CISA Warns of Critical Citrix NetScaler RCE Flaws CVE-2023-4966, CVE-2023-4967

Key Takeaways

• Two critical zero-day vulnerabilities (CVE-2026-88771, CVE-2026-88772) in Citrix NetScaler ADC and Gateway appliances are being actively exploited.
• The flaws allow unauthenticated remote code execution and have a high CVSS v4 severity score of 9.5.
• Citrix has released emergency patches, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added them to its Known Exploited Vulnerabilities catalog.
• Organizations must prioritize patching and investigate for signs of compromise, as patching alone may not remove risk if a device is already breached.

Critical Citrix NetScaler Flaws Under Active Exploitation

Cybersecurity agencies and vendors are sounding the alarm over two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that are currently being exploited in the wild. These security defects enable threat actors to achieve remote code execution on vulnerable systems, posing a severe risk to organizations globally.

The vulnerabilities, identified as CVE-2026-88771 and CVE-2026-88772, have been assigned a critical CVSS v4 severity score of 9.5 out of 10. Given their active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has promptly added both to its Known Exploited Vulnerabilities catalog. CISA has corroborated reports and intelligence from partners indicating widespread exploitation activities.

Citrix responded with emergency updates following confirmation that attackers were successfully targeting unpatched, customer-managed NetScaler deployments. NetScaler products are frequently deployed at the network perimeter, providing essential services such as application delivery, load balancing, VPN access, and secure remote connectivity. This strategic placement makes compromised appliances exceptionally valuable to attackers, as they can act as a bridge between external internet users and internal corporate networks.

Details of the Vulnerabilities

CVE-2026-88771 is an improper input validation vulnerability. This flaw permits an unauthenticated remote attacker to execute arbitrary commands on a vulnerable NetScaler ADC or Gateway instance. Critically, this vulnerability affects all susceptible deployments, including those with default configurations, as no optional features need to be enabled for it to be exploitable. Citrix has characterized this issue as having low attack complexity, meaning threat actors do not require an account or user interaction to initiate exploitation.

CVE-2026-88772, on the other hand, is a memory overflow vulnerability. Exploitation of this flaw can lead to either remote code execution or denial-of-service conditions. Unlike CVE-2026-88771, this vulnerability specifically requires Datagram Transport Layer Security (DTLS) to be enabled. DTLS is typically enabled by default on NetScaler VPN virtual servers unless explicitly disabled by administrators. Consequently, remote-access deployments are a primary focus area for security teams to review. Citrix has provided configuration checks to assist administrators in determining if DTLS is active on their NetScaler virtual servers.

Both zero-day vulnerabilities were publicly disclosed on September 27, 2026, alongside six other NetScaler flaws. Citrix confirmed that active exploitation of these two remote code execution issues was occurring prior to the release of official fixes.

Affected Versions and Patching Guidance

Security teams should treat the remediation of these vulnerabilities as an active incident response priority rather than a routine patching task. The vendor’s security bulletin specifies that NetScaler ADC and Gateway 14.1 releases prior to 14.1-73.37, and 13.1 releases prior to 13.1-64.23, are vulnerable. Additionally, NetScaler ADC 14.1-FIPS builds before 14.1-73.37 FIPS and 13.1-FIPS or NDcPP builds before 13.1-37.279 are also affected. Customers utilizing Secure Private Access Hybrid with vulnerable NetScaler instances must also upgrade these instances. It is important to note that Citrix-managed cloud services are not impacted by this bulletin, as Cloud Software Group directly applies updates to these services.

Administrators are strongly advised to identify all customer-managed NetScaler ADC and Gateway systems, particularly those accessible from the public internet, and upgrade them to the fixed releases as quickly as operationally feasible. Citrix recommends upgrading to version 14.1-73.37 or later for the 14.1 branch and 13.1-64.23 or later for the 13.1 branch. FIPS and NDcPP deployments require their corresponding patched releases. Organizations should also verify whether CVE-2026-88772 applies by reviewing their DTLS-enabled VPN and other virtual server settings.

According to CISA, simply patching may not eliminate the risk if a device has already been compromised. CISA recommends that organizations actively search for signs of compromise before applying updates and centralize NetScaler logs to a SIEM or log-retention platform, as local appliance logs can quickly overwrite crucial evidence. CISA has also provided a Sigma detection rule resource to aid in threat hunting for suspicious NetScaler activity.

The scope of this situation has expanded beyond the initial two flaws. CISA updated its alert on October 9 to include CVE-2026-107406 and to emphasize the urgent need for updates for all vulnerabilities from CVE-2026-88771 through CVE-2026-88779. CVE-2026-88779, a separate, actively exploited SAML-related NetScaler issue, can cause a denial of service and may potentially be leveraged to force a reboot, facilitating the execution of code previously injected via exploitation of CVE-2026-88771.

What You Should Do

• Patch Immediately: Upgrade all customer-managed NetScaler ADC and Gateway systems, especially internet-facing appliances, to the latest patched versions (14.1-73.37+ or 13.1-64.23+).
• Hunt for Compromise: Before patching, actively look for indicators of compromise. Do not assume patching alone will remove an existing threat.
• Centralize Logs: Ensure NetScaler logs are forwarded to a central SIEM or log-retention platform to prevent evidence overwriting and facilitate long-term analysis. Utilize CISA’s Sigma detection rules for threat hunting.
• Verify DTLS Status: Review configuration settings for DTLS-enabled VPNs and other virtual servers to determine exposure to CVE-2026-88772.
• Incident Response Plan: If compromise is suspected, preserve all evidence (system snapshots, support bundles, memory data, remote syslog records). Isolate the affected appliance, rotate credentials and certificates, investigate connected systems, and rebuild from a known-good backup.
• Stay Updated: Monitor official Citrix advisories and CISA alerts for any further developments, including additional vulnerabilities or exploitation techniques.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.