Skip to content
OriginalSign in
Image: Rapid7

Rapid7Rapid7

Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks

Part of the CVE-2026-88771 story · since 27 Sep

Quiet for 2 weekslast report 27 Oct29 articles13 outlets
27 Sep · SecurityOnline first22 Oct30 OctNowThis article10th of 29
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV. This article, 10th of 29.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV.

Citrix disclosed eight vulnerabilities affecting NetScaler ADC and NetScaler Gateway on 27 September 2026, including two critical remote-code-execution flaws: CVE-2026-88771 and CVE-2026-88772. Both have a CVSSv4 score of 9.5 and were confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA) as actively exploited zero-days before disclosure. CVE-2026-88771 is an input-validation flaw exploitable against vulnerable appliances in their default configuration, with low attack complexity.

CVE-2026-88772 is a memory-corruption vulnerability requiring DTLS to be enabled, and has high attack complexity. CISA said exploitation is occurring globally and added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on 27 September.

The remaining six flaws are CVE-2026-88773, an HTTP request-smuggling vulnerability rated 9.3; CVE-2026-88774, a policy-bypass flaw rated 7.0; CVE-2026-88775, CVE-2026-88776 and CVE-2026-88777, memory-overflow vulnerabilities each rated 8.8; and CVE-2026-88778, involving predictable TCP initial sequence numbers and rated 8.8. Exploitation has not been confirmed for these six vulnerabilities.

Citrix updates addressing all eight issues include NetScaler ADC and Gateway 14.1-73.37 and later, 13.1-64.23 and later, and the specified FIPS and NDcPP releases. Rapid7 recommends emergency patching and investigation of affected appliances for compromise indicators.

How the story developed

All 29 articles
Quiet for 2 weekslast report 27 Oct29 articles13 outlets

29 articles from 13 outlets since 27 Sep. Quiet since 27 Oct. This was the 10th report, 18 hours after the first.

Now27 Sep24682022242628First reportSecurityOnline · 27 Sep, 18:30This article10th of 29 · day 1
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV. This article, 10th of 29.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Sun 27 SepDay 05
    1. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances18:30 · SecurityOnline · First report · Known exploited CVE
    2. Citrix NetScaler Zero Days Exploited Against Unpatched Systems18:30 · Security Affairs · Known exploited CVE
    3. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action20:47 · CISA · official · CISA alert · Known exploited CVE
    Show 2 more from 27 Sep
    1. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days20:47 · CISA · official · Known exploited CVE
    2. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution23:02 · CISA · official · Known exploited CVE
  2. Mon 28 SepDay 18
    1. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SecurityWeek · Known exploited CVE
    2. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SOCRadar · Known exploited CVE
    3. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks12:07 · Rapid7 · Known exploited CVE · This article, 10th of 29
    Show 5 more from 28 Sep
    1. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now08:35 · Infosecurity · Known exploited CVE
    2. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws09:47 · Security Affairs · Known exploited CVE
    3. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws13:21 · NCSC · official · Known exploited CVE
    4. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Known exploited CVE
    5. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed15:30 · Unit 42 · Known exploited CVE
  3. Tue 29 SepDay 21
    1. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated08:00 · SecurityOnline · Known exploited CVE
  4. Wed 30 SepDay 34
    1. NetScaler Flaw Exploited to Gain Root Access Before Authentication07:13 · The Hacker News · Known exploited CVE
    2. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks08:25 · Security Affairs · Known exploited CVE
    3. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells10:13 · The Hacker News · Known exploited CVE
    4. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells13:16 · SecurityWeek · Known exploited CVE
  5. Thu 1 OctDay 44
    1. Active NetScaler Zero Days Expose Devices to Remote Code Execution02:14 · SecurityOnline · Known exploited CVE
    2. Attackers Exploit Critical NetScaler Flaw to Steal Configurations04:38 · The Hacker News · Known exploited CVE
    3. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords10:28 · SecurityOnline · Known exploited CVE
    4. Citrix NetScaler Zero Days Exploited Against 50,000 Devices12:31 · DataBreaches · Known exploited CVE
  6. Fri 2 OctDay 52
    1. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks17:05 · Dark Reading · Known exploited CVE
    2. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending22:22 · SecurityOnline · Known exploited CVE

  7. Quiet for 2 days

    Mon 5 OctDay 81
    1. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes05:53 · SecurityWeek · Picked up again · Known exploited CVE

  8. Quiet for 2 days

    Wed 7 OctDay 101
    1. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access15:08 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 12 days

    Mon 19 OctDay 222
    1. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching13:24 · Cloudflare · Picked up again · Known exploited CVE
    2. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys17:00 · Rapid7 · Known exploited CVE

  10. Quiet for 8 days

    Tue 27 OctDay 301
    1. Citrix patches NetScaler flaws after active exploitation11:55 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in