Citrix NetScaler: two critical zero-days (CVE-2026-88771 and 88772) exploited worldwide

What happened

On September 27, 2026, Citrix published bulletin CTX697096 covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway (CVE-2026-88771 to CVE-2026-88778). Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited as zero-days, and CISA added them to the KEV catalog the same day. According to CISA, both are critical and each can independently enable remote code execution, with exploitation confirmed "globally".

Reported technical details

According to Threadlinqs, citing Google Threat Intelligence Group and Mandiant:

• CVE-2026-88772: a pre-authentication heap overflow in NSPPE's DTLS handling (UDP/443) leading to code execution as root.
• CVE-2026-88771: improper input validation (CWE-20) in a log-processing script that concatenates names from logs into shell commands.
• Post-exploitation included Apache configuration persistence, the WHIPSHOT web shell and the SLAPSHOT tunneler.
• Exploitation dates back at least to early September (GovInfoSecurity reports activity since August).

Both score 9.5 on CVSS 4.0.

Fixed versions

Upgrade to 14.1-73.37 or later, or 13.1-64.23 or later. Note: new flaws in October (CVE-2026-88779 and CVE-2026-107406) require even newer builds; we cover them in a separate article.

What to do now

1. Inventory every internet-facing NetScaler and confirm its build.
2. Because exploitation predates the patch, hunt for compromise (web shells, new accounts, Apache changes) even after upgrading.
3. Follow Citrix guidance for suspected cases and treat any evidence as an incident.

Sources

• CISA — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
• Threadlinqs — Active Exploitation of Citrix NetScaler ADC (TL-2026-3189)
• GovInfoSecurity — Citrix Patches Yet Another Under-Fire Zero-Day in NetScaler