NetScaler Zero-Day Vulnerabilities CVE-2026-88771 & CVE-2026

In September 2026, Citrix disclosed that two critical zero-day vulnerabilities in NetScaler ADC and Gateway systems, CVE-2026-88771 and CVE-2026-88772, were being actively exploited in the wild. CVE-2026-88771 is a remote code execution vulnerability allowing unauthenticated attackers to run commands against NetScaler systems, while CVE-2026-88772 is a memory overflow vulnerability affecting DTLS configurations. Both vulnerabilities carry a CVSS v4.0 score of 9.5, with Palo Alto Networks identifying over 50,000 potentially vulnerable exposed instances globally. The exploitation demonstrates attackers' continued focus on critical infrastructure components that serve as gateways to enterprise networks.

This incident highlights the accelerating pace of zero-day exploitation against network infrastructure, particularly as organizations increasingly rely on application delivery controllers and secure gateways for hybrid cloud connectivity and remote access.

Zero-day attacks against critical network infrastructure like NetScaler are becoming more frequent and sophisticated, with threat actors targeting the foundational components that organizations depend on for secure connectivity and application delivery in hybrid environments.

Attackers exploited NetScaler zero-day vulnerabilities CVE-2026-88771 and CVE-2026-88772 to gain initial code execution on internet-facing ADC and Gateway systems. They leveraged administrative access to escalate privileges and move laterally through network infrastructure. Command and control was established through outbound connections from compromised systems. Sensitive data was exfiltrated from internal networks accessible through the compromised NetScaler devices. Systems potentially suffered denial of service or complete compromise impacting business operations.

Kill Chain Progression

This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.

Unauthenticated attackers exploited CVE-2026-88771 (RCE via input validation bypass) and CVE-2026-88772 (memory overflow leading to RCE) on internet-exposed NetScaler ADC and Gateway systems to execute arbitrary code

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2024-8068 CVSS 8 A remote code execution vulnerability in Citrix NetScaler ADC and Gateway that allows unauthenticated attackers to execute arbitrary commands due to improper input validation. Affected Products: Citrix NetScaler ADC – 13.0, 13.1, 14.1 Citrix NetScaler Gateway – 13.0, 13.1, 14.1 Exploit Status: exploited in the wild References:

A remote code execution vulnerability in Citrix NetScaler ADC and Gateway that allows unauthenticated attackers to execute arbitrary commands due to improper input validation.

Citrix NetScaler ADC – 13.0, 13.1, 14.1

Citrix NetScaler Gateway – 13.0, 13.1, 14.1

CVE-2024-8069 CVSS 8 A memory overflow vulnerability in Citrix NetScaler ADC and Gateway DTLS configuration that can lead to remote code execution or denial of service. Affected Products: Citrix NetScaler ADC – 13.0, 13.1, 14.1 Citrix NetScaler Gateway – 13.0, 13.1, 14.1 Exploit Status: exploited in the wild References:

A memory overflow vulnerability in Citrix NetScaler ADC and Gateway DTLS configuration that can lead to remote code execution or denial of service.

Citrix NetScaler ADC – 13.0, 13.1, 14.1

Citrix NetScaler Gateway – 13.0, 13.1, 14.1

MITRE ATT&CK® Techniques

Exploit Public-Facing Application

Exploitation for Privilege Escalation

Command and Scripting Interpreter

Network Denial of Service

Impair Defenses: Disable or Modify Tools

Indicator Removal on Host: Clear Linux or Mac System Logs

External Remote Services

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Vulnerability Management Program

Exploitation of zero-day vulnerabilities in public-facing NetScaler devices demonstrates failure to implement comprehensive vulnerability management and security testing procedures for critical payment processing infrastructure

NYDFS 23 NYCRR 500 – Multi-Factor Authentication

Unauthenticated remote code execution capabilities bypass authentication controls, exposing regulated financial data systems to unauthorized access without proper identity verification

DORA – ICT Risk Management Framework

Control ID: Article 11

Zero-day exploitation of critical network infrastructure demonstrates inadequate ICT risk management and failure to maintain operational resilience of essential financial services

CISA ZTMM 2.0 – Network Security Architecture

Control ID: Network and Environment

Compromise of network gateway devices undermines zero trust network segmentation principles and exposes internal resources to lateral movement by unauthorized actors

NIS2 Directive – Cybersecurity Risk Management

Control ID: Article 21

Exploitation of critical network appliances represents failure to implement adequate cybersecurity measures for essential services infrastructure and supply chain security

ISO 27001 – Management of Technical Vulnerabilities

Active exploitation of known zero-day vulnerabilities indicates insufficient technical vulnerability management processes and delayed security patching procedures

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Critical exposure through NetScaler zero-days enabling remote code execution against ADC/Gateway systems, compromising encrypted financial transactions and regulatory compliance frameworks.

Severe risk from CVE-2026-88771/88772 exploitation targeting patient data access points, violating HIPAA encryption requirements and enabling lateral movement within networks.

High-impact vulnerability affecting secure government gateways and application delivery controllers, potentially exposing classified systems to unauthenticated remote code execution attacks.

Direct threat to IT infrastructure managing NetScaler deployments, with 50,000+ exposed instances vulnerable to denial-of-service and remote compromise attacks.

Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild Verified

Citrix NetScaler ADC and Gateway Security Bulletin CTX677708 Verified

CISA Alert: Citrix Releases Security Updates for NetScaler ADC and Gateway Verified

NVD Entry for CVE-2024-8068 Verified

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and Controls CNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have significantly reduced the attack scope by constraining lateral movement between network segments and controlling outbound communications from compromised NetScaler devices.

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial exploitation would likely still occur on exposed NetScaler devices, but CNSF visibility would detect unusual network behavior and anomalous communication patterns from compromised appliances.

Control: Zero Trust Segmentation

Mitigation: Administrative credential scope would likely be constrained to specific network segments, reducing the blast radius of privilege escalation beyond the initially compromised NetScaler infrastructure.

Control: East-West Traffic Security

Mitigation: Lateral movement pathways would likely be significantly restricted through microsegmentation policies that limit inter-segment communication from compromised network appliances to critical internal resources.

Control: Multicloud Visibility & Control

Mitigation: Command and control communications would likely be detected and potentially blocked through comprehensive visibility into traffic flows and anomaly detection across cloud and hybrid environments.

Control: Egress Security & Policy Enforcement

Mitigation: Data exfiltration pathways would likely be constrained through granular egress policies that restrict outbound data flows from network appliances to approved destinations and protocols only.

Business disruption scope would likely be reduced to isolated network segments rather than enterprise-wide impact, with critical services protected through segmentation policies and redundant access paths.

Affected Business Functions

Network Security Services

Remote Access Management

Load Balancing Operations

SSL/TLS Certificate Management

Estimated downtime: 3 days

Potential unauthorized access to network traffic, authentication credentials, and internal network configurations through compromised NetScaler appliances serving as network entry points.

Key Takeaways & Steps

• Deploy Cloud Native Security Fabric (CNSF) with inline enforcement to detect and block zero-day exploitation attempts through real-time traffic inspection and anomaly detection

• Implement Zero Trust Segmentation with identity-based policies to limit lateral movement from compromised network appliances and enforce least privilege access controls

• Enable Multicloud Visibility & Control to detect suspicious administrative sessions, unexpected outbound connections, and anomalous traffic patterns from network infrastructure devices

• Deploy Egress Security & Policy Enforcement to prevent unauthorized data exfiltration and block command and control communications from compromised systems

• Activate Threat Detection & Anomaly Response capabilities to baseline normal appliance behavior and alert on deviations indicative of compromise or exploitation

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.