Affected Systems

Citrix NetScaler ADC and NetScaler Gateway versions prior to 14.1-73.37, 13.1-64.23, and corresponding FIPS/NDcPP releases. CVE-2026-88771 affects all deployments including default configurations. CVE-2026-88772 affects appliances with DTLS enabled (default for VPN virtual servers). Customer-managed appliances and Secure Private Access Hybrid deployments are affected; Citrix-managed cloud services are patched by vendor.

Exploitation Status

Active exploitation confirmed by Citrix on September 27, 2026. Both CVE-2026-88771 and CVE-2026-88772 were exploited as zero-days before patches were released. Scope, attribution, and timeline of exploitation unknown. No indicators of compromise published. Forensic investigations detected the flaws during incident response.

Business Impact

NetScaler ADC and Gateway appliances sit at the enterprise network edge, handling VPN, remote access, load balancing, and authentication. Successful exploitation grants unauthenticated remote code execution, enabling full appliance compromise, credential theft, lateral movement, and persistent access. CVE-2026-88771 requires no special configuration, making every unpatched deployment vulnerable. Patching does not confirm whether prior compromise occurred. Organizations may need to assume breach and perform full incident response including credential rotation and certificate revocation.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade all NetScaler ADC and Gateway appliances to patched versions: 14.1-73.37, 13.1-64.23, or corresponding FIPS/NDcPP releases (13.1-37.279). No workarounds available.
  • Assume potential compromise on all previously unpatched appliances. Preserve forensic evidence: VPX snapshots, remote syslog and NetScaler Console logs, technical support bundles, and packet engine core dumps before patching.
  • After patching, rotate all service account passwords and secrets stored on NetScaler appliances, reset passwords for users who authenticated through them, and revoke certificates and private keys.
  • Run Netherlands NCSC NetScaler compromise detection scripts (from 2025 guidance) on live appliances, core dumps, and full images to identify indicators of prior exploitation.
  • Ensure NetScaler management interfaces are not exposed to the public internet. Isolate any appliances showing signs of compromise and conduct full incident response.