Citrix NetScaler Zero-Day exploitation: What enterprise teams need to know

Citrix confirms two critical NetScaler zero-days are being exploited. Both score 9.5, while one affects default configurations and requires urgent enterprise patching.

Citrix confirms active NetScaler ADC and Gateway zero-day exploitation, and recommends affected customers install the relevant security updates as soon as possible. The two critical vulnerabilities are already being exploited on unmitigated deployments.

Citrix confirmed that there is an active zero-day attack against customer-managed NetScaler ADC and NetScaler Gateway appliances, bringing enterprise infrastructure security to the forefront of the urgent challenges. Citrix released security bulletin CTX697096 on September 27, 2026, which covers eight vulnerabilities, including two critical ones: Remote Code Execution (RCE) vulnerabilities CVE-2026-88771 and CVE-2026-88772. They both have a maximum CVSS v4 severity score of 9.5.

The United States Cybersecurity and Infrastructure Security Agency (CISA) confirmed the exploitation and placed both vulnerabilities in its Known Exploited Vulnerabilities (KEV) list.

Why these NetScaler Zero-Days need immediate attention

Both vulnerabilities can be exploited by unauthenticated attackers to execute arbitrary commands remotely on affected, unmitigated devices, although the specific preconditions differ between the two flaws.

CVE-2026-88771 (CVSS 9.5): Due to improper input validation, this Citrix NetScaler vulnerability can allow an unauthenticated attacker to execute arbitrary commands. It impacts NetScaler ADC or Gateway deployments running a vulnerable software build, and no special features or non-default configurations are required to be enabled.

CVE-2026-88772 (CVSS 9.5): This is a Datagram Transport Layer Security (DTLS)-related memory overflow condition that can lead to Remote Code Execution or Denial of Service (DoS). Since DTLS is enabled by default on VPN virtual servers, affected VPN gateway deployments can meet the vulnerability's precondition unless DTLS is explicitly disabled.

There were also six other vulnerabilities, CVE-2026-88773 to CVE-2026-88778, that were fixed in the same patch release. They include HTTP request smuggling, memory-overflow vulnerabilities, a policy bypass and TCP sequence-number prediction.

Why Indian enterprise networks need immediate action

NetScaler sits at the enterprise network edge and is used for load balancing, VPN and remote access, and user authentication. For large IT services exporters, financial institutions and global capability centres (GCCs) in India, remote access infrastructure is a critical asset, making internet-facing NetScaler appliances an important part of the enterprise security perimeter.

These Citrix NetScaler zero-days are particularly important because CVE-2026-88771 does not require authentication or an additional feature to be enabled on affected builds. A compromised edge appliance can provide an attacker with access to a network's perimeter, which is why security teams need to assess whether an affected appliance was exposed before it was patched.

The forensic trap: Patching vs. compromise assessment

One of the typical pitfalls that enterprise security teams encounter when responding to a disclosure is patching the vulnerability without first checking for signs of compromise. Since these NetScaler vulnerabilities were exploited before the fixes were available, security teams need to consider whether an attacker gained access before the patch was deployed.

Forensic analysts and cybersecurity experts stress the importance of a two-step triage process:

Preserve and Audit: Conduct compromise assessments and preserve relevant system logs and forensic evidence before rebooting or updating where possible. NCSC-NL has advised saving relevant logs and a memory dump before installing the update.

Apply Verified Upgrades: Upgrade affected instances to the fixed versions as soon as possible, such as 14.1-73.37 or later and 13.1-64.23 or later. Citrix says there is no workaround for the two exploited vulnerabilities and urges affected customers to install the relevant updated versions as soon as possible.

Which NetScaler versions are affected?

Citrix says the bulletin applies to customer-managed NetScaler ADC and NetScaler Gateway. Citrix-managed cloud services are updated separately by Cloud Software Group.

What Indian CIOs and security teams should do now

Indian enterprises using customer-managed NetScaler appliances should first identify whether they have affected builds exposed to the internet. Security teams should preserve relevant forensic evidence where compromise is suspected, check for indicators of compromise and then move to the fixed build.

Citrix says an IOC scanning capability is available through NetScaler Console version 14.1-73.36 or later, with telemetry enabled. However, Citrix warns that the listed indicators do not cover every possible exploitation technique, so a clean IOC result should not automatically be treated as proof that an appliance was not compromised.

What are the Citrix NetScaler zero-day vulnerabilities?

The two actively exploited zero-days are CVE-2026-88771 and CVE-2026-88772 , both rated CVSS 9.5. They affect Citrix NetScaler ADC and NetScaler Gateway deployments.

Is CVE-2026-88771 remotely exploitable?

Yes. Citrix says CVE-2026-88771 allows an unauthenticated attacker to execute arbitrary commands and does not require an additional feature or non-default configuration.

What is CVE-2026-88772?

CVE-2026-88772 is a memory-overflow vulnerability that can lead to Remote Code Execution or Denial of Service when DTLS is enabled. Citrix says DTLS is enabled by default on VPN virtual servers.

What are the fixed NetScaler versions?

Citrix lists 14.1-73.37 and later and 13.1-64.23 and later as fixed releases for the standard NetScaler ADC and Gateway branches. Separate fixed builds apply to FIPS and NDcPP editions.

Should enterprises patch NetScaler immediately?

Citrix strongly urges affected customers to install the relevant updated versions as soon as possible. Security teams should also consider preserving evidence and checking for compromise before updating where appropriate.

Does patching prove that a NetScaler appliance was not compromised?

No. Because the vulnerabilities were exploited before fixes were available, security teams should conduct appropriate compromise checks rather than treating a successful update as proof that no earlier intrusion occurred.