Citrix says two worrying NetScaler RCE zero-days exploited in attacks

Citrix patched two critical zero‑days (CVE‑2026‑88771, CVE‑2026‑88772) in NetScaler ADC/Gateway, both enabling remote code execution Exploits already observed; CISA added flaws to KEV catalog with a three‑day patch deadline (Sept 30) NetScaler appliances are prime targets due to internet exposure, p

<![CDATA[ <article> <ul><li><strong>Citrix patched two critical zero‑days (CVE‑2026‑88771, CVE‑2026‑88772) in NetScaler ADC/Gateway, both enabling remote code execution</strong></li><li><strong>Exploits already observed; CISA added flaws to KEV catalog with a three‑day patch deadline (Sept 30)</strong></li><li><strong>NetScaler appliances are prime targets due to internet exposure, privileged access, and limited monitoring visibility</strong></li></ul><p>Citrix has released a patch for two critical zero-day vulnerabilities apparently being actively exploited in real-life attacks. </p><p>In its weekend security advisory, Citrix said it fixed two bugs: CVE-2026-88771 and CVE-2026-88772.</p><p>It is now urging organizations to apply the fix as soon as possible and defend their premises from potentially disruptive attacks.</p><h2 id="what-citrix-fixed">What Citrix fixed</h2><p>The first issue is an improper input validation vulnerability that allows unauthenticated attackers to execute arbitrary commands remotely. It has a severity score of 9.5/10 (critical). The latter is a buffer overflow/memory-corruption vulnerability in Citrix NetScaler ADC and NetScaler Gateway which could allow attackers to execute malicious code remotely, or trigger Denial of Service (DoS). This one, too, carries a severity score of 9.5/10 (critical). </p><p>Both flaws affect Citrix NetScaler ADC and Citrix NetScaler Gateway: ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway before 14.1-73.37 and before 13.1-64.23.</p><p>Citrix released patches for the flaws in NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23, as well as the corresponding FIPS builds.</p><p>"Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," Citrix said in the security bulletin.</p><h2 id="abused-in-the-wild">Abused in the wild</h2><p>Citrix has thus confirmed what was being reported on, earlier. According to <em>BleepingComputer</em>, Citrix admins took to Reddit to report IT suppliers and security teams contacting their organizations and recommending they shut down NetScaler appliances.</p><p>"We got a call from our IT supplier's security team, they couldn't give any details but they advised to shut our Netscalers down immediately," one administrator wrote. Other admins said similar warnings were coming from law enforcement, national cybersecurity agencies, and CERTs. "We are currently rapidly reacting to rumors that multiple unpatched Citrix NetScaler RCE vulnerabilities are circulating in the wild. While details are scarce, the information is credible," security experts watchTowr said in response to the news.</p><p>The US Cybersecurity and Infrastructure Security Agency (CISA) also reacted. Both vulnerabilities were added to its catalog of known exploited flaws (KEV) on Sunday, giving Federal Civilian Executive Branch (FCEB) agencies a three-day deadline (until Wednesday, September 30) to patch up.</p><p>The Dutch National Cyber Security Center (NCSC-NL) also reacted fast. Even before Citrix publicly disclosed the flaws, the organization allegedly notified organizations in the country about the zero-days. <em>BleepingComputer</em> said “multiple people shared copies of the notification online, which said the agency had received information from a European partner CERT regarding two vulnerabilities that could independently lead to remote code execution.”</p><h2 id="why-target-netscaler">Why target NetScaler</h2><p>This is not the first time cybercriminals are targeting NetScaler appliances. They are often in the crosshairs because they are tasked with providing remote access to internal applications and desktops, and as such, they are exposed to the internet and can be targeted directly. </p><p>That makes any <a href="https://www.techradar.com/best/best-malware-removal" target="_blank">zero-day vulnerabilities</a> in the appliances particularly valuable. Bugs that leak authenticated session tokens, those that allow for authentication bypass, or remote code execution, can provide a foothold inside an organization, without requiring any interaction on the victim side. From there, threat actors could steal credentials, access internal resources, or move laterally to deploy ransomware. </p><p>Edge appliances like the Citrix NetScaler are also attractive because they’re somewhat harder to monitor, compared to other endpoints. Organizations usually deploy extensive security tools for computers and servers, leaving specialized networking appliances somewhere in the shadows. </p><p>This combination of internet exposure, privileged access, and somewhat limited visibility, makes a serious NetScaler vulnerability particularly attractive to both state-sponsored actors, and profit-oriented groups. </p><p><em>Via </em><a href="https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/" target="_blank"><em>BleepingComputer</em></a></p> </article> ]]>