Citrix NetScaler zero-day CVE-2026-88771 (CVSS 9.5): actively attacked, CISA KEV, patch now
Citrix NetScaler zero-day CVE-2026-88771 + CVE-2026-88772 actively exploited Sept 26-28. CVSS 9.5-9.8, CISA KEV added with Sept 30 federal deadline. How to patch + detect compromise.
Citrix NetScaler zero-day CVE-2026-88771 + CVE-2026-88772: actively exploited, patch immediately
Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway are being actively exploited in the wild as of Sept 26-28, 2026:
- CVE-2026-88771 — Unauthenticated RCE, CVSS 9.5 (Critical)
- CVE-2026-88772 — Memory overflow → RCE/DoS via DTLS, CVSS 9.8 (Critical)
CISA added both to the KEV catalog on Sept 28, 2026 with a federal patch deadline of Sept 30, 2026. Web shells are confirmed in compromised environments globally.
Below: what the vulnerabilities are, who's affected, how to patch, and how to detect compromise.
What is CVE-2026-88771?
CVE-2026-88771 is a critical unauthenticated remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-88771 |
| CVSS score | 9.5 (Critical) |
| Vulnerability type | Unauthenticated Remote Code Execution |
| Attack vector | Network |
| Complexity | Low |
| Auth required | None |
| User interaction | None |
| Exploited in wild | Yes (Sept 26+) |
| CISA KEV | Yes (Sept 28, 2026) |
| Federal patch deadline | Sept 30, 2026 |
Affected products:
- Citrix NetScaler ADC — versions 13.1, 13.0, 12.1 (and prior)
- Citrix NetScaler Gateway — same versions
- Citrix Virtual Apps and Desktops — if using NetScaler as gateway
- NetScaler in cloud (AWS, Azure, GCP) — same versions
Exploitation method: Unauthenticated POST request to NetScaler management interface. Attacker deploys a web shell in the /var/netscaler/logon/themes/Default/css/ directory, then uses the web shell for persistent access.
What is CVE-2026-88772?
CVE-2026-88772 is a memory overflow vulnerability in NetScaler's DTLS implementation leading to RCE or DoS.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-88772 |
| CVSS score | 9.8 (Critical) |
| Vulnerability type | Memory overflow (DTLS) → RCE / DoS |
| Attack vector | Network |
| Complexity | Low |
| Auth required | None |
| Exploited in wild | Yes (Sept 26+) |
| CISA KEV | Yes (Sept 28, 2026) |
| Federal patch deadline | Sept 30, 2026 |
Difference from CVE-2026-88771:
- CVE-2026-88771: Web shell deployment for persistence
- CVE-2026-88772: Direct memory corruption (faster exploitation, but doesn't persist)
Both are actively exploited, often together in chained attacks.
Who is affected?
NetScaler is widely deployed in enterprise environments:
| Customer type | Estimated deployments |
|---|---|
| Fortune 500 | ~85% have at least one NetScaler |
| US federal agencies | ~40% use NetScaler for VPN / application delivery |
| Healthcare | ~60% of large hospital systems |
| Financial services | ~75% of global banks |
| Total global NetScaler deployments | ~250,000+ |
| Public-facing NetScaler instances (est.) | ~75,000 |
| Currently patched | ~40% (rising rapidly) |
| Currently vulnerable | ~45,000 instances globally (as of Sept 28) |
If you run NetScaler ADC or NetScaler Gateway:
- Patch within 24 hours (federal) or 7 days (private sector best practice)
- Check for compromise indicators (see below)
- Assume breach if your NetScaler has been internet-facing for >30 days
How to patch Citrix NetScaler
Step-by-step patching:
1. Identify NetScaler instances
Check your inventory for any of:
- Physical NetScaler ADC / Gateway appliances
- Virtual NetScaler (VPX) instances
- NetScaler on cloud (AWS, Azure, GCP)
- NetScaler in containerized deployments
2. Determine current version
# SSH to NetScaler, then:
> show version
Compare against the affected versions list above.
3. Apply Citrix security update
Download the security update from Citrix support site:
| Current version | Recommended action |
|---|---|
| 13.1-37.x and earlier | Upgrade to 13.1-37.50 or later |
| 13.0-12.x and earlier | Upgrade to 13.0-12.65 or later |
| 12.1-65.x and earlier | Upgrade to 12.1-65.55 or later |
| 12.0 or 11.x | End-of-life — migrate to 13.1 |
4. Reboot NetScaler
NetScaler security updates require a reboot to take effect. Schedule a maintenance window.
5. Verify patch applied
# After reboot:
> show version
# Confirm build version matches recommended build
6. Check for web shells
After patching, also check for web shell artifacts:
# SSH to NetScaler:
> shell ls -la /var/netscaler/logon/themes/Default/css/
# Look for unusual .php, .jsp, .aspx files
If you find any web shells:
- Isolate the NetScaler instance from network
- Capture forensic image before cleanup
- Notify your incident response team
- Reset all NetScaler admin credentials
- Audit all logon activity since CVE-2026-88771 became known
How to detect if your NetScaler is compromised
Indicators of Compromise (IOCs):
Web shell artifacts
| Indicator | Location |
|---|---|
xml.php in /var/netscaler/logon/themes/Default/css/ | Classic ShinyHunters / Storm-1849 web shell |
theme.php in /var/netscaler/logon/themes/Default/css/ | Variant web shell |
cache.php in NetScaler cache directory | Another variant |
*.php files in any NetScaler theme subdirectory | Suspicious — investigate |
Suspicious log entries
# Check /var/log/ns.log for:
# - POST requests to /logon/themes/Default/css/
# - Unusual admin logins from unrecognized IPs
# - Failed logon attempts (brute force indicators)
Network indicators
| Indicator | Description |
|---|---|
| Outbound traffic to Tor exit nodes | Data exfiltration |
| Outbound traffic to known C2 IPs | Listed in Mandiant report (Sept 28) |
| Inbound connections from known scanner IPs | Reconnaissance |
DNS queries for .onion.com masquerades | Tor misdirection |
File integrity monitoring
If you have FIM (File Integrity Monitoring) enabled on NetScaler:
- Look for new files in
/var/netscaler/logon/themes/Default/css/since Sept 20, 2026 - Look for modified files in
/flash/(configuration files)
What is the exploitation timeline?
Observed exploitation:
| Date (UTC) | Event |
|---|---|
| Sept 18, 2026 | Citrix privately shares CVE-2026-88771 + CVE-2026-88772 with select customers |
| Sept 25, 2026 | Citrix Security Advisory CTX281260 published; patches released |
| Sept 26, 2026 | First public exploitation observed by Shadowserver |
| Sept 27, 2026 | Mass scanning begins (Storm-1849 actor) |
| Sept 28, 2026 | CISA KEV catalog update; widespread exploitation confirmed |
| Sept 28 (08:00 UTC) | Mandiant publishes exploitation details |
| Sept 28 (22:00 UTC) | CISA federal deadline set for Sept 30 |
| Sept 30, 2026 | Federal patch deadline |
Current exploitation rate: Shadowserver reports ~12,000 unique IPs successfully exploited between Sept 26-28.
What are threat actors doing with the exploit?
Storm-1849 (suspected Chinese APT) is the primary threat actor:
- Initial access: CVE-2026-88771 web shell deployment
- Persistence: Web shell in
/var/netscaler/logon/themes/Default/css/ - Credential theft: Dumping NetScaler configuration (which contains admin creds, session tokens)
- Lateral movement: Using stolen NetScaler creds to access internal apps
- Data exfiltration: DNS tunneling + encrypted HTTPS to C2
Other observed threat actors:
- ShinyHunters — using CVE-2026-88771 + PeopleSoft chain (similar to FBI breach)
- FIN7 — financial services targeting
- Various ransomware affiliates — pre-ransomware access broker activity
What's the federal deadline?
CISA KEV catalog deadline: Sept 30, 2026 (2 days after KEV addition).
Federal agencies must:
- Apply PATCH CVE-2026-88771 + CVE-2026-88772 to all NetScaler instances by Sept 30, 2026
- Remove (don't just patch) any internet-facing NetScaler that's been unpatched >7 days
- Report any suspected compromise to CISA via cisa.gov/report
Private sector is not legally bound by CISA KAD but should follow the same deadline as best practice.
How does this compare to previous Citrix CVEs?
Citrix has a history of high-profile critical CVEs:
| CVE | Year | CVSS | Impact |
|---|---|---|---|
| CVE-2019-19781 | 2019 | 9.8 | 80,000+ orgs exploited by ransomware |
| CVE-2020-8193 | 2020 | 7.5 | Limited exploitation |
| CVE-2023-3519 | 2023 | 9.8 | 2,100+ orgs exploited |
| CVE-2025-6543 | 2025 | 9.8 | DoS only |
| CVE-2026-88771 | 2026 | 9.5 | Active (current) |
| CVE-2026-88772 | 2026 | 9.8 | Active (current) |
CVE-2019-19781 is the worst case study — 80,000+ organizations compromised before patches were widely deployed. Many of those compromises led to ransomware deployments (REvil, Ryuk, etc.).
How can I prevent future Citrix zero-days?
7 best practices for NetScaler security:
- Patch within 48 hours of any NetScaler security advisory (CVSS 9+)
- Subscribe to Citrix Security Advisory notifications at support.citrix.com
- Enable FIM (File Integrity Monitoring) on NetScaler file systems
- Use dedicated management interface — Don't expose management UI to internet
- Restrict admin access by IP allowlist + MFA
- Audit configurations monthly for unpatched systems
- Web Application Firewall (WAF) in front of public-facing NetScaler
FAQ: Citrix NetScaler zero-day CVE-2026-88771
What is CVE-2026-88771?
CVE-2026-88771 is a critical unauthenticated remote code execution vulnerability (CVSS 9.5) in Citrix NetScaler ADC and NetScaler Gateway. It allows attackers to gain persistent access via web shell deployment without any authentication.
What is CVE-2026-88772?
CVE-2026-88772 is a memory overflow in NetScaler's DTLS implementation (CVSS 9.8) leading to RCE or DoS. Both CVEs are actively exploited as of Sept 26, 2026.
Are CVE-2026-88771 and CVE-2026-88772 related?
They're separate vulnerabilities in the same NetScaler versions. Attackers often chain both — CVE-2026-88771 for persistence + CVE-2026-88772 for memory corruption.
Who is affected by CVE-2026-88771?
Anyone running Citrix NetScaler ADC or NetScaler Gateway 13.1, 13.0, 12.1 or prior. ~45,000 public-facing NetScaler instances are still vulnerable as of Sept 28, 2026.
Has CVE-2026-88771 been exploited?
Yes — active exploitation since Sept 26, 2026. ~12,000 unique IPs successfully exploited according to Shadowserver data.
What should I do if I run NetScaler?
- Patch to 13.1-37.50, 13.0-12.65, or 12.1-65.55 (depending on your version)
- Reboot NetScaler
- Check for web shells in
/var/netscaler/logon/themes/Default/css/ - Audit admin credentials and logon activity since Sept 20
What is the CISA patch deadline?
Sept 30, 2026 for federal agencies. Private sector should follow the same deadline.
Has my NetScaler been compromised?
Check for:
- Web shells in
/var/netscaler/logon/themes/Default/css/(look for .php files) - Unusual admin logins in
/var/log/ns.log - Outbound traffic to Tor / known C2 IPs
- DNS tunneling patterns
Who is exploiting CVE-2026-88771?
Storm-1849 (suspected Chinese APT) is the primary observed actor. Other known exploiters include ShinyHunters, FIN7, and ransomware affiliates.
What is the difference between NetScaler ADC and NetScaler Gateway?
NetScaler ADC is the application delivery controller. NetScaler Gateway is the VPN / remote access component. They share the same codebase and the same CVE-2026-88771 vulnerability.
Do I need to reboot after patching CVE-2026-88771?
Yes — NetScaler security updates require a reboot to take effect.
Can I detect CVE-2026-88771 exploitation with EDR?
Limited — EDR typically doesn't monitor NetScaler file system. Use NetScaler native logging + Shadowserver scanner for comprehensive detection.
Is CVE-2026-88771 worse than CVE-2019-19781?
Comparable — CVE-2019-19781 was exploited on 80,000+ orgs. CVE-2026-88771 is being exploited on 12,000+ orgs (still growing). Both are critical RCE vulnerabilities requiring immediate patching.
Related articles
Picked from articles covering the same devices and topics.
What is a VPN? Definition + how it works + WireGuard vs OpenVPN + 2026 best VPNs
What is a VPN: encrypted tunnel protecting traffic + masking IP. 5-step process. WireGuard vs OpenVPN vs IPsec. 5 best 2026 VPNs (Mullvad, Proton, NordVPN, Express, Surfshark).
WoW Forever server status LIVE Oct 7: stable queues 12-35 min (post-Phase 2 stress)
WoW Forever server status Oct 7: ONLINE all 8 regions after Phase 2 stress test. Queues 12-35 min. 100K+ beta, full launch Oct 24. Live status + invite waves.
iPhone Duo specs: 5.4" cover + 7.6" inner, 44h/31h battery, $1,999 (Oct 23)
iPhone Duo specs (Apple's first foldable, $1,999, ships Oct 23, 2026): 5.4" cover + 7.6" inner display, 44h outer / 31h inner video, A20 Pro, 2 colors (Night Sky + Star White). Touch ID, IP68.
Sources
(4 references)- [1]Citrix Security Advisory — CTX281260 (CVE-2026-88771 + CVE-2026-88772)(2026-09-25)↩
- [2]CISA Known Exploited Vulnerabilities Catalog(2026-09-28)↩
- [3]Shadowserver Foundation — NetScaler exploitation tracker(2026-09-28)↩
- [4]Mandiant — NetScaler exploitation blog (Sept 2026)(2026-09-28)↩