Patch Citrix NetScaler now: two flaws are being exploited

If your office, agency, or bank uses Citrix NetScaler Gateway for remote access, or NetScaler ADC for load balancing, patch it now. Citrix has confirmed that two newly fixed vulnerabilities are being exploited on unpatched devices, and CISA added both to its Known Exploited Vulnerabilities (KEV) catalog on September 27, 2026, with a remediation due date of September 30 for federal agencies.

Update, October 4, 2026: Citrix has since disclosed a third exploited flaw, CVE-2026-88779, which affects SAML configurations and needs newer builds than those below. See Patch Citrix NetScaler again.

What’s affected

Citrix’s bulletin covers eight vulnerabilities. The two being actively exploited are the urgent ones:

• CVE-2026-88771: remote code execution that an unauthenticated attacker can use to run commands. It affects all customer-managed NetScaler ADC and Gateway deployments, including default configurations. No special feature has to be turned on. Severity: 9.5 (CVSS v4.0).
• CVE-2026-88772: a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled. DTLS is on by default for VPN virtual servers, so most NetScaler Gateway setups are exposed. Severity: 9.5.

The other six vulnerabilities in the bulletin (request smuggling, policy bypass, and several denial-of-service issues) are fixed by the same updates.

Citrix-managed cloud services (Gateway Service and Citrix-managed Adaptive Authentication) are updated by Citrix. This alert is about appliances and virtual instances you manage yourself.

What to do

1. Update to a fixed build, or a later release in the same branch:

Branch	Fixed in
NetScaler ADC and Gateway 14.1	14.1-73.37 and later
NetScaler ADC and Gateway 13.1	13.1-64.23 and later (see the note below)
NetScaler ADC 14.1-FIPS	14.1-73.37 FIPS and later
NetScaler ADC 13.1-FIPS and 13.1-NDcPP	13.1.37.279 and later

Before upgrading to 13.1-64.23: Citrix reports a known issue where some appliances can get stuck in a reboot loop during that upgrade. Run show ns variable first. If it returns nothing, you’re fine. If it lists variables, upgrade to 13.1-64.24 instead.

Citrix’s bulletin lists fixes only for these branches. If you’re running anything older, plan the move to a supported branch now.

2. Check whether you’ve already been compromised. Because these flaws were exploited before many sites could patch, updating isn’t the whole job. Citrix is providing indicators of compromise through NetScaler Console (version 14.1-73.36 or later, with telemetry enabled) on the Security Advisory page. If you don’t use NetScaler Console, contact Citrix Support to request the scan. Citrix itself cautions that these indicators won’t catch every attack, so if anything looks suspicious, bring in experienced incident responders.

3. Keep your logs somewhere else. Citrix recommends forwarding NetScaler logs to an external logging or SIEM system, so evidence survives even if an appliance is compromised.

How to tell if DTLS is on

For CVE-2026-88772, look at your VPN virtual server configuration. A line like this means DTLS is on, because it’s the default:

add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONE

Only an explicit -dtls OFF means it’s disabled. Either way, patch. CVE-2026-88771 affects every deployment regardless of DTLS.

For office managers

If your office connects to work remotely through a “Citrix Gateway” or “NetScaler” login page, forward this to whoever manages your IT today and ask them to confirm it’s been patched. It’s the kind of flaw attackers use to break into networks through the front door. If you think something’s already wrong, see what to do in the first hour.

Sources

• NetScaler ADC and NetScaler Gateway security bulletin for CVE-2026-88771 through CVE-2026-88778 (Citrix): affected configurations, CVSS scores, fixed builds, the 13.1-64.23 reboot issue, IoC scanning, and confirmation of exploitation
• Known Exploited Vulnerabilities catalog (CISA): both CVEs added September 27, 2026, with a September 30 due date