Citrix NetScaler zero-day: unauthenticated command execution on the gateway
On 27 September 2026 Citrix fixed a critical NetScaler flaw that was already being exploited. What it is and how to check your appliances.
What happened
On 27 September 2026 Citrix published security bulletin CTX697096 for NetScaler ADC and NetScaler Gateway. Two of the bugs are rated 9.5 (CVSS 4.0):
- CVE-2026-88771: an input validation flaw that lets an unauthenticated attacker run commands. It affects default configurations.
- CVE-2026-88772: a memory overflow that can lead to code execution or a crash when DTLS is enabled, which it is by default on VPN virtual servers.
The bulletin also fixes six more flaws that depend on configuration. watchTowr reports that both critical bugs were exploited before a fix existed. CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog on 27 September. watchTowr’s page is not consistent on whether 88772 is confirmed as exploited, so treat it as at-risk either way.
I have not listed affected version numbers here, because secondary sources disagree. Check them in Citrix’s bulletin.
Why it matters
NetScaler Gateway sits at the edge of the network, often as the VPN or login portal, and holds credentials and session data. A bug that needs no account means anyone who can reach it can try. Edge appliances are also easy to forget, and an update can wipe the evidence of an earlier break-in.
What to check
- Find every NetScaler you run, including ones set up by a vendor or an old project. External scanning finds the ones you forgot.
- Before updating, save logs, a snapshot and a support bundle. An update can remove forensic evidence.
- Install the fixed build for your branch from bulletin CTX697096. Citrix has published no workaround.
- Check for compromise with Citrix’s indicator scan, or ask Citrix support. A clean result is not proof, because the indicators do not cover every technique.
- Rotate passwords, secrets and certificates that were used through the appliance.
- Keep the management interface off the public internet, and send logs to a system the appliance cannot change.
- Apply the bulletin’s separate step for CVE-2026-88778 (Enhanced ISN Generation), since the upgrade alone does not cover it.
The steps above follow watchTowr’s guidance and Citrix’s bulletin. Verify against the bulletin before you act.