Affected Systems

Citrix NetScaler ADC and NetScaler Gateway devices. Specific vulnerable versions not disclosed in advisory. Cortex Xpanse telemetry identifies 50,277 exposed instances potentially vulnerable as of Sept. 27, 2026.

Exploitation Status

Active exploitation confirmed in the wild. Both CVE-2026-88771 and CVE-2026-88772 are zero-day vulnerabilities exploited before patches were available. No specific TTPs or indicators of compromise publicly disclosed yet.

Business Impact

Critical risk for organizations running NetScaler ADC or Gateway. CVE-2026-88771 allows unauthenticated remote code execution via improper input validation. CVE-2026-88772 is a memory overflow leading to RCE or DoS in DTLS configurations. Both rated CVSS v4.0 9.5. Over 50,000 potentially vulnerable instances exposed to internet. Attackers may establish persistence that survives patching.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately identify all NetScaler ADC and Gateway instances using Citrix Security Advisory precondition checks for CVE-2026-88771 and CVE-2026-88772
  • Isolate vulnerable NetScaler systems from network and preserve forensic evidence: VPX snapshots, syslog data, technical support bundles, and packet engine core dumps
  • Hunt for indicators of compromise: suspicious administrative sessions, unexpected outbound connections, and unexplained logging gaps on NetScaler devices
  • Apply Citrix patches to latest versions immediately per vendor security bulletin (note: patching does not remove existing attacker persistence)
  • Monitor NetScaler Console and SIEM for post-patch anomalies; engage incident response if compromise suspected