Citrix NetScaler Zero-Days 2026 (CVE-2026-88771): Compromise Check and Patch Checklist

On 27 September 2026 Citrix fixed eight vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway and warned that "exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed" (CTX697096). CISA added both to its Known Exploited Vulnerabilities (KEV) catalog that day, calling them "critical, zero-day vulnerabilities," and Google Threat Intelligence Group (GTIG) says the CVE-2026-88772 campaign has run "since at least early September." Two more followed: CVE-2026-88779, a SAML denial of service CISA listed as exploited on 4 October, and CVE-2026-107406 on 8 October, which also hits SAML identity provider appliances on the builds that fixed the September flaws.

Quick answer. Upgrade every customer-managed NetScaler ADC and Gateway to 14.1-73.46 or 13.1-64.29 or later (14.1-73.46 FIPS, or 13.1-37.283 for 13.1-FIPS and NDcPP), the first builds that satisfy all three bulletins, and turn on Enhanced ISN Generation for CVE-2026-88778. Check for compromise and preserve evidence first: CISA warns that updates "may reduce forensic visibility," and Canada's Cyber Centre that persistence "may remain on affected appliances even after the updates are applied." Any indicator means rebuilding from clean firmware, restoring a backup that predates the compromise and rotating every secret the appliance held. Stingrai, a CREST-accredited penetration testing firm, tests VPN and ADC appliances in external network engagements, runs assumed-breach tests from a compromised-gateway position and retests after you patch.

Every fact below comes from a primary source; statuses and counts are as of 13 October 2026.

What Citrix disclosed, and which flaws are exploited

Three Citrix bulletins cover ten CVEs. Descriptions and CVSS v4.0 scores are Citrix's; v3.1 scores are NVD's.

The two zero-days. Citrix says CVE-2026-88771 affects "all NetScaler ADC and NetScaler Gateway deployments," default configuration included. CVE-2026-88772 sits in DTLS handling, and GTIG says its exploitation "bypasses authentication and triggers an unhandled termination of the NetScaler Packet Processing Engine (NSPPE) to establish initial root-level access."

The October additions. CVE-2026-88779 crashes SAML-configured appliances, and CISA warns attackers "may also exploit CVE-2026-88779 to force a reboot and accelerate conditions to allow execution of code previously injected through exploitation of CVE-2026-88771." For CVE-2026-107406, CTX697191 does not report exploitation, CISA's Vulnrichment record of 9 October rates exploitation "none" and it is not in KEV, but SAML IdP appliances stay exposed on 14.1-73.37 to 14.1-73.41 and 13.1-64.23 to 13.1-64.28, the builds that fixed the September flaws.

Exploit details are public. watchTowr Labs published analyses of CVE-2026-88771 (28 September) and CVE-2026-88772 (29 September), each with a public "Detection Artefact Generator" script. Shadowserver's honeypots logged CVE-2026-88771 attempts from 110 source IPs on 30 September.

The scores disagree, as NVD's 8.1 against Citrix's 9.5 for CVE-2026-88772 shows. Let exploitation and exposure set the order of work, as BOD 26-04 does.

Fixed builds, read from Citrix's bulletins

Each bulletin names its fixed builds "and later releases," so a later build carries the earlier fixes.

• CVE-2026-88778 also needs a configuration change: enable Enhanced ISN Generation, which NetScaler's documentation says is disabled by default.

• Customer-managed only. Cloud Software Group upgrades Citrix-managed cloud services; Secure Private Access hybrid deployments using NetScaler instances must be upgraded.

• Supported lines only. The bulletins list 14.1 and 13.1, so end-of-life releases must move to a supported line; Shadowserver tagged 272 IPs as end-of-life Citrix on 11 October.

• Two bulletins also write the 13.1-FIPS builds as "13.1.37.279" and "13.1.37.283"; the table uses the hyphenated form.

What CISA's KEV catalog and BOD 26-04 say

CISA's KEV JSON feed (catalog version 2026.10.08, released 8 October and still current on 13 October) lists:

CVE-2026-107406 is not listed. The notes on the September entries read: "Customers must conduct forensic triage as directed by BOD 26-04 and follow Citrix's published guidance for mitigations."

BOD 26-04, "Prioritizing Security Updates Based on Risk," issued on 10 June 2026, binds US federal civilian executive branch agencies and revoked BOD 22-01. Its three-day deadline "& forensic triage" means the agency "must complete remediation or mitigation action within the timeline (three days) and carry out a forensic triage of the asset to assess whether the system is compromised." For everyone else it is a sound benchmark; our BOD 26-04 explainer walks through the decision table.

Check for compromise before you patch

A patch closes the hole but does not evict anyone already inside, which is why CISA says organizations that suspect compromise "should preserve forensic evidence before applying updates." CISA's forensic triage guidance sets the rhythm (scope within two hours, preserve evidence and patch within 24, contain within 24, analyze within 48, decide on escalation within 72), and Citrix's CTX694799 supplies the appliance steps.

1. Preserve evidence

• VPX: snapshot the instance, with memory state where possible (GTIG).

• Record system time, time zone and NTP settings before isolating.

• Keep remote syslog and NetScaler Console logs as well as local logs.

• Collect a technical support bundle and a packet engine core dump; Citrix warns the dump triggers a warm restart.

• MPX and SDX: take forensic disk images through your incident process.

• Log each item collected, with source, time and collector (CISA).

2. Run Citrix's scan, then keep looking

NetScaler Console's indicator of compromise detection reports "Potentially Compromised" or "No Compromise Detected" per appliance. It needs product usage telemetry, skips NetScaler BLX, and Citrix cautions it "might fail to identify actual compromises" because "threat actors change TTPs and infrastructure frequently."

3. Hunt on the appliance and in its logs

Published indicators (IPs defanged):

• GTIG: 143.198.7[.]94 (scanning and staging) and 157.254.167[.]12 (exploitation and web shell installation); command headers HTTP_NSC_LDAP, HTTP_NSC_CLIENTTYPE and HTTP_X_UX.

• LevelBlue: exploitation sources 70.172.58[.]168, 162.243.36[.]88, 173.40.135[.]209, 47.230.224[.]154, 92.118.204[.]229 and 87.224.84[.]82; payload, command and exfiltration hosts 23.27.143[.]20, 62.133.62[.]80, 64.94.85[.]67, 31.56.197[.]72 and 45.141.21[.]130; SHA-256 e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c (main.py) and 974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938 (update_c08937.pl). LevelBlue notes its payload "deletes both the configuration archive and itself," so missing files prove nothing.

• Detection content: CISA's SIGMA rule (dated 29 September) and GTIG's YARA rules for the WHIPSHOT web shell, the SLAPSHOT tunneler and tampered Apache configuration.

4. Decide: patch, or rebuild

No indicators: upgrade, revoke active sessions and keep the "heightened monitoring" CISA's guidance calls for.

Any indicator: treat the appliance as compromised.

1. Isolate it. In a high-availability pair, assess both nodes and halt configuration sync so a modified httpd.conf cannot spread to the peer (GTIG).

2. Rebuild, don't clean: erase and reinstall MPX hardware; replace VPX instances (Citrix).

3. Upgrade the firmware before restoring the configuration, from a backup that predates the compromise (Citrix; CISA).

4. Rotate everything it held: local passwords, key encryption keys, SSL certificates (revoke the old ones), LDAP, RADIUS, OAuth, API and SNMP secrets, and passwords of users who authenticated through it (Citrix).

5. Investigate what it touched, from authentication servers and StoreFront to Delivery Controllers, jump hosts and privileged access vaults (Citrix; GTIG), and monitor the rebuilt appliance for at least 90 days (Citrix).

Hit already? See the first 48 hours after a security incident.

Who is exposed

What Shadowserver sees. On 11 October Shadowserver's device statistics identified 21,326 IPs as NetScaler ADC or Gateway (19,837 NetScaler, 1,489 Gateway), plus 330 exposing a NetScaler management interface. Its scans tagged 1,171 IPs as running versions vulnerable to CVE-2026-88771 and CVE-2026-88772, down from 1,795 on 30 September, and 8,419 as "possible" CVE-2026-107406 and 5,589 as "possible" CVE-2026-88779. Shadowserver calls these assessments "version based" and notes that "mitigations/workarounds may be in place or affected features not enabled." None of these counts measures compromise.

Who was targeted. GTIG: organizations "in North America and Europe in the government, financial services, technology, education, and legal and professional services sectors were likely impacted."

Regulated firms. The Gateway is usually the remote-access front door:

• NYDFS: in DFS's text of Part 500, 500.5 requires annual penetration testing "from both inside and outside the information systems' boundaries" and timely remediation; 500.12, MFA for any individual accessing information systems; 500.17, notice "in no event later than 72 hours after determining that a cybersecurity incident has occurred," a term 500.1(g) defines (our NYDFS guide).

• HIPAA: 164.308(a)(6)(ii) requires covered entities and business associates to "identify and respond to suspected or known security incidents" and document them. If unsecured PHI was compromised, the Breach Notification Rule requires notice to individuals "without unreasonable delay and in no case later than 60 calendar days after discovery" (164.404), notice to HHS (164.408), and business associate notice to the covered entity within the same limit (164.410).

• FFIEC: the Information Security booklet (II.C.10(d)) expects an exception process "for patches that management decides to delay or not apply" and patches installed "in the disaster recovery environment in a timely manner."

• Canada: the Cyber Centre's AL26-024 asks organizations to preserve evidence before patching, to consider taking internet-facing appliances offline where risk justifies it, and to report activity to contact@cyber.gc.ca.

Why the edge keeps failing. GTIG counted 43 enterprise zero-days in 2025, "about half (21)" in security and networking products and 14 on edge devices, a figure that "likely underrepresents the true scale"; such appliances "sit outside the reach of endpoint detection and response (EDR) tools, and often store or process credentials." NetScaler alone has six CVEs added to KEV in 2026 as of 8 October, against three in 2025 (see our vulnerability and zero-day statistics).

Find every NetScaler you own. Start with NetScaler Console's Security Advisory dashboard (CVE Detection, Impacted Instances). Then search Shodan or Censys for your own IP ranges, domains and certificate names, filter for NetScaler fingerprints such as the /logon/LogonPoint/ login page, and reconcile with your inventory; HA peers, DR and cloud VPX instances are the usual misses. Shadowserver sends subscribers free daily network reports.

The NetScaler checklist: today, this week, this quarter

Where Stingrai fits

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

For a NetScaler estate the work is human-led, by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team; Stingrai Inc holds the accreditation, as its CREST Marketplace profile shows.

• External network and perimeter testing that includes the appliances: our external network penetration test covers VPN gateways, ADCs and their management interfaces: exposed services, versions and configuration (scope and cost).

• Assumed breach from a compromised gateway: an adversary simulation that starts from the access and stored credentials an attacker would hold after a NetScaler compromise and measures how far they reach into Active Directory and past your SOC (how assumed breach works).

• Retest after patching: included, so the upgraded build, the closed management plane and the rotated secrets are verified rather than assumed.

Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your NYDFS, HIPAA, PCI DSS and SOC 2 programs. Network, appliance and assumed-breach work is scoped per engagement; Stingrai's published fixed prices cover one web application and associated APIs only (pricing).

Frequently Asked Questions

Which NetScaler build fixes CVE-2026-88771?

Citrix's CTX697096 fixes it in 14.1-73.37 and 13.1-64.23 (14.1-73.37 FIPS; 13.1-37.279 for FIPS and NDcPP). Install 14.1-73.46 or 13.1-64.29 or later instead, because those builds also fix CVE-2026-88779 and CVE-2026-107406.

Is CVE-2026-88771 being exploited?

Yes. Citrix says exploits "on unmitigated NetScaler deployments have been observed," and CISA added it to the KEV catalog on 27 September 2026 after "reports and partner threat intelligence confirming threat actors are actively exploiting these vulnerabilities globally."

Does patching NetScaler remove a web shell?

No. Canada's Cyber Centre warns that persistence "may remain on affected appliances even after the updates are applied." Hunt before you patch; on any indicator, rebuild from clean firmware, restore a pre-compromise backup and rotate the appliance's secrets.

What is CVE-2026-107406, and is it exploited?

A memory overflow on appliances configured as a SAML SP or IdP, CVSS v4.0 9.5, fixed in 14.1-73.46 and 13.1-64.29 (CTX697191, 8 October 2026). CTX697191 does not report exploitation and it is not in KEV as of 13 October 2026, but SAML IdP appliances on the September fix builds remain exposed.

What deadline did CISA set for the NetScaler zero-days?

KEV lists CVE-2026-88771 and CVE-2026-88772 as added on 27 September 2026, due 30 September, with forensic triage required, and CVE-2026-88779 as added on 4 October, due 7 October. The dates bind US federal civilian agencies under BOD 26-04 and are a benchmark for everyone else.

Does disabling DTLS protect against these vulnerabilities?

Only partly. GTIG says disabling DTLS and blocking inbound UDP/443 reduce exposure to CVE-2026-88772 but "should not be relied on to mitigate CVE-2026-88771." Only a fixed build remedies both.

How many NetScaler appliances are exposed?

Shadowserver's device statistics identified 21,326 IPs as NetScaler ADC or Gateway on 11 October 2026 (19,837 NetScaler, 1,489 Gateway), and its version checks tagged 1,171 as vulnerable to CVE-2026-88771 and CVE-2026-88772, down from 1,795 on 30 September. These are exposure counts, not compromises.

Do I have to report a compromised NetScaler?

It depends on your regulator. NYDFS-covered entities must notify within 72 hours of determining that a cybersecurity incident, as 500.1(g) defines it, has occurred (23 NYCRR 500.17). If unsecured PHI was compromised, HIPAA requires notice to individuals within 60 calendar days of discovery, notice to HHS, and business associate notice to the covered entity within the same limit (45 CFR 164.404, 164.408, 164.410). Canada's Cyber Centre asks for reports of matching activity.

Related reading

• Emergency Pentest After a Security Incident

• CISA BOD 26-04: The 72-Hour KEV Remediation Clock

• Zero-Day Statistics 2026

• Vulnerability Statistics 2026

• External Network Penetration Testing Scope

• NYDFS Penetration Testing Requirements (2026)

References

1. Citrix. Security Bulletin for CVE-2026-88771 to CVE-2026-88778, CTX697096. 27 September 2026. https://support.citrix.com/external/article/CTX697096

2. Citrix. Security Bulletin for CVE-2026-88779, CTX697174. 3 October 2026. https://support.citrix.com/external/article/CTX697174

3. Citrix. Security Bulletin for CVE-2026-107406, CTX697191. 8 October 2026. https://support.citrix.com/external/article/CTX697191

4. Citrix. Steps to Take if NetScaler ADC is Suspected to be Compromised, CTX694799. https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html

5. NetScaler. Indicators of Compromise detection in NetScaler Console. https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html

6. CISA. Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway. 27 September 2026, revised 9 October. https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway

7. CISA. Known Exploited Vulnerabilities catalog, version 2026.10.08. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

8. CISA. BOD 26-04 and implementation guidance. 10 June 2026. https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

9. CISA. SIGMA rule for CVE-2026-88771 and CVE-2026-88772. 29 September 2026. https://github.com/cisagov/SIGMA_Rules

10. NIST. National Vulnerability Database records. https://nvd.nist.gov/vuln/detail/CVE-2026-88771

11. Canadian Centre for Cyber Security. AL26-024. 27 September 2026, update 2 on 9 October. https://www.cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772

12. Mandiant and GTIG. Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances. 29 September 2026. https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances

13. GTIG. Look What You Made Us Patch: 2025 Zero-Days in Review. 5 March 2026. https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review

14. LevelBlue SpiderLabs. Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators. 30 September 2026. https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators

15. watchTowr Labs. Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771), 28 September 2026, and Here We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772), 29 September 2026. https://labs.watchtowr.com/

16. Shadowserver Foundation. Public dashboard (device statistics, vulnerable HTTP and honeypot data), read 13 October 2026. https://dashboard.shadowserver.org/

17. New York State Department of Financial Services. Second Amendment to 23 NYCRR 500 (500.1, 500.5, 500.12, 500.13, 500.17). https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf

18. 45 CFR 164.308, 164.312 and 164.404 to 164.410 (eCFR). https://www.ecfr.gov/current/title-45/section-164.308

19. FFIEC. IT Examination Handbook, Information Security, September 2016. https://ithandbook.ffiec.gov/media/swzjlcxk/ffiec_itbooklet_informationsecurity.pdf

20. CISA. BOD 26-02: Mitigating Risk From End-of-Support Edge Devices. 5 February 2026. https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices

Talk to Stingrai

Patched and want proof the perimeter holds? Stingrai will scope an external test of your VPN and ADC appliances, an assumed-breach test from the gateway segment and a retest, as a one-time annual engagement or a continuous program. Get a quote.