Two Citrix NetScaler Zero-Days Were Exploited for Weeks Before Anyone Outside Was Told

NetScaler isn't a server sitting quietly in a rack somewhere. For most organizations that run it, it's the front door, the load balancer and VPN gateway standing between the open internet and everything behind it. That's exactly what makes CVE-2026-88771 and CVE-2026-88772 worth stopping on. Both are unauthenticated remote code execution bugs, both score a 9.5, and both were being exploited in the wild for weeks before the public had any idea, until a security research firm's honeypot network forced the story into the open a full day before Citrix had a patch ready.

What these two bugs actually let an attacker do

CVE-2026-88771 comes down to improper input validation that lets an attacker run arbitrary commands, and it affects every NetScaler ADC and Gateway deployment, default configuration included, no special setup or feature flag required to be vulnerable. CVE-2026-88772 is a memory overflow bug leading to remote code execution or denial of service, with one prerequisite: DTLS has to be enabled, which happens to be the default state for VPN virtual servers, so in practice most Gateway deployments running VPN access qualify anyway. Neither bug needs a valid account. Neither needs a person on the other end to click anything. Network reachability to the appliance is the entire bar.

The Dutch national cyber security center, NCSC-NL, put the impact in blunt terms: successful exploitation hands an attacker full control of the gateway, which is direct access to the internal corporate network sitting behind it. That's the part worth sitting with if you've ever thought of a VPN gateway as a perimeter device rather than a target in its own right. It's both.

The disclosure timeline is almost as notable as the bugs

Attackers had been active against unpatched NetScaler appliances since early September 2026, "this entire month" by the time it became public, per watchTowr's own account. Researchers characterized the activity as likely nation-state aligned, well-resourced, and oriented toward espionage rather than smash-and-grab crime, which fits a pattern of deliberately quiet access rather than loud, fast exploitation. WatchTowr identified the exposure through its automated Rapid Reaction testing and confirmed active in-the-wild exploitation using its own honeypot network, publishing a public warning on September 26, before Citrix had assigned CVE numbers or shipped a fix. Citrix confirmed both vulnerabilities and released patches the very next day, September 27, under bulletin CTX697096, and CISA added both to its Known Exploited Vulnerabilities catalog the same day.

That ordering matters. Usually the sequence is vendor advisory, then CVE, then proof it's being exploited. Here, a security firm's own detection network is what pushed the disclosure forward, meaning the multi-week gap between "attackers start using this" and "the public and unaffected organizations find out" was closed by outside pressure rather than the normal responsible disclosure clock. Guidance during that final weekend varied by source. Some IT suppliers, law enforcement contacts, and CERTs reportedly told organizations privately to shut affected NetScaler appliances down immediately. NCSC-NL's own public position was more measured: prepare for patches, implement whatever safeguards are operationally possible, and don't force a shutdown if that itself causes more damage than it prevents. Both positions are defensible. Neither changes what the actual fix is.

Every affected build, and what to move to

Citrix's bulletin bundles six further vulnerabilities into the same release, CVE-2026-88773 through CVE-2026-88778, ranging from CVSS 7.0 to 9.3. None of those six are reported as actively exploited the way the first two are, but they ship in the same patch train, so there's no version where you can take the urgent fix and skip the rest.

Why patching this one is necessary but not the whole job

This is the part that separates CVE-2026-88771 and -88772 from a routine "patch when convenient" bulletin. Exploitation predates the patch by weeks. Anyone whose NetScaler Gateway, VPN, or AAA virtual server was reachable from the internet at any point in September, before the September 27 fix, has to treat this as a possible-compromise investigation, not just a version bump. That's a genuinely uncomfortable position for a security team to be in, and it's exactly the scenario the 24-hour threat hunt I ran through my own SOC lab's alert volume was built around: the assumption that a control existing doesn't mean a compromise didn't already happen underneath it, and the only way to know is to go look.

Citrix's own indicator-of-compromise check, available through NetScaler Console 14.1-73.36 and later, only works if the logs on the affected device haven't rotated past the attack window, which for a multi-week exploitation window is a real risk on appliances with short log retention. Researchers published two things worth checking manually before that log rotation makes the question unanswerable: a base64-encoded string appended directly after the User-Agent header with no space separating them, and the string pitboss followed by IFS, or the broader pattern pitboss*b64decode. Preserving logs to external SIEM storage now, even before you've finished the investigation, is worth doing simply so the evidence still exists by the time you get to it.

The takeaway for anything sitting at your network's edge

NetScaler is an application delivery controller, the same category of device CCNA material touches on as a load balancer and reverse proxy for published services, and a VPN gateway on top of that. Those two roles together mean it's simultaneously one of the most business-critical devices in a network and one of the most exposed, reachable from anywhere by design because that's the entire point of a gateway. An unauthenticated RCE in a device built to be internet-facing isn't a hypothetical worst case, it's the worst case the device's own job description invites. Patch first, always. But when a bug's exploitation window opens before its disclosure does, patching is the start of the response, not the end of it.

Frequently asked questions

What are CVE-2026-88771 and CVE-2026-88772?

Two critical, unauthenticated remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, both scoring CVSS 9.5. CVE-2026-88771 is improper input validation that lets an attacker run arbitrary commands on any deployment, including default configuration, with no special setup. CVE-2026-88772 is a memory overflow bug that leads to RCE or denial of service, but only on systems with DTLS enabled, which is the default on VPN virtual servers.

Do these vulnerabilities require a username and password?

No. Both are exploitable by anyone with network access to the appliance, no valid account and no user interaction required. That is what makes an internet-facing NetScaler Gateway, VPN, or AAA virtual server a priority target rather than a routine patching item.

How long were these bugs exploited before they were disclosed?

Active exploitation began in early September 2026 and continued through the month before watchTowr's public warning on September 26 and Citrix's confirmation with patches the next day. Researchers who observed the activity described the attackers as likely nation-state aligned, well-resourced actors running an espionage operation rather than opportunistic criminals, which lines up with a multi-week quiet exploitation window before anyone outside the attack was told.

If I've already patched, am I safe?

The patch stops new exploitation, but it does not undo anything that already happened during the weeks these bugs were active in the wild before Citrix shipped a fix. If your NetScaler was internet-facing and unpatched at any point in September 2026, patching now closes the door without telling you whether someone already walked through it. Checking logs for the indicators researchers published is the only way to know.

What are the patched versions?

NetScaler ADC and Gateway 14.1-73.37 or later, and 13.1-64.23 or later, with equivalent FIPS builds at 14.1-73.37 FIPS and 13.1-37.279. Citrix's bulletin CTX697096 also disclosed six additional, less urgent vulnerabilities, CVE-2026-88773 through CVE-2026-88778, that the same patch train addresses.

What should I check if I can't confirm I patched in time?

Look through NetScaler access logs, before they rotate, for a base64-encoded string appended directly after the User-Agent header with no space, and for the string pitboss followed by IFS, or the pattern pitboss*b64decode. Citrix's own built-in indicator-of-compromise check only works if logs haven't already rotated past the attack window, so preserving logs and shipping them to external SIEM storage matters as much as running the check itself.