CVE-2026-88771, CVE-2026-88772: Citrix NetScaler — Remote Code Execution & Access (September 2026)

CVE-2026-88771, CVE-2026-88772 — Citrix NetScaler

CVE-2026-88771 and CVE-2026-88772 are critical vulnerabilities in Citrix NetScaler ADC and Gateway, confirmed as actively exploited zero-days as of September 26-27, 2026. These flaws allow attackers to achieve remote code execution, denial of service, HTTP request smuggling, and broad unauthorized access to enterprise networks. Severity is critical; immediate action is required.

Attack Vector

Attackers exploit these vulnerabilities remotely, targeting exposed NetScaler ADC and Gateway appliances. Successful exploitation does not require authentication. Techniques observed include HTTP request smuggling, enabling attackers to bypass security controls and inject malicious payloads. Once compromised, adversaries can execute arbitrary code, disrupt services, and pivot deeper into enterprise environments. No specific IOCs are published, but abnormal HTTP traffic and unexpected administrative actions should be considered suspicious.

Who Is at Risk

All organizations running Citrix NetScaler ADC and Gateway are at risk, regardless of region or sector. Both on-premises and cloud deployments are vulnerable if unpatched. As of this brief, Citrix NetScaler customers have received urgent warnings to disconnect affected systems, with confirmed but not yet widespread compromises. No specific organizations are named, but exposure is global.

Patch & Mitigate

• Patch: Await official Citrix guidance and hotfix release. Immediate disconnection of vulnerable NetScaler systems is recommended until patches are available.
• Workaround: None officially provided. Isolate or disconnect affected appliances from the internet and critical networks.
• Detect: Monitor for unusual HTTP requests, new administrative sessions, and signs of unauthorized code execution or configuration changes in NetScaler logs.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit public-facing NetScaler appliances to gain a foothold.
• TA0005 — Defense Evasion: HTTP request smuggling is used to bypass security controls and evade detection.
• TA0008 — Lateral Movement: Compromised NetScaler systems may be leveraged to access internal enterprise resources.

Source: https://www.cybersecuritydive.com/news/citrix-upgrades-netscaler-exploitation/831502/