Network defenders running Citrix NetScaler ADC and NetScaler Gateway appliances now have a clear, time-bound reason to patch: CISA has confirmed global active exploitation of two newly added critical flaws and given federal agencies until September 30, 2026 to remediate. Both vulnerabilities carry a CVSS score of 9.5 and allow unauthenticated attackers to take over appliances that front enterprise VPN and application delivery traffic.<\/p>\n
On September 27, 2026, CISA added the following two vulnerabilities to its Known Exploited Vulnerabilities catalog, citing partner threat intelligence confirming active exploitation worldwide:<\/p>\n
CISA noted that updating NetScaler appliances can be complex and may require downtime, and published the alert to help organizations assess exposure, prioritize mitigation, and account for these flaws in risk-management activities.<\/p>\n
No rewrite needed.<\/p>\n
Federal Civilian Executive Branch agencies have been given until September 30, 2026 to apply the fixes, with private-sector operators strongly encouraged to follow the same timeline.<\/p>\n
Technical analysis published on September 28, 2026 traced CVE-2026-88771 to a Perl script, ns_monuploadd_err.pl, which processes NetScaler crash and error information. The script builds a shell command using input that can be shaped by an attacker, and the attacker-controlled data ends up in NetScaler logs that get fed back into the script as input. The result is unauthenticated remote code execution as root.<\/p>\n
Triggering the flaw is a single pre-authentication request to the \/nf\/auth\/doAuthentication.do endpoint. A crafted POST body carries an injected shell command that runs as the appliance’s root user, giving the attacker the same level of control as an administrator on the box.<\/p>\n
Telemetry from Palo Alto Networks Unit 42 identified more than 50,277 publicly exposed NetScaler ADC and Gateway instances that appeared potentially vulnerable to both zero-days as of September 27, 2026. That number gives a sense of the attack surface available to whoever learns to weaponize the flaws reliably.<\/p>\n
GreyNoise recorded the earliest known exploitation attempt against its sensors on September 24, originating from IP address 149.104.78[.]141. That initial attempt did not succeed, but it confirmed pre-patch probing in the wild.<\/p>\n
GreyNoise described a multi-step intrusion attempt aimed at persistence and stealth. The actor tried to set the setuid and setgid bits on \/bin\/sh to obtain a root shell, then install a password-protected webshell that activates only when a specific cookie value is present, a pattern that helps hide commands from standard web-server logs.<\/p>\n
Further attempts included configuring the web server to treat a dot file (.ctxs.receiver) as a PHP file without giving it a .php extension, creating URL aliases that route requests for a non-existent cascading style sheet (receiver.min.css) to that web shell, and adding a flexible AliasMatch pattern so variable characters added to receiver.min.[0-9a-f].css paths would still reach the shell. The actor also attempted to kill the httpd process to restart the server, likely to load the new configuration. The goal across these steps is durable, low-noise access to the appliance.<\/p>\n
Citrix has published generic indicators of compromise through the NetScaler Console to help customers determine whether their deployments have been touched. If compromise is suspected, the recommended response is to preserve evidence, isolate the device, revoke credentials and access, and investigate every server and system the NetScaler ADC talked to for signs of further compromise. From there, rebuild and update the firmware to the latest fixed version, and if a restore from a known good backup is required, rotate every local account password, regenerate Key Encryption Keys (KEK), and replace all restored SSL certificates. Finally, harden the device against future attacks.<\/p>\n
They are two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. CVE-2026-88771 is an unauthenticated command injection flaw, and CVE-2026-88772 is a memory-bound flaw that can lead to remote code execution or denial of service. Both carry a CVSS score of 9.5.<\/p>\n
Yes. CISA confirmed global active exploitation and added both flaws to the Known Exploited Vulnerabilities catalog on September 27, 2026. GreyNoise recorded an exploitation attempt against its sensors as early as September 24.<\/p>\n
Fixed versions include NetScaler ADC and Gateway 14.1-73.37 and later, 13.1-64.23 and later, 14.1-FIPS 14.1-73.37, and 13.1-FIPS and 13.1-NDcPP 13.1.37.279. CISA gave federal agencies until September 30, 2026 to apply the fixes, and private organizations are urged to follow the same timeline.<\/p>\n