Two NetScaler Zero-Days Are Being Exploited. What Infrastructure Teams Must Check Now

A NetScaler appliance may look like one item in the patch queue. In many organisations, it is far more important than that. It can terminate remote-access sessions, expose applications, enforce authentication paths and connect external users to internal services.

That is why two newly disclosed vulnerabilities, CVE-2026-88771 and CVE-2026-88772, require more than a routine update. Citrix has confirmed exploitation against unmitigated systems.^[1] CISA says threat actors are exploiting both vulnerabilities globally and has added them to its Known Exploited Vulnerabilities catalog.^[2]

The immediate task is to update affected appliances. The harder task is deciding whether an exposed appliance may already have been compromised.

Why the configuration details matter

Both vulnerabilities can allow unauthenticated remote code execution, but their exposure conditions differ.

Citrix rates both flaws at 9.5 under CVSS 4.0. CVE-2026-88771 has low attack complexity with an additional attack precondition. CVE-2026-88772 has high attack complexity, but it can lead to remote code execution or denial of service when DTLS is enabled.

These details should prevent two dangerous assumptions. A team cannot treat a default configuration as safe, and it cannot assume that DTLS is off merely because nobody remembers enabling it.

Which versions need attention

Citrix lists the following customer-managed versions as affected:^[1]

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
• NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.279

Secure Private Access Hybrid deployments that use NetScaler instances are also affected. Citrix-managed cloud services are updated by the vendor, but customer-managed appliances remain the customer’s responsibility.

Version inventory should therefore include every production, disaster-recovery, test and standby appliance. An inactive node can still become a problem if it remains reachable or later returns to service without the update.

Patching and compromise assessment are separate jobs

Installing a fixed build prevents continued exploitation of these known flaws. It does not remove persistence that an attacker may already have established.

CERT-EU describes observed activity in which commands were injected through logs, the appliance’s web-server configuration was changed and an internet-reachable PHP web shell was installed.^[3] CISA recommends checking for indications of compromise before patching when possible because applying updates may reduce forensic visibility.^[2]

This creates an uncomfortable but important sequence:

1. Confirm which appliances and versions are exposed.
2. Restrict or isolate vulnerable systems where operations allow it.
3. Preserve evidence before making changes.
4. Review available indicators and hunt for suspicious activity.
5. Apply the supported update.
6. Decide whether the appliance can remain trusted or requires rebuild and credential recovery.

Accessible text alternative for Figure 1

Five-step NetScaler incident response sequence: 1. Inventory version and exposure, 2. Contain and preserve evidence before changes, 3. Investigate indicators, logs and access, 4. Apply fixed build to close known vulnerabilities, 5. Trust decision to retain or rebuild. A bottom reminder emphasizes not stopping at patch installed until evidence supports trust.

Unit 42 recommends preserving appliance snapshots, remote syslog data, NetScaler Console logs, technical support bundles and packet-engine core dumps.^[4] It also recommends looking for suspicious administrative sessions, unexpected outbound connections and unexplained logging gaps. The company correctly warns that patching does not remove an attacker’s established access.

Not every organisation will have enough internal forensic expertise to make that decision alone. If evidence is missing, logs have gaps or persistence is suspected, involving an incident-response team is safer than declaring recovery because the version number changed.

How large is the exposure?

Unit 42 reported 50,277 internet-exposed instances that could potentially be vulnerable based on its September 27 telemetry.^[4] This is not a count of compromised systems. It is an external exposure estimate and should be treated as such.

The number still explains the urgency. Edge appliances are continuously scanned, and working exploitation can move faster than enterprise change windows. An organisation should not wait for evidence that its own appliance was targeted before reducing exposure.

What teams should do today

Infrastructure, network and security teams should work from one shared inventory rather than run separate patch and investigation efforts.

• Identify every customer-managed NetScaler ADC and Gateway instance.
• Record version, internet exposure, role, HA relationship and management owner.
• Check whether DTLS is enabled or implicitly active on VPN virtual servers.
• Preserve relevant evidence before updating when operationally possible.
• Apply the fixed Citrix build on an emergency basis.^[5]
• Review Citrix, CISA and trusted threat-research indicators.
• Rotate credentials and secrets that may have crossed the appliance if compromise is suspected.
• Validate authentication, VPN, application delivery and monitoring after recovery.

The final step should not be “the patch installed successfully.” It should be “the service is restored, the exposure is closed, and we have enough evidence to trust the appliance or we have replaced it.”

NetScaler sits at the boundary between users and important systems. When that boundary may have been crossed, patching is necessary. Recovery requires a separate judgement.

References and further reading

1. NetScaler security bulletin CTX697096, Citrix, September 2026. Affected versions, exposure conditions and fixed builds. ↩
2. Critical NetScaler zero-days exploited, CISA, September 27, 2026. Global exploitation, KEV status and evidence-preservation guidance. ↩
3. CVE-2026-88771 technical investigation, CERT-EU, September 28, 2026. Observed log injection and web-shell persistence. ↩
4. NetScaler zero-day threat brief, Palo Alto Networks Unit 42, September 27, 2026. Exposure telemetry and investigation guidance. ↩
5. Rapid7 NetScaler zero-day guidance, Rapid7, updated September 29, 2026. Emergency remediation and detection guidance. ↩