Two 9.5-Rated “Digital Front Doors”: Why Attackers Are Hammering Citrix NetScaler and Why You Need to Move Now

What happens when the guardian of the network, the security appliance itself gets broken into? 

On September 27, 2026, an alert went out that should put every cybersecurity professional on high alert. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added two vulnerabilities in Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772) to its “Known Exploited Vulnerabilities” (KEV) catalog. This isn’t routine paperwork, it’s a global threat notice backed by hard evidence: attackers are actively exploiting these flaws in real time, seizing remote code execution (RCE) on unpatched devices. 

This isn’t just about two “high-severity bugs.” It’s a battle over the digital front door of the enterprise. 

Why NetScaler Is So “Tempting” 

Citrix NetScaler (formerly NetScaler ADC and Gateway) isn’t just another server. It’s the aorta of enterprise networking – distributing traffic between applications and users and serving as the “front door” for remote work VPNs and authentication at many organizations. 

Think of it as the drawbridge of a heavily fortified castle. If the drawbridge falls, an attacker doesn’t just see the moat, they walk straight across it and into the great hall. Because NetScaler appliances are typically exposed directly to the internet to deliver services, they’re naturally a high-value “crown jewel” in attackers’ eyes. 

The “Kill Power” and “Ease of Use” of These Flaws 

These two vulnerabilities were flagged as “critical” by CISA not just because of their staggering CVSS score of 9.5 out of 10, but because of how they’re exploited: 

CVE-2026-88771 (Unauthenticated Input Validation Error): What makes this one terrifying is that it requires no preconditions. It affects NetScaler ADC and Gateway across all affected versions – even default configurations aren’t spared. That means an unauthenticated remote attacker can craft a specific request and execute arbitrary commands directly on the appliance. 

CVE-2026-88772 (Memory Buffer Overflow): Exploiting this one requires DTLS (Datagram Transport Layer Security) to be enabled. But here’s the deadly trap – DTLS is on by default on VPN virtual servers. That puts the vast majority of NetScaler Gateway deployments in the danger zone. Attackers can leverage the memory overflow to achieve the same remote code execution or launch denial-of-service attacks. 

The Iron Rule: “Forensics First, Then Patch” 

Unlike the usual “patch immediately” response flow, CISA offered a critical and easily overlooked piece of guidance in this alert: If possible, check whether the device has already been compromised before patching. 

This isn’t busywork. Both Citrix and CISA emphasize that patching or rebooting a device can destroy or wipe out valuable forensic evidence (such as malicious payloads in memory or access logs). If an attacker is already lurking in your network, a hasty reboot may only sever your trail of evidence, letting them hide deeper in the system. 

The correct order is: 

1. Forensics first: If compromise is suspected, preserve evidence first (memory dumps, logs). 

2. Hunt for IoCs: Citrix has published Indicators of Compromise (IoC) through NetScaler Console to help organizations determine whether they’ve been hit. 

3. Isolate and rotate: If compromise is confirmed, isolate the device immediately. But the job is far from over – NetScaler stores a wealth of sensitive credentials, session information, and SSL keys. You must rotate all related local passwords, Key Encryption Keys (KEK), and replace all recovered SSL certificates. 

As Citrix advises, once compromise is suspected, the safest path may be to rebuild the appliance from a known-good backup after preserving evidence, rather than simply applying a patch on top of an infected system. 

An Action Guide for Defenders 

If you or your organization uses Citrix NetScaler ADC or Gateway, here’s what you should do right now: 

Step One: Check Your Version 

Immediately verify your appliance version. Affected versions include: 

1. NetScaler ADC and Gateway 14.1 (below 14.1-73.37) 

2. NetScaler ADC and Gateway 13.1 (below 13.1-64.23) 

3. NetScaler ADC FIPS 14.1 (below 14.1-73.37 FIPS) 

4. NetScaler ADC FIPS and NDcPP 13.1 (below 13.1-37.279) 

Watch for a critical trap: even if you installed the August 2026 fix for CVE-2026-19490, that does not mean you’re protected that build still falls below the new remediation threshold.

Step Two: Upgrade to a Safe Version

Move appliances to: 

1. 14.1-73.37 or later 

2. 13.1-64.23 or later (note: check Citrix guidance regarding potential reboot loops) 

3. The corresponding FIPS/NDcPP versions 

Step Three: Check and Harden Configurations 

1. Verify whether DTLS is enabled (it’s on by default for VPN virtual servers). 

2. For SAML authentication, validate that identity providers issue signed SAML assertions (new NetScaler versions no longer accept unsigned assertions). 

3. For CVE-2026-88778 (a related vulnerability), enable enhanced initial sequence number generation under Citrix’s guidance. 

Step Four: Review Your Exposure 

Never expose the NetScaler management interface directly to the public internet. Restrict management access to a trusted management network or VPN. 

The Bottom Line: Security Is Never “Patched and Done” 

The Citrix NetScaler crisis is yet another wake-up call: patching is only the baseline of security. Assuming a vulnerability may already have been exploited and that your system may already be breached is the survival rule in today’s threat landscape. 

From the infamous “Citrix Bleed” (CVE-2023-4966) in 2023, which enabled the LockBit ransomware gang to launch mass intrusions, to today’s two unpatched zero-days, NetScaler has consistently been a high-value target. Attackers won’t wait for you to schedule a comfortable maintenance window. They’re out there on the network right now, testing every door that might be unlocked. 

For security teams responsible for critical infrastructure, the coming hours matter enormously. This alert is not a drill. It demands immediate verification, deliberate action, and a serious embrace of the assumption that “the system may already be compromised.” In the world of cybersecurity, the most dangerous thing is rarely the vulnerability you know about it’s the one you think you’ve handled, but that’s already being exploited. 

This article is based on information published in CISA’s official alert: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway 

If you’re reading this article, use the discount code CQBLOG_AMSC27_CITRIX at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.

Want to learn more?

Join our FREE live webinar:

Secure Users: Designing Workstations for Threat Resistance

Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.

Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.

Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.

Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.

Register for free:
👉 https://luma.com/SecureUsers