DaystoPatch

CitrixExploited incident

NetScaler ADC and Gateway zero-day RCE pair (input validation and DTLS memory overflow)

CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778Critical, CVSS 9.5In CISA's Known Exploited Vulnerabilities catalog since 27 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version 25 hours after the first public report.
Embed this live clock

Response

Silence
25h
First public report to first vendor statement
Exposure
25h
First public report to first fix
Follow-through
25h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Kevin Beaumont on Mastodon (cyberplace.social)CuratedQuote verified

    There are rumours swirling for the past week behind the scenes that there are two actively exploited zero days in Citrix Netscaler.

    created_at 2026-09-26T15:22:08.414Z; adds 'The rumours have now broken containment to Reddit.'

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f1275b6f81a68a06…
    Used in metrics
    Yes
    Dispute this timestamp
    10 more sources for this moment
    Kevin Beaumont on Mastodon (cyberplace.social)CuratedQuote verified26 Sep 2026, 21:50 UTC

    The Netscaler zero day thing is real, being used in active attacks. No patch yet

    created_at 2026-09-26T21:50:48.930Z. watchTowr also reported the unpatched zero-days on 2026-09-26 (not fetched).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d537880555a64a25…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Citrix advisory CTX697096ClaimedQuote verified27 Sep 2026

    Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

    The vendor's own disclosure.

    Source
    Citrix advisory CTX697096 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a687aaa69767cd65…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-88771)ClaimedQuote verified27 Sep 2026

    Citrix NetScaler Improper Input Validation Vulnerability

    Added to CISA's KEV catalog on 2026-09-27.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-88772)ClaimedQuote verified27 Sep 2026

    Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

    Added to CISA's KEV catalog on 2026-09-27.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2026-88771 (CNA: NetScaler)CuratedQuote verified27 Sep 2026, 16:02 UTC

    "datePublished":"2026-09-27T16:02:07.001Z"

    Earliest public signal that could be evidenced is Citrix's own disclosure. Rapid7 says 'rumors' of exploitation circulated the week before, and Mandiant/GTIG later said exploitation of CVE-2026-88772 had run since early September, but no dated public report before 2026-09-27 was found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7aca710e0c0df51d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-88771ClaimedQuote verified27 Sep 2026, 16:02 UTC

    Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7aca710e0c0df51d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet27 Sep 2026, 16:05 UTC

    https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Vulnerability Severity (CVSS 4) Preconditions CVE-2026-88771 9.5 None CVE-2026-88772 9.5 DTLS config enabled (enabled by default on VPN) CVE-2026-88773 9.3 HTTP Configuration enabled CVE-2026-88774 7.0 Any policy with

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet27 Sep 2026, 19:52 UTC

    Two unauthenticated NetScaler RCE zero-days are under active exploitation - patching won't undo the damage. 9 detections, 10 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Research: watchtowrClaimedQuote verified28 Sep 2026, 10:55 UTC

    Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

    Earliest mention we hold (a vetted outlet).

    Source
    Research: watchtowr research
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0d89ad0e6238f050…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet28 Sep 2026, 15:11 UTC

    Citrix NetScaler PreAuth Command Injection CVE-2026-88771

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    +25h

    CVE record CVE-2026-88771 (CNA: NetScaler)CuratedQuote verified

    "datePublished":"2026-09-27T16:02:07.001Z"

    CVE-2026-88772's record was published at 16:09:56Z the same day.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7aca710e0c0df51d…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Citrix advisory CTX697096ClaimedQuote verified27 Sep 2026

    Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

    Source
    Citrix advisory CTX697096 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a687aaa69767cd65…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Citrix bulletin CTX697096 (Wayback snapshot 2026-09-27 20:45 UTC)CuratedQuote verified27 Sep 2026

    Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.

    Changelog in the same snapshot: '2026-09-27 Initial Publication'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:450deba67a840e49…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +25h

    CVE record CVE-2026-88771 (CNA: NetScaler)CuratedQuote verified

    before 14.1-73.37

    R5 fix (2026-10-23): time and quote from the CVE record; bulletin CTX697096 (changelog '2026-09-27 Initial Publication', Wayback 20260927204512) lists the same builds.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7aca710e0c0df51d…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    +25h

    CVE record CVE-2026-88771 (CNA: NetScaler)CuratedQuote verified

    before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP

    R5 fix: the CVE record lists fixed builds for all four branches.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7aca710e0c0df51d…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

NetScaler gateways hit by two zero-day remote code execution flaws, fixed Sep 27

Attackers were exploiting two critical NetScaler ADC and Gateway flaws before Citrix released fixed builds on 27 September 2026.

In plain words

Citrix NetScaler, the remote-access gateway many companies put on the internet, had two critical flaws that attackers were using before any fix existed. Citrix released fixed versions on 27 September 2026, and attacks spread widely in the days after. If we run NetScaler, we need to be on the fixed versions (and the later 4 October update if we use single sign-on), and we should check the devices for signs of a break-in.

What happened and who is affected

What happened

On 27 September 2026 Citrix published bulletin CTX697096 covering eight NetScaler vulnerabilities and said exploits of two of them, CVE-2026-88771 and CVE-2026-88772, had been observed on unpatched appliances. CVE-2026-88771 lets an unauthenticated attacker run commands on any default deployment; CVE-2026-88772 needs DTLS, which is on by default for VPN virtual servers. Fixed builds were released with the bulletin, and researchers later reported mass exploitation.

Who is affected

Customer-managed NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, 14.1-FIPS before 14.1-73.37 FIPS, and 13.1-FIPS/NDcPP before 13.1-37.279. Citrix-managed cloud services are updated by Citrix.

CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/citrix-cve-2026-88771/

Affected products

  • NetScaler ADC
  • NetScaler Gateway
  • NetScaler ADC FIPS and NDcPP
How we built this timeline

Grouping: all eight CVEs (CVE-2026-88771 to CVE-2026-88778) are fixed by bulletin CTX697096; only 88771 and 88772 are in KEV (both added 27 Sep 2026) and the bulletin leads with 88771. Zero-day: the initial bulletin already said exploits were observed.

Mandiant/GTIG (via Help Net Security, 30 Sep 2026) said CVE-2026-88772 exploitation had been ongoing since at least early September 2026 by suspected state-sponsored actors; that was not public before the bulletin. No workaround for the exploited CVEs was published (the bulletin gives a TCP configuration change only for CVE-2026-88778).

The fixed builds were themselves later found vulnerable to CVE-2026-88779 (citrix-cve-2026-88779). CVE records: 88771 published 16:02:07Z, 88772 16:09:56Z on 27 Sep 2026.

Correction 23 Oct 2026: R3 search found Kevin Beaumont's Mastodon posts of 26 Sep 2026 (rumours at 15:22Z; 'real, being used in active attacks. No patch yet' at 21:50Z), now the earliest First public report candidates, about 25 hours before Citrix's bulletin.

GreyNoise later reported exploitation attempts from 24 Sep 2026 (retrospective).

Related

Citrix report card