Skip to content
OriginalConnect AISign inSign up free
Image: SecurityOnline

SecurityOnlineDo Son

Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated

Part of the CVE-2026-88771 story · since 27 Sep

Quiet for 3 weekslast report 27 Oct29 articles13 outlets
27 Sep · SecurityOnline first25 Oct3 NovNowThis article14th of 29
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV. This article, 14th of 29.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV.

Citrix NetScaler ADC and NetScaler Gateway appliances are affected by CVE-2026-88771, a critical pre-authentication command-injection vulnerability rated 9.5 under CVSSv4. Citrix and CISA said on 27 September 2026 that the flaw was being exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalogue. The issue affects default configurations and can allow an unauthenticated attacker to execute arbitrary operating-system commands as root.

A related flaw, CVE-2026-88772, is also rated 9.5 and was reportedly exploited; it involves a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled.

According to watchTowr’s analysis, a NetScaler maintenance script processes log data and passes attacker-controlled text into a shell without adequate validation. An attacker can place crafted values in logs through ordinary pre-authentication requests, such as login attempts. The vulnerable script runs periodically rather than immediately, after which the injected command may execute with root privileges. watchTowr has published technical details and a GitHub-based detection-artifact generator. Citrix’s fix changes the parsing and file-handling logic so that untrusted log content cannot reach a command shell.

Administrators should upgrade urgently to NetScaler ADC and Gateway 14.1-73.37 or later, or 13.1-64.23 or later. Listed fixed FIPS and NDcPP builds include 14.1-73.37 FIPS and 13.1-37.279. Organisations should also investigate internet-facing appliances for unexpected files, processes and crash artefacts, preserve forensic images where compromise is suspected, and restrict access to management and gateway interfaces until patching is possible.

How the story developed

All 29 articles
Quiet for 3 weekslast report 27 Oct29 articles13 outlets

29 articles from 13 outlets since 27 Sep. Quiet since 27 Oct. This was the 14th report, 2 days after the first.

Now27 Sep24681921232527First reportSecurityOnline · 27 Sep, 18:30This article14th of 29 · day 2
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV. This article, 14th of 29.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Sun 27 SepDay 05
    1. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances18:30 · SecurityOnline · First report · Known exploited CVE
    2. Citrix NetScaler Zero Days Exploited Against Unpatched Systems18:30 · Security Affairs · Known exploited CVE
    3. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action20:47 · CISA · official · CISA alert · Known exploited CVE
    Show 2 more from 27 Sep
    1. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days20:47 · CISA · official · Known exploited CVE
    2. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution23:02 · CISA · official · Known exploited CVE
  2. Mon 28 SepDay 18
    1. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SecurityWeek · Known exploited CVE
    2. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SOCRadar · Known exploited CVE
    3. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now08:35 · Infosecurity · Known exploited CVE
    Show 5 more from 28 Sep
    1. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws09:47 · Security Affairs · Known exploited CVE
    2. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks12:07 · Rapid7 · Known exploited CVE
    3. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws13:21 · NCSC · official · Known exploited CVE
    4. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Known exploited CVE
    5. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed15:30 · Unit 42 · Known exploited CVE
  3. Tue 29 SepDay 21
    1. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated08:00 · SecurityOnline · Known exploited CVE · This article, 14th of 29
  4. Wed 30 SepDay 34
    1. NetScaler Flaw Exploited to Gain Root Access Before Authentication07:13 · The Hacker News · Known exploited CVE
    2. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks08:25 · Security Affairs · Known exploited CVE
    3. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells10:13 · The Hacker News · Known exploited CVE
    4. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells13:16 · SecurityWeek · Known exploited CVE
  5. Thu 1 OctDay 44
    1. Active NetScaler Zero Days Expose Devices to Remote Code Execution02:14 · SecurityOnline · Known exploited CVE
    2. Attackers Exploit Critical NetScaler Flaw to Steal Configurations04:38 · The Hacker News · Known exploited CVE
    3. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords10:28 · SecurityOnline · Known exploited CVE
    4. Citrix NetScaler Zero Days Exploited Against 50,000 Devices12:31 · DataBreaches · Known exploited CVE
  6. Fri 2 OctDay 52
    1. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks17:05 · Dark Reading · Known exploited CVE
    2. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending22:22 · SecurityOnline · Known exploited CVE

  7. Quiet for 2 days

    Mon 5 OctDay 81
    1. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes05:53 · SecurityWeek · Picked up again · Known exploited CVE

  8. Quiet for 2 days

    Wed 7 OctDay 101
    1. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access15:08 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 12 days

    Mon 19 OctDay 222
    1. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching13:24 · Cloudflare · Picked up again · Known exploited CVE
    2. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys17:00 · Rapid7 · Known exploited CVE

  10. Quiet for 8 days

    Tue 27 OctDay 301
    1. Citrix patches NetScaler flaws after active exploitation11:55 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Sign inSign up free

Updated