Citrix says two worrying NetScaler RCE zero-days exploited in attacks

Date:
Mon, 28 Sep 2026 15:10:00 +0000

Description:
The company released a fix and urged organizations to patch up immediately.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Citrix patched two critical zerodays (CVE202688771, CVE202688772) in NetScaler ADC/Gateway, both enabling remote code execution Exploits already observed; CISA added flaws to KEV catalog with a threeday patch deadline (Sept 30) NetScaler appliances are prime targets due to internet exposure, privileged access, and limited monitoring visibility Citrix has released a patch for two critical zero-day vulnerabilities apparently being actively exploited in real-life attacks.

In its weekend security advisory, Citrix said it fixed two bugs: CVE-2026-88771 and CVE-2026-88772. It is now urging organizations to apply
the fix as soon as possible and defend their premises from potentially disruptive attacks. Latest Videos From TechRadar Watch full video here: What Citrix fixed The first issue is an improper input validation vulnerability that allows unauthenticated attackers to execute arbitrary commands remotely. It has a severity score of 9.5/10 (critical). The latter is a buffer overflow/memory-corruption vulnerability in Citrix NetScaler ADC and
NetScaler Gateway which could allow attackers to execute malicious code remotely, or trigger Denial of Service (DoS). This one, too, carries a severity score of 9.5/10 (critical).

Both flaws affect Citrix NetScaler ADC and Citrix NetScaler Gateway: ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23. You may like Cisco hit by max severity zero-day exploit targeting Identity Services Engine, so it's time to patch up Linux users beware CISA flags
three major security issues you need to patch right now Microsoft September 2026 Patch Tuesday fixes nearly a thousand flaws, including two major zero-days

Citrix released patches for the flaws in NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23, as well as the corresponding FIPS builds.

"Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," Citrix said in the security bulletin. Are
you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro
newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. Abused in the wild Citrix has thus confirmed what was being reported on, earlier. According to BleepingComputer , Citrix admins took to Reddit to report IT suppliers and security teams contacting their organizations and recommending they shut down NetScaler appliances.

"We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately," one administrator wrote. Other admins said similar warnings were coming from law enforcement, national cybersecurity agencies, and CERTs. "We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible," security experts watchTowr said in response to the news.

The US Cybersecurity and Infrastructure Security Agency (CISA) also reacted. Both vulnerabilities were added to its catalog of known exploited flaws (KEV) on Sunday, giving Federal Civilian Executive Branch (FCEB) agencies a three-day deadline (until Wednesday, September 30) to patch up. What to read next Hackers are targeting a critical WordPress flaw, so be on your guard Watch out TP-Link Tapo Camera vulnerabilities could let hackers spy inside homes, so patch now Cisco patches three critical vulnerabilities as part of 'comprehensive internal security review'

The Dutch National Cyber Security Center (NCSC-NL) also reacted fast. Even before Citrix publicly disclosed the flaws, the organization allegedly notified organizations in the country about the zero-days. BleepingComputer said multiple people shared copies of the notification online, which said the agency had received information from a European partner CERT regarding two vulnerabilities that could independently lead to remote code execution. Why target NetScaler This is not the first time cybercriminals are targeting NetScaler appliances. They are often in the crosshairs because they are
tasked with providing remote access to internal applications and desktops,
and as such, they are exposed to the internet and can be targeted directly.

That makes any zero-day vulnerabilities in the appliances particularly valuable. Bugs that leak authenticated session tokens, those that allow for authentication bypass, or remote code execution, can provide a foothold
inside an organization, without requiring any interaction on the victim side. From there, threat actors could steal credentials, access internal resources, or move laterally to deploy ransomware.

Edge appliances like the Citrix NetScaler are also attractive because theyre somewhat harder to monitor, compared to other endpoints. Organizations
usually deploy extensive security tools for computers and servers, leaving specialized networking appliances somewhere in the shadows.

This combination of internet exposure, privileged access, and somewhat
limited visibility, makes a serious NetScaler vulnerability particularly attractive to both state-sponsored actors, and profit-oriented groups.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/citrix-says-two-worrying-netscaler-rce- zero-days-exploited-in-attacks


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)