Citrix NetScaler zero days are under attack. Patch and check for webshells

Attackers were breaking into Citrix NetScaler appliances before a fix existed. Citrix has now released patches for two critical vulnerabilities in NetScaler ADC and NetScaler Gateway, SecurityWeek and Rapid7 reported, and both flaws were already being exploited in the wild. If your organization runs NetScaler for remote access, patching is only half the job. You also need to check whether someone got in first.

The Citrix NetScaler zero days

The vulnerabilities are tracked as CVE-2026-88771 and CVE-2026-88772 and each carries a severity score of 9.5 out of 10.

According to Rapid7, CVE-2026-88771 is an improper input validation flaw that allows remote code execution on an appliance in its default configuration. No extra features need to be switched on, and Rapid7 described the attack complexity as low, which means exploitation is likely to be reliable. SecurityWeek reported that it can be exploited without authentication.

CVE-2026-88772 is a memory overflow that can lead to remote code execution or a denial of service. It only affects appliances with DTLS enabled. Rapid7 rated it harder to exploit, but SecurityWeek noted that DTLS is on by default for VPN virtual servers, so a large share of remote access deployments are in scope anyway.

SecurityWeek reported that Citrix's advisory covers eight vulnerabilities in total, including HTTP request smuggling, denial of service and security bypass issues. The two zero days are the urgent ones.

NetScaler devices sit at the edge of corporate networks and handle remote access for employees and contractors. That position is exactly why they are a favorite target. A compromised gateway can expose credentials, session tokens and a direct path into internal systems, and it is often less closely monitored than a laptop or a server.

Affected versions

According to Citrix bulletin CTX697096, as summarized by Rapid7, these builds need updating:

• NetScaler ADC and Gateway 14.1 before 14.1-73.37.
• NetScaler ADC and Gateway 13.1 before 13.1-64.23.
• NetScaler ADC 14.1 FIPS before 14.1-73.37 FIPS.
• NetScaler ADC 13.1 FIPS and 13.1 NDcPP before 13.1.37.279.

Patches were released on September 28. If you run an older branch that is no longer supported, there may be no patch for it at all, and moving to a supported version is the only real fix.

How the attacks unfolded

Rapid7 said the earliest exploitation it observed dates to September 20, more than a week before patches were available. In the activity it tracked, attackers used command injection to bundle up the contents of the appliance's configuration directory, which holds encrypted admin passwords, SSL certificates, SSH keys and license data. Rapid7 confirmed two compromised organizations, and in the second case the attacker placed a webshell in the logon directory on September 24.

That detail matters. A webshell is a small script that lets an attacker run commands through the web server later, even after the original hole is closed. Stolen certificates and keys keep their value after a patch too.

SecurityWeek reported that many administrators shut their appliances down as soon as they heard warnings from suppliers, national CERT teams and managed detection providers, often before Citrix had published anything. The Dutch National Cyber Security Centre gave advance notice to some organizations under restricted sharing rules, according to SecurityWeek. Pulling the plug on a remote access gateway is disruptive, so the fact that admins did it anyway says a lot about how seriously they took the threat.

Government response

The Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities catalog on September 27 and gave federal civilian agencies until September 30 to patch, SecurityWeek reported. CISA's alert said threat actors were actively exploiting the vulnerabilities globally. A three day deadline is unusually short and signals active, widespread attacks.

CISA's deadlines only bind federal agencies, but private companies treat the KEV list as a strong signal of what to fix first. When something lands there with a deadline this tight, it belongs at the top of every patch queue.

What to do

1. Upgrade to a fixed version right away. Rapid7 advised treating this as an emergency update outside normal patch cycles.
2. Hunt for webshells and unfamiliar files. Patching closes the hole but does not remove an attacker who is already in. Pay particular attention to the logon directory and recently modified files. Citrix has published indicators of compromise to help.
3. Kill active sessions after upgrading. Existing sessions can survive a patch, so end them and force users to sign in again.
4. Rotate secrets. Change admin passwords and credentials that passed through the device. If the configuration directory may have been copied, plan to replace SSL certificates and SSH keys as well.
5. Review logs from before the patch. Look back to at least mid September for unusual requests, new admin accounts or outbound connections you cannot explain.
6. If you find evidence of compromise, treat it as an incident. Rebuilding the appliance from a clean image is safer than trying to clean it in place, and the investigation should extend to systems the gateway could reach.

If your company uses NetScaler for remote access and you are not sure it has been patched, ask your IT team today.

Why edge devices keep getting hit

This is not the first time NetScaler has been in this position, and it will not be the last for edge gear in general. VPN gateways, firewalls and file transfer appliances share the same problem: they must face the internet, they hold credentials, and they are often patched less often than ordinary servers because downtime is painful.

Attackers have also become much faster at turning a flaw into a working exploit. Bain's latest technology report estimated that AI has cut the time a typical cyberattack takes from about four weeks to about 18 hours, as we covered in our story on Bain's $6 trillion AI revenue forecast. That leaves defenders very little room.

Breaches that start at the network edge often end with large data losses further inside. The recent Pentagon personnel data breach is a reminder of how long attackers can sit unnoticed once they are in.

What it means for employees

Most people who use NetScaler never see it. It is the login page they hit before reaching email or internal apps. If your employer asks you to sign in again, reset your password or reenroll a security key in the coming days, that is probably part of the cleanup, so do it promptly. Just make sure the request comes through a channel you trust, since attackers like to piggyback on real incidents with fake reset emails. Our guides to choosing a password manager and securing your accounts in 10 minutes cover the habits that help. More security news is in our tech section.

Frequently asked questions

Is my organization affected if it uses Citrix Workspace but not NetScaler?

These flaws are in NetScaler ADC and NetScaler Gateway. Many companies use NetScaler Gateway as the front door to Citrix virtual apps, so check with your IT team whether a gateway sits in front of your setup.

Does patching remove an attacker who is already inside?

No. The update closes the vulnerability, but a webshell or stolen credentials can still give an attacker access. That is why the hunting, session reset and credential rotation steps matter.

Which of the two flaws is more dangerous?

CVE-2026-88771 works against default configurations and is easier to exploit, according to Rapid7. CVE-2026-88772 needs DTLS, but that is on by default for VPN virtual servers, so both deserve urgent attention.

Why did CISA give only three days?

Short deadlines are reserved for flaws under active, widespread exploitation. CISA said attackers were exploiting these globally.