Citrix NetScaler Zero-Days CVE-2026-88771/88772: Patch Now

Updated October 2, 2026: an earlier version of this story said Citrix had issued no advisory, no CVE numbers and no fix. That was wrong. Citrix published CVE-2026-88771 and CVE-2026-88772 with fixed builds in security bulletin CTX697096 on September 27, shortly before this story went up, and CISA added both to its Known Exploited Vulnerabilities catalog the same day. The guidance below is corrected: patch now, then hunt.

If you run a Citrix NetScaler ADC or NetScaler Gateway that faces the internet, patch it today. Security firm watchTowr said on September 26 that two remote code execution flaws in the appliances were being exploited in the wild before any fix existed. On Sunday, September 27, Citrix published bulletin CTX697096 with fixes, and the two flaws CISA listed as exploited that day, CVE-2026-88771 and CVE-2026-88772, appear to be the pair watchTowr flagged.

RelatedF5 BIG-IP and Check Point Zero-Days: What to Patch First

The fixed releases are NetScaler ADC and NetScaler Gateway 14.1-73.37 and 13.1-64.23, plus the matching FIPS and NDcPP builds of ADC listed in the bulletin. Anything older is affected. CISA gave federal agencies until September 30 to act, and its KEV entry also calls for forensic triage, not just the update.

What do we actually know about the two zero-days?

More than we did on Friday, and it is worth being precise about the sourcing. watchTowr, whose researchers have taken apart several earlier NetScaler bugs, posted on X on September 26 that there are two vulnerabilities, both remote code execution, both unpatched at that point, both exploited before any fix existed, and both found during forensic investigations of compromised customer environments. The firm called the rumors that had been circulating among administrators credible. It also said one of the flaws lets an attacker place shellcode directly into memory.

BleepingComputer reports that the Dutch NCSC received word from a European partner CERT and that exploitation has been seen at multiple Citrix customers worldwide. The Dutch warning went out as a pre-notification under restricted TLP handling rather than a public advisory, which is why most admins first heard about it secondhand. On the r/Citrix subreddit, posts from September 25 describe IT suppliers telling customers there was no fix yet and to shut the appliances down.

The CVE records Citrix filed on September 27 fill in the rest. CVE-2026-88771 is an improper input validation flaw (CWE-20) that lets an unauthenticated attacker execute arbitrary commands. CVE-2026-88772 is a memory overflow (CWE-119) that can lead to remote code execution or denial of service, which fits watchTowr's description of shellcode placed directly into memory. Citrix scores both 9.5 under CVSS 4.0. The same bulletin covers six more CVEs, CVE-2026-88773 through CVE-2026-88778, which CISA has not listed as exploited. CISA's KEV entries point to indicators of compromise that can be run in the NetScaler console and to Citrix's guide for appliances suspected of compromise.

Is this the same bug Citrix already patched in August?

No, and this is the most common misreading so far. Citrix fixed an authentication bypass, CVE-2026-19490, in bulletin CTX696939 on August 19, and CISA added it to the Known Exploited Vulnerabilities catalog on September 9. watchTowr said explicitly that the new activity involves different vulnerabilities. If you patched for 19490 last month, that does not protect you here.

It is also not the SAML heap overflow we covered in August, CVE-2026-8452, which was patched in June and then used to drop web shells two months later. Nor is it the CVE-2026-8451 memory leak from July that drew CitrixBleed comparisons. Count them and this is the fourth serious NetScaler emergency of the year.

Why is patching not enough on its own?

Because these flaws were exploited before the fix existed, so an appliance that is patched today may already have been compromised. For a short window the only advice anyone could give was "shut it down". Now there is something to install, and it should go on first. A NetScaler Gateway sits at the edge on purpose. It is the thing remote workers log into, so it has to accept connections from anywhere, and a pre-authentication code execution bug in that position hands an attacker a foothold on a device that usually holds session state, credentials in transit and a trusted route into the internal network.

So the order of operations is patch, then reduce exposure, then hunt. The exposure advice comes from the Dutch NCSC notice, watchTowr and the coverage that followed; the patch and triage steps come from Citrix and CISA:

RelatedCisco Email Gateway Root Bug Exploited, CISA Gives 3 Days

• Upgrade now to NetScaler ADC or Gateway 14.1-73.37 or 13.1-64.23 or later, or the FIPS and NDcPP builds listed in CTX697096.
• If you cannot patch immediately, take internet-facing appliances offline or restrict inbound TCP 443 to known corporate or partner IP ranges until you can.
• Never expose the management interface to the internet, and disable VPN virtual servers you are not actually using.
• Hunt as well as patch. Run the indicators of compromise Citrix provides in the NetScaler console, follow its guidance for appliances suspected of compromise, and look for unexpected processes, crash dumps and new files in the appliance's web directories. Exploitation was found through forensics, so some victims were compromised before anyone knew to look.

That last point is the one people skip. A patch closes the door. It does nothing about someone already inside, and with 8452 the web shells outlived the fix by weeks.

Who is most exposed?

Any organization whose remote access still depends on an internet-facing NetScaler Gateway, which in practice means a lot of governments, hospitals and mid-sized enterprises that standardized on Citrix years ago. The Netherlands has been here before. The Dutch NCSC told organizations to switch Citrix gateways off in January 2020 during the CVE-2019-19781 attacks, and Dutch organizations were hit again through CVE-2025-6543 last year. A regional CERT reaching for the same instruction again tells you how seriously they rate this.

Patching an edge appliance means a maintenance window, which is exactly why some teams will be tempted to schedule it for later. That is a bet that nobody has scanned your appliance yet, and for exposed NetScalers that bet has been losing for most of the year.

Our take

The unusual thing here is not that NetScaler has another critical bug. It is that the warning reached admins through Reddit threads and a restricted CERT notice before the vendor said a word publicly. For a device whose entire job is to sit on the internet, that gap is a long time. If you run one, install the CTX697096 fix now, cut exposure while you do, then go looking for anything that already got in. Keep hunting after the update, because a patch has never evicted anyone.

Original analysis by GenZTech. Corrected October 2, 2026: the original version said Citrix had not published an advisory; it had, in CTX697096, shortly before publication.