Home / Cybersecurity

Citrix NetScaler Gets Another Exploited Pair: Two Unauthenticated RCE Flaws Hit CISA's Catalog

Federal agencies had three days to secure appliances, and CISA's advice is unusual: look for compromise before you patch.

CybersecuritySep 27, 20263 min read2 diagrams

Key takeaways

  • CISA added two NetScaler ADC and Gateway remote-code-execution flaws to the KEV catalog on September 27, with a September 30 federal deadline.
  • Citrix confirmed exploitation on unmitigated systems; versions 12.1 and 13.0 are end-of-life and get no fixes.
  • CISA has flagged 26 exploited Citrix flaws since November 2021, six used by ransomware gangs.

On Sunday, September 27, the US Cybersecurity and Infrastructure Security Agency added two more Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until Wednesday, September 30 to secure affected appliances. Citrix confirmed the same day that attackers were using the flaws against unmitigated deployments. It is the latest in a run of exploited NetScaler bugs this year.

What was disclosed

According to BleepingComputer's report, the pair is tracked as CVE-2026-88771 and CVE-2026-88772, and both let an unauthenticated attacker run code remotely on NetScaler ADC and NetScaler Gateway. The first affects deployments in their default configuration. The second needs DTLS to be enabled, which Citrix says is on by default on VPN virtual servers. In practice, that covers the gateway role that most organizations expose to the internet for remote access.

Citrix's bulletin also lists several lesser issues under specific conditions, including denial of service, HTTP request smuggling, policy bypass and predictable TCP sequence numbers. Fixes are in NetScaler ADC and Gateway 14.1-73.37 and later, and 13.1-64.23 and later in the 13.1 branch, with matching FIPS and NDcPP builds. Versions 12.1 and 13.0 are end-of-life and receive no security updates; Citrix tells customers to move to a supported release.

Timeline of exploited Citrix NetScaler vulnerabilities in 2026 Exploited NetScaler flaws in 2026 (as reported) March CVE-2026-3055 CVE-2026-4368 Aug 26 CVE-2026-8452 in KEV Early Sept CVE-2026-19490 auth bypass Sep 27 Two unauthenticated RCEs CVE identifiers and dates as given by the cited reports; check CISA's KEV catalog for the authoritative entries.
Source: BleepingComputer, Security Affairs and OpenVPN's blog; not an exhaustive list.

Patching is not the first step

The unusual part of the guidance is the order of operations. CISA advises checking for compromise before updating, and preserving forensic evidence, because the upgrade process can erase traces on the appliance. Citrix published indicators of compromise through NetScaler Console but cautioned they have limited forensic value, which means a clean scan is not proof of a clean device. CERT-EU recommends a compromise assessment for any internet-facing appliance running affected builds.

That advice reflects how earlier NetScaler campaigns played out. Researchers described the earlier CVE-2026-8452, a memory-buffer flaw rated CVSS 8.8 in Gateway and AAA configurations, as being used in broad "pray and spray" attacks that dropped web shells about a week before CISA's warning. A web shell survives a patch. An organization that updates on day two but was compromised on day one can end up with a fixed device and a persistent intruder.

Bar showing 26 exploited Citrix flaws since 2021 of which six were used by ransomware gangs CISA-flagged exploited Citrix flaws since Nov 2021 6 20 Used by ransomware gangs Exploited, no ransomware link recorded Total: 26 exploited Citrix vulnerabilities, about 23% tied to ransomware. Shadowserver sees 23,000+ exposed NetScaler fingerprints, some honeypots or patched.
Source: BleepingComputer citing CISA data; Shadowserver count is an upper bound.

Why it matters

NetScaler sits at the network edge, terminates VPN sessions and holds credentials, so a code-execution bug there is a path into the internal network. Edge appliances have become a favorite target precisely because they are hard to monitor and often run old firmware. The 12.1 and 13.0 branches being unsupported means some organizations cannot patch at all; their only option is replacement.

The short three-day deadline also comes under CISA's newer binding directive, BOD 26-04, which has the agency pushing tighter windows than the 21-day norm of the past, though sources differ on the details of how it works.

What to watch

  • Public proof-of-concept code. Wider exploitation typically follows once technical details circulate.
  • Ransomware attribution. CISA lists ransomware use as unknown for now; that field often changes.
  • Exposure counts. Shadowserver and other scanners will show how quickly internet-facing builds are updated.
  • End-of-life gear. Organizations still on 12.1 or 13.0 should treat the appliance as unpatchable and plan replacement.

Sources

  1. CISA orders feds to patch exploited Citrix flaws by Wednesday — BleepingComputer
  2. U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog — Security Affairs
  3. CVE-2026-8452: Citrix NetScaler Exploited (KEV) — OpenVPN Blog

More in Cybersecurity