vulnerability that can lead to remote code execution or denial-of-service conditions. Unlike CVE-2026-88771, this issue requires Datagram Transport Layer Security, or DTLS, to be enabled.

DTLS is enabled by default on NetScaler VPN virtual servers unless administrators have explicitly turned it off. This makes remote-access deployments a key area for security teams to review.

Citrix has provided configuration checks that can help administrators determine whether DTLS is active on a NetScaler virtual server. Both zero-days were disclosed on September 27, 2026, alongside six other NetScaler flaws. Citrix confirmed that attackers were already exploiting the two remote code execution issues before it made fixes public.

CISA Warns of Two Citrix NetScaler 0-Days

Security teams should treat the release as an active incident response matter rather than a routine patching task. Cyber Security News previously reported on Citrix’s confirmation of the two NetScaler zero-days, including the risks facing internet-exposed ADC and Gateway appliances.

The vendor’s security bulletin lists NetScaler ADC and Gateway 14.1 releases before 14.1-73.37 and 13.1 releases before 13.1-64.23 as vulnerable. NetScaler ADC 14.1-FIPS builds before 14.1-73.37 FIPS and 13.1-FIPS or NDcPP builds before 13.1-37.279 are also affected.

Secure Private Access Hybrid customers using vulnerable NetScaler instances must upgrade those instances as well. Citrix-managed cloud services are not covered by this bulletin because Cloud Software Group applies updates to those services directly.

Administrators should identify every customer-managed NetScaler ADC and Gateway system, especially appliances reachable from the public internet, and upgrade to the fixed releases as soon as operationally possible.

Citrix recommends 14.1-73.37 or later for the 14.1 branch and 13.1-64.23 or later for the 13.1 branch. FIPS and NDcPP deployments need their matching patched releases. Organizations should also check whether CVE-2026-88772 applies by reviewing DTLS-enabled VPN and other virtual server settings.

According to CISA, patching alone may not remove the risk where a device was already compromised. CISA has advised organizations to look for signs of compromise before applying updates and to send NetScaler logs to a central SIEM or log-retention platform, since local appliance logs can rotate quickly and overwrite evidence. CISA also published a Sigma detection rule resource to support threat hunting for suspicious NetScaler activity.

Where compromise is suspected, organizations should first preserve evidence, including system snapshots, support bundles, memory data where appropriate, and remote syslog records.

Citrix advises isolating the affected appliance, changing credentials and stored secrets, revoking certificates and private keys, investigating connected systems, and rebuilding from a known-good backup that predates the suspected compromise.

Restored passwords, key-encryption keys, and SSL certificates should then be rotated. The situation has expanded beyond the initial two flaws. CISA updated its alert on October 9 to include CVE-2026-107406 and to stress prompt updates for CVE-2026-88771 through CVE-2026-88779.

CVE-2026-88779, a separate actively exploited SAML-related NetScaler issue, can cause denial of service and may be used to force a reboot that helps execute code previously injected through exploitation of CVE-2026-88771.

Cyber Security News also covered the actively exploited NetScaler SAML zero-day, which requires affected organizations to apply a newer set of NetScaler updates.

For defenders, the immediate priority is clear: patch exposed NetScaler systems, preserve logs before making major changes, review authentication and administrative activity, and assume that a vulnerable internet-facing device may have been probed or compromised.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post CISA Warns of Hackers Exploiting Two Citrix NetScaler 0-Days to Execute Code Remotely appeared first on Cyber Security News.