Citrix NetScaler zero-days were exploited before fixes shipped

By September 28, 2026, Citrix had confirmed that two critical remote code execution vulnerabilities in NetScaler ADC and Gateway were exploited before patches were public. CVE-2026-88771, an improper input validation bug, affects all deployments with no extra feature required. CVE-2026-88772 is a memory overflow that affects appliances with DTLS enabled, which is the default for VPN virtual servers. Both carry CVSS severity scores of 9.5.

The September zero-days came after two other NetScaler flaws drew attention earlier in 2026. Citrix patched CVE-2026-8452, a heap-based overflow in the SAML authentication flow, on June 30, 2026. WatchTowr Labs published a full technical writeup on August 14, and at the time of Arctic Wolf's post, no in-the-wild exploitation was confirmed, but the public exploit chain raised the probability of abuse.

On August 19, Citrix released fixes for CVE-2026-19490, an authentication bypass with a CVSS score of 9.3. Field Effect's blog post on September 4 said that threat actors had begun targeting that flaw after public proof-of-concept exploit code appeared early in September.

For the current pair, security firm watchTowr warned on September 26. It said on X that it was reacting to credible rumors of multiple unpatched NetScaler remote code execution vulnerabilities. That same day, an administrator on Reddit's r/Citrix wrote that a supplier's security team advised shutting down NetScalers immediately, and others in the thread said their organizations had done the same.

The Dutch National Cyber Security Centre circulated an amber advisory before Citrix's public disclosure. The Stack reported that a since-deleted version of the advisory said the flaws were discovered during investigations at customer environments and exploitation had been identified at multiple Citrix customers worldwide.

Citrix issued its bulletin on September 27 and said, "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." It did not say how widely the flaws had been exploited, by whom, or since when. The bulletin also fixed six other vulnerabilities that Citrix did not list as exploited, including HTTP request smuggling, a policy bypass, several memory overflows, and a TCP Initial Sequence Number prediction flaw.

CISA added the two exploited flaws to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until Wednesday, September 30, to patch them. The agency said it has received reports and partner threat intelligence confirming that threat actors are actively exploiting the vulnerabilities globally, and that forensic triage will be needed at any agency using the products.

For defenders, Citrix's guidance on suspected compromise says to preserve evidence first, including a VPX snapshot, logs, a technical support bundle, and a core dump of the packet engine. Administrators should then isolate the appliance, change service account passwords and secrets, reset passwords for users who authenticated through it, and revoke certificates and private keys. Citrix also says to investigate connected systems such as authentication servers and management jump hosts, and to rebuild MPX appliances. The company has made indicators of compromise available through NetScaler Console.