Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

Citrix has patched eight critical and high-severity vulnerabilities in NetScaler ADC and NetScaler Gateway, two of which (CVE-2026-88771, CVE-2026-88772) have been exploited in zero-day attacks to plant webshells on compromised devices.

Rumors about their existence and active exploitation popped up on Reddit on Friday, fueled by warnings from IT suppliers, who apparently got the information from the Dutch National Cyber Security Center (NCSC-NL).

According to security researcher Kevin Beaumont, European government sources have been warning organizations about active attacks all week, and the attacks have been unfolding this entire month.

“Probably nation state aligned as well resourced, espionage rather than teens,” he commented.

“Based on public reporting, it has not been determined whether exploitation has reached widespread scale,” Satnam Narang, senior staff research engineer at Tenable, noted.

“No details about threat actors have been made public at this time. However, based on our research, roughly two-thirds of threat actor activity targeting Citrix NetScaler over the last seven years involved advanced persistent threat (APT) groups, while one-third involved ransomware groups and their affiliates.”

The exploited vulnerabilities

Citrix NetScaler ADC is an application delivery and security platform, used for managing network traffic and setting up a firewall for applications. NetScaler Gateway is a secure remote access and VPN solution that allows external users to connect to internal enterprise networks and applications.

Citrix released patches for vulnerabilities numbered CVE-2026-88771 through CVE-2026-88778 on Sunday, and confirmed that “exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.”

CVE-2026-88771 stems from improper input validation and allows remote, unauthenticated attackers to execute arbitrary commands on vulnerable devices running a default configuration. No user interaction is needed to trigger exploitation.

“This vulnerability gives attackers full control of the gateway, providing direct access to the internal corporate network behind it,” NCSC-NL said on Sunday.

CVE-2026-88772 is a memory overflow vulnerability that could lead to remote code execution or denial of service. It’s remotely exploitable without user interaction, but only if DTLS configuration enabled on NetScaler ADC or NetScaler Gateway (it is by default on virtual VPN servers).

They can be exploited independently from one another.

The vulnerabilities affect customer-managed deployments of:

• Citrix NetScaler ADC and Citrix NetScaler Gateway v14.1 before v14.1-73.37 and v13.1 before v13.1-64.23
• Citrix NetScaler ADC FIPS before v14.1-73.37 FIPS and FIPS and NDcPP before v13.1-37.279

“Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities,” the vendor stated, and advised customers to upgrade to a version containing the fixes, then check for evidence of compromise and follow incident response processes if they identify signs of compromise.

Investigation and incident response

“You will need to check every box after patching for webshells,” Beaumont noted, but pointed out that the detection script provided by Citrix through the NetScaler Console only works if logs on the affected devices haven’t been rotated since the attack.

Given the activity started weeks ago, he noted, they probably have, so he advised checking SIEM logs “for base64 strings after the User-Agent field (no space) and loglines for ‘pitboss’ followed by the string IFS (so pitboss*IFS) or pitboss*b64decode.”

He also shared that the webshells are unique for each box, and the attackers ran anti forensics commands to delete artefacts.

Citrix acknowledged that, since threat actors change techniques, tactics, and procedures and infrastructure frequently, the indicators of compromise they used “might fail to identify actual compromises,” so customers should “retain the services of experienced forensic investigators to assess [their] environment.”

The US Cybersecurity and Infrastructure Security Agency (CISA) added the two actively exploited flaws to its Known Exploited Vulnerabilities catalog on Sunday and ordered US federal civilian agencies to address them by Wednesday (September 30, 2026) and perform forensic triage to check for evidence of compromise.

“CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally,” the agency warned.

NCSC-NL advised organizations to back up the devices’ memory and log files going back to at least a month before installing the updates, and to monitor the devices for suspicious traffic or anomalour actions even after they’ve been upgraded.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!