Skip to content
  • There are no suggestions because the search field is empty.

2026-09-28: Cybercriminals exploit two critical vulnerabilities in Citrix NetScaler remote access devices

Citrix released urgent updates for NetScaler ADC and NetScaler Gateway on 27 September 2026. Many organizations use these devices to give employees remote access and to spread traffic across their applications. CVE-2026-88771 and CVE-2026-88772 both carry a 9.5 out of 10 (Critical) CVSS score, and Citrix confirms cybercriminals are already exploiting them against unpatched devices.

Read Citrix's security bulletin (external link).

How the vulnerabilities work

NetScaler sits at the front door of a company network. Remote logins and much of the company's web traffic pass through it before reaching anything inside.

CVE-2026-88771 is an input validation vulnerability. The device doesn't properly check the data it receives, so a cybercriminal can hide commands inside an ordinary-looking request and the device runs them. According to Citrix, every NetScaler ADC and NetScaler Gateway deployment is affected, including devices in their default configuration. No login is required.

CVE-2026-88772 is a memory overflow, a bug where the device writes more data into a block of memory than it can hold, spilling into neighboring memory. It sits in Datagram Transport Layer Security (DTLS), the protocol that encrypts fast virtual private network (VPN) traffic such as voice and video calls. DTLS is switched on by default on NetScaler Gateway VPN servers. Citrix rates this attack as harder to carry out, but it also requires no login.

Why this is dangerous

Citrix states that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed." A cybercriminal that succeeds can run commands on the device. That gives them a foothold at the edge of the network, where they can intercept logins, steal credentials, and move into internal systems.

CVE-2026-88772 can also crash the device and cut off remote access for the whole organization. No group has been publicly linked to the attacks.

Affected software

The vulnerabilities affect these supported, customer-managed versions:

  • NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
  • NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.279

          FIPS and NDcPP are editions certified for government use. Secure Private Access hybrid deployments that use NetScaler instances are also affected. Citrix updates its own cloud-managed services and Adaptive Authentication itself, so customers of those services don't need to act.

          For CVE-2026-88772, a NetScaler Gateway is vulnerable unless an administrator explicitly turned DTLS off. Other virtual servers are vulnerable only if they're configured to use DTLS.

          Mitigation & next steps

          Citrix urges customers to install version 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 FIPS and NDcPP, or later, as soon as possible. Its bulletin, CTX697096, offers no other fix for these two vulnerabilities.

          CISA added both vulnerabilities to its KEV Catalog on 27 September 2026. It ordered federal agencies to act by 30 September 2026 and to run forensic checks since a device may have been compromised before it was patched. Citrix has published indicators of compromise, the traces an attack leaves behind, along with a guide for devices suspected of compromise (CTX694799).

          Holm Security’s response

          Holm Security has released a test to scan for these vulnerabilities:

          • HID-2-1-5402500 - Citrix NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX697096)

            Scan for specific vulnerabilities

            Read how you can include or exclude a specific vulnerability in a scan profile here.