Skip to content
Today
Sections

Build Reports disagree3 publishers 3 min read Published Updated

Default NetScaler Gateway configurations meet the conditions for both exploited pre-auth RCE bugs

Citrix confirmed attackers are exploiting two CVSS 9.5 pre-auth RCE flaws in NetScaler ADC and Gateway, one of them present in default configurations. Self-managed appliances need the fixed build, installed after evidence is saved, since an upgrade can erase signs of intrusion.

The Engineer · Build desk

Send a correction

Illustration accompanying Default NetScaler Gateway configurations meet the conditions for both exploited pre-auth RCE bugs
Generated illustration

What happened

  • NetScaler administrators were told to shut appliances down on September 26, 2026, after a private Dutch NCSC pre-notification, and Citrix published bulletin CTX697096 with fixed builds the next day.
  • CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog on September 27, 2026.
  • The fixed releases are 14.1-73.37 and 13.1-64.23 or later, plus 14.1-73.37 FIPS and 13.1.37.279 for FIPS and NDcPP appliances.
  • Appliances already patched for the earlier CVE-2026-19490 remain vulnerable unless they run one of the new fixed builds.

Why it matters

  • What it limits constraint Self-managed Gateway owners cannot defer the upgrade on the grounds that a vulnerable feature is off, because factory defaults satisfy both bugs and exploitation needs no login.
  • What doesn't add up contradiction The sources split on mitigation: the dev.to summary offers disabling DTLS as an interim step for CVE-2026-88772, while watchTowr says Citrix has published no workaround for either bug.
  • Who has to decide decision An emergency NetScaler change has to include time for evidence capture before the upgrade, and a clean IOC scan is not grounds to skip credential rotation.
  • Who's exposed exposure A compromised appliance puts its stored LDAP service accounts, RADIUS shared secrets, OAuth tokens and certificates in scope for rotation, along with every user who logged in through it.

A NetScaler Gateway running a VPN virtual server on factory settings meets the preconditions for both bugs [22]. CVE-2026-88771 needs no feature enabled [4]. CVE-2026-88772, a memory overflow, needs DTLS, and DTLS is on by default for VPN virtual servers [5]. The attacker needs network access and no account [8].

Only the DTLS bug can be switched off by configuration. On a VPN virtual server the setting is `-dtls OFF`, and DTLS-type virtual servers have to be found and handled separately, according to a summary of the bulletin published on dev.to [19]. The same summary says to weigh the operational impact before turning DTLS off [21]. I think the change is worth making where the VPN can run without DTLS, as a stopgap while the upgrade is staged. It does nothing for CVE-2026-88771 [19]. Taking the appliance off the internet has a similar limit, because an unpatched device stays reachable from the internal network [20].

On 13.1, run `show ns variable` before upgrading. If it returns any variables, install 13.1-64.24, because 13.1-64.23 has a known reboot loop during the upgrade [3]. So the first fixed 13.1 build needed a fix of its own [3]. The bulletin also covers six configuration-dependent bugs, and one of them, CVE-2026-88778, closes only once Enhanced ISN Generation is enabled; the upgrade alone leaves it open [14]. The bulletin applies to customer-managed appliances, and Citrix updates its own managed cloud services [15].

I would run evidence capture and the upgrade as one emergency change. CISA advises checking for compromise and preserving forensic evidence before updating, because an update can remove that evidence [12]. watchTowr's capture list is logs, a snapshot, a support bundle and a core dump from each exposed appliance [12]. The dev.to summary lists what to look for: abnormal requests, unexpected configuration or file changes, outbound connections from the device, and suspicious administrative or VPN logins [16]. The IOC scan on the NetScaler Console Security Advisory page needs Console 14.1-73.36 or later with telemetry enabled [6]. Citrix warns its IOCs do not cover every technique, so a clean scan is not proof [6].

A positive finding extends the work past the appliance. Citrix says to investigate every system the NetScaler connected to, particularly authentication servers, web tier systems and management jump hosts, and to erase and reinstall MPX appliances [18].

CISA said: "Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally." [9]

According to the dev.to summary, the public documentation does not say which user the injected code runs as or what privileges it gains [25]. An unattributed post on the sh3llc0d3 threat intel site claimed the exploits target nsppe, the native packet processing engine, and give "immediate execution under the nobody or root service context" [24]. The Stack, which reported the post, could not confirm it [24]. The Stack also reported that a large customer disclosed the bugs to Citrix before they were exploited, and that Citrix did not push an emergency fix until attacks started [23].

What to watch

  • Whether CISA adds CVE-2026-88772 to the KEV catalog, given its own statement that both bugs are being exploited.
  • Whether Citrix expands the NetScaler Console IOC scan beyond its current coverage, which it says does not include every technique.
  • Whether Citrix answers The Stack's report that a customer disclosed the bugs before exploitation began.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence76
Adoption68
Hype gap+5
Incentives35
Confidence74

Perspective Coverage

3 publishers
Builder
Builder 22%
Operator
Operator 65%
Investor
Investor 13%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Citrix confirmed that two pre-authentication RCE vulnerabilities in NetScaler ADC and Gateway, CVE-2026-88771 and CVE-2026-88772, are being actively exploited in unpatched environments; both carry a CVSS v4.0 score of 9.5.

    Reported SupportedView cited source
  2. [2]

    Fixed versions: NetScaler ADC and Gateway 14.1-73.37 and later; 13.1-64.23 and later; NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later; NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.279 and later.

    Reported SupportedView cited source
  3. [3]

    On 13.1, run show ns variable first; if it returns any variables, use 13.1-64.24 to avoid a known reboot loop during the upgrade that affects 13.1-64.23.

    Reported SupportedView cited source
  4. [4]

    CVE-2026-88771 is an improper input validation vulnerability that lets an unauthenticated attacker run arbitrary commands on the appliance; it affects every NetScaler ADC and Gateway deployment on an affected version, including the default configuration, and no special feature needs to be enabled.

    Reported SupportedView cited source
  5. [5]

    CVE-2026-88772 is a memory overflow that can lead to RCE or denial of service when DTLS is enabled; DTLS is on by default for VPN virtual servers, so most NetScaler Gateway deployments meet the precondition unless DTLS has been explicitly disabled.

    Reported SupportedView cited source
  6. [6]

    The IOC scan on the NetScaler Console Security Advisory page requires version 14.1-73.36 or later with telemetry enabled; Citrix warns that the IOCs do not cover every technique, so a clean result is not proof.

    Reported SupportedView cited source
  7. [7]

    According to watchTowr, Citrix has not published a workaround for either vulnerability, so upgrading is the only fix.

    Reported Supported Source: watchTowrView cited source
  8. [8]

    The vulnerabilities require only network access, not a valid account.

    Reported SupportedView cited source
  9. [9]

    "Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally."

    Reported Supported Source: CISA, quoted by The StackView cited source
  10. [10]

    On September 26, 2026, NetScaler administrators reported being told to shut appliances down following a private pre-notification from the Dutch NCSC (NCSC-NL); Citrix released fixed builds on September 27, 2026 in security bulletin CTX697096.

    Reported SupportedView cited source
  11. [11]

    CISA added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog on September 27, 2026.

    Reported SupportedView cited source
  12. [12]

    CISA advises checking for compromise and preserving forensic evidence before updating, because an update can remove the evidence; watchTowr lists capturing logs, a snapshot, a support bundle and a core dump from each exposed appliance before updating.

    Reported SupportedView cited source
  13. [13]

    Appliances patched for the earlier CVE-2026-19490 remain vulnerable unless they run one of the fixed builds.

    Reported SupportedView cited source
  14. [14]

    The same bulletin fixes six further configuration-dependent NetScaler vulnerabilities (CVE-2026-88773 to CVE-2026-88778); CVE-2026-88778 is fixed by enabling Enhanced ISN Generation rather than by the upgrade alone.

    Reported SupportedView cited source
  15. [15]

    The bulletin applies to customer-managed appliances; Citrix updates its own managed cloud services.

    Reported SupportedView cited source
  16. [16]

    Clues of compromise include abnormal requests, unexpected configuration or file changes, outbound communication from the device, and suspicious administrative or VPN authentication activity.

    Reported SupportedView cited source
  17. [17]

    Citrix says customers suspecting compromise should change all service account passwords and secrets stored on the NetScaler (e.g. LDAP service accounts, RADIUS shared secrets, OAuth tokens, API keys, SNMP community names), change user accounts authenticated via the platform including Gateway or AAA virtual servers, and revoke certificates and private keys stored on it.

    Reported Supported Source: Citrix, as reported by The StackView cited source
  18. [18]

    Citrix says to investigate all servers and systems the NetScaler ADC connected to, particularly authentication servers, sensitive systems, web tier systems and management jump hosts, and to erase and reinstall MPX appliances.

    Reported Supported Source: Citrix, as reported by The StackView cited source
  19. [19]

    -dtls OFF applies to VPN virtual server settings; DTLS-type virtual servers must be checked and handled separately; disabling DTLS removes a prerequisite for CVE-2026-88772 but does not prevent CVE-2026-88771.

    Reported SupportedView cited source
  20. [20]

    Halting unnecessary external exposure only restricts external reachability and leaves vulnerabilities on unpatched devices reachable from the internal network.

    Reported SupportedView cited source
  21. [21]

    For CVE-2026-88772, operators should evaluate the operational impact before disabling DTLS.

    Reported SupportedView cited source
  22. [22]

    A NetScaler Gateway with a VPN virtual server on default settings meets the preconditions for both CVE-2026-88771 and CVE-2026-88772.

    Derived Supported
  23. [23]

    The Stack understands the bugs were proactively disclosed to Citrix by a large customer prior to their exploitation and that Citrix did not push an emergency fix until attacks started.

    Reported Contested Source: The Stack, single-sourcedView cited source
  24. [24]

    An unattributed blog on the sh3llc0d3 threat intel site claimed the exploits target defects in the native packet processing engine (nsppe) and that the "control flow hijack provides the adversary with immediate execution under the nobody or root service context"; The Stack could not immediately confirm this.

    Reported Insufficient Source: unattributed sh3llc0d3 post, via The StackView cited source
  25. [25]

    Public documentation does not detail the executing user or acquired privileges when code executes on the NetScaler device.

    Reported InsufficientView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. dev.to

    2 articles · October 5, 2026

    Citrix NetScaler CVE-2026-88771 and CVE-2026-88772: Two Pre-Authentication RCE Zero-Days Under Active Exploitation
  2. thestack.technology

    1 article · September 27, 2026

    NetScaler attacks: Zero days reported exploited

  3. watchtowr.com

    1 article · September 27, 2026

    CVE-2026-88771: Citrix NetScaler ADC and Citrix NetScaler Gateway Vulnerability

Topics and entities

Topics

Entities