Citrix Races Out Patches for Two NetScaler Zero-Days
Citrix has shipped fixes for two critical NetScaler zero-day vulnerabilities that were already being exploited in the wild, ending a chaotic weekend for administrators who were told by vendors and CERT teams to shut their appliances down without explanation.
The advisory covers eight flaws affecting NetScaler ADC and NetScaler Gateway, ranging from remote code execution and HTTP request smuggling to denial of service and authentication bypass. The two zero-days flagged as exploited are CVE-2026-88771 and CVE-2026-88772, both rated at 9.5 on the CVSS scale.
CVE-2026-88771 is an unauthenticated remote code execution flaw that affects all NetScaler ADC and Gateway deployments, including those running in the default configuration. That means a default install is not safe from a remote attacker who never touches valid credentials.
CVE-2026-88772 is a memory overflow that can also lead to remote code execution or a denial of service. It hits appliances with DTLS configuration enabled, which is the default setting on VPN virtual servers.
How Defenders Found Out
NetScaler admins started posting on Reddit over the weekend saying their IT suppliers, CERT teams, and MDR providers had told them to power down appliances immediately, often without saying why. Some warnings traced back to a private pre-notification from the Dutch National Cyber Security Centre (NCSC-NL), distributed under TLP:AMBER restrictions.
According to a copy posted in the Reddit thread, NCSC-NL learned of the two zero-days from a European partner CERT and said exploitation had been identified at multiple Citrix customers worldwide. Several admins took their NetScalers offline. Others said they had received no official notice at all.
That information gap is the part worth remembering. A patch released on a weekend is only useful if the people running the appliance hear about it.
Citrix published indicators of compromise alongside the patches, and the company confirmed the two CVEs as exploited on its community blog.
The Numbers Behind the Threat
Palo Alto Networks Unit 42 counted 50,277 exposed NetScaler instances that could potentially be vulnerable based on Cortex Xpanse telemetry as of September 27, 2026. Those instances are not confirmed compromised, but they are reachable from the internet, which is enough to keep incident responders busy.
Unit 42 tracked the actors back to fingerprinting activity on August 21, 2026, from IP addresses 104.248.244.66 and 77.83.199.39. The earliest requests probed a US-based organization's NetScaler Gateway with a commonly requested CSS file path, /admin_ui/common/css/ns/ui.css, a quiet way to confirm a target is running the product.
The attackers then used two distinct web shell techniques. One approach exploited the DTLS path to drop .deb web shell files. The other used a three-stage command injection chain that dropped PHP web shells, giving persistent access into the network.
CISA added both CVEs to its Known Exploited Vulnerabilities catalog and issued an alert warning that threat actors are actively exploiting the flaws globally. The agency urged users and administrators to review Citrix's advisories and to check for indicators of compromise before patching, since cleaning a compromised box matters more than closing the hole.
What the Patches Cover and Who Must Act
Citrix's bulletin covers CVE-2026-88771 through CVE-2026-88778, a batch of eight flaws in the same ADC and Gateway product line. The full list includes remote code execution, HTTP request smuggling, denial of service, and security bypass issues.
The wider CVSS severe advisory matters because opportunistic attackers do not stop at the two named zero-days. Once the research is public, scanning for every unpatched instance of the family begins, and the 50,277 exposed appliances Unit 42 catalogued are the obvious targets.
Administrators running NetScaler ADC and Gateway should apply the updates, check their appliances for the published indicators of compromise, and rotate any credentials that touched those systems. CISA's KEV catalog already contains more than a dozen Citrix NetScaler vulnerabilities, including recently added CVE-2026-19490 and CVE-2026-8452.
See our related coverage of critical network flaws in our cybersecurity section for more on edge-device exposure.
Why This Keeps Happening
NetScaler sits at the edge of corporate networks, terminating VPN sessions and load-balancing traffic for applications behind it. That makes it an attractive first hop for attackers who want persistent access without planting malware on a thousand endpoints.
This is not Citrix's first entry in the KEV catalog this year, and the pattern repeats across edge appliances from several vendors. The infrastructure that most companies rely on as a trusted front door is also the most rewarding target for anyone probing the internet.
Unit 42 said its analysis of post-disclosure changes is ongoing and that activity after September 27 might not match the original indicators, since defenders, researchers, and scanning tools now share the same public exploit knowledge. That means a clean appliance check today is not proof it was clean last week.
What Happens Next
The honest answer is that patching closes the hole but not the question of who got in before it was closed. Security teams should assume at least some of the 50,277 exposed instances were touched, run the compromise checks Citrix published, and threat-hunt for the web shell filenames and IP addresses Unit 42 released.
CISA's KEV entry sets an implied timeline for federal agencies, and private-sector firms that run NetScaler should treat the same window as relevant even without a formal deadline. The risk here is not theoretical. Attackers were inside customer environments for weeks before the first advisory.
For more on how vulnerability disclosures translate into real-world exposure, read Reuters coverage of major breaches.
NetScaler administrators who need to confirm their posture can pull Unit 42's full threat brief for the compromise indicators before re-enabling access.
Unit 42's figure of 50,277 instances comes from Cortex Xpanse, which continuously maps internet-facing assets. The number counts every potentially vulnerable endpoint the scanner could see, not confirmed infections, and it does not include systems hidden behind internal proxies or load balancers that defenders often forget about.
That distinction matters for prioritization. An organization should inventory every NetScaler appliance it owns, including lab and disaster-recovery units that may not show in standard production asset lists. Forgotten nodes are exactly where patient attackers leave a foothold to return later.
Citrix published the indicator list so that defenders can check before patching, and CISA echoed that advice. Checking first costs time that overstretched teams rarely have, but patching over an active compromise simply locks the attacker inside behind a fixed front door. Security practitioners have seen this play out before with other edge devices, where patches arrived only after attackers had already worked the field. The NetScaler case is one more entry in that book.
The difference this time is speed of disclosure. From first fingerprinting on August 21 to public advisories on September 28, the window of hidden exposure ran about five weeks. That is a short runway for defenders who depend on vendor notice, and it is a long one for the attackers who knew.