--- title: Critical Citrix NetScaler Zero-Days Under Active... description: Two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5), affect Citrix NetScaler ADC and Gateway, enabling unauthenticated remote code... canonical: https://daily.dev/posts/critical-citrix-netscaler-zero-days-under-active-exploitation-3nob04fl1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical Citrix NetScaler Zero-Days Under Active Exploitation | daily.dev og:description: Two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5), affect Citrix NetScaler ADC and Gateway, enabling unauthenticated remote code... og:url: https://daily.dev/posts/critical-citrix-netscaler-zero-days-under-active-exploitation-3nob04fl1 og:image: https://api.daily.dev/og/posts/3NoB04FL1.png og:image:alt: Critical Citrix NetScaler Zero-Days Under Active Exploitation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical Citrix NetScaler Zero-Days Under Active Exploitation **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 3 min read · 0 upvotes · 0 comments ## Summary Two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5), affect Citrix NetScaler ADC and Gateway, enabling unauthenticated remote code execution via improper input validation and memory overflow. Both are under active exploitation globally, added to CISA's KEV catalog, and federal agencies face a September 30, 2026 remediation deadline. Six additional high-severity CVEs were patched in the same advisory (CTX697096), including HTTP request smuggling and TCP sequence number predictability issues. Affected versions include NetScaler 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23; organizations must upgrade immediately and check for compromise before patching, since updates may erase forensic evidence. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-88771 and how does it affect Citrix NetScaler? CVE-2026-88771 is a critical (CVSS 9.5) improper input validation flaw in the NetScaler management interface that allows unauthenticated remote code execution. It affects every default NetScaler ADC and Gateway deployment with no special configuration required, letting attackers send crafted requests to execute arbitrary code and pivot into internal networks or cloud workloads. _Teams tracking active exploits like this rely on daily.dev to stay ahead of NetScaler patch deadlines._ ### Which Citrix NetScaler versions are vulnerable to CVE-2026-88771 and CVE-2026-88772 and what should I upgrade to? Vulnerable versions are NetScaler ADC and Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS 14.1 before 14.1-73.37 FIPS, and FIPS/NDcPP 13.1 before 13.1-37.279. Organizations should upgrade immediately to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 FIPS/NDcPP, and check for signs of compromise before patching since updates can erase forensic evidence. _daily.dev helps admins keep pace with urgent version upgrades like this NetScaler patch cycle._ ### Why does CVE-2026-88772 in Citrix NetScaler require DTLS and what is its impact? CVE-2026-88772 is a memory overflow vulnerability that requires DTLS to be enabled, and since DTLS is turned on by default on VPN virtual servers, most VPN deployments are vulnerable out of the box. Exploitation can cause remote code execution or denial of service, making internet-facing VPN gateways a high-risk target. _Following DTLS-related exposure like this helps VPN admins on daily.dev act before attackers do._ ## Similar posts on daily.dev - [CVE‑2026‑3055](https://daily.dev/posts/cve-2026-3055-agwr1jxtq) · Arctic Wolf · 0 upvotes · 0 comments - [Citrix NetScaler bug may be multiple flaws in one](https://daily.dev/posts/citrix-netscaler-bug-may-be-multiple-flaws-in-one-kggs3gauu) · The Register · 0 upvotes · 0 comments - [Critical Citrix NetScaler Flaw Draws CitrixBleed Comparisons as Exploitation Window Narrows](https://daily.dev/posts/critical-citrix-netscaler-flaw-draws-citrixbleed-comparisons-as-exploitation-window-narrows-iikwjwkhl) · IT Security Guru · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/critical-citrix-netscaler-zero-days-under-active-exploitation-3nob04fl1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical Citrix NetScaler Zero-Days Under Active Exploitation","url":"https://daily.dev/posts/critical-citrix-netscaler-zero-days-under-active-exploitation-3nob04fl1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-citrix-netscaler-zero-days-under-active-exploitation-3nob04fl1"},"datePublished":"2026-09-29T15:47:45.340Z","dateModified":"2026-10-01T14:50:06.864Z","description":"Two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5), affect Citrix NetScaler ADC and Gateway, enabling unauthenticated remote code...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9cd1cf45fe389d11fa2c1de02dabc63c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9cd1cf45fe389d11fa2c1de02dabc63c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-citrix-netscaler-zero-days-under-active-exploitation-3nob04fl1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"Critical Citrix NetScaler Zero-Days Under Active Exploitation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/critical-citrix-netscaler-zero-days-under-active-exploitation-3nob04fl1#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-88771 and how does it affect Citrix NetScaler?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-88771 is a critical (CVSS 9.5) improper input validation flaw in the NetScaler management interface that allows unauthenticated remote code execution. It affects every default NetScaler ADC and Gateway deployment with no special configuration required, letting attackers send crafted requests to execute arbitrary code and pivot into internal networks or cloud workloads. Teams tracking active exploits like this rely on daily.dev to stay ahead of NetScaler patch deadlines."}},{"@type":"Question","name":"Which Citrix NetScaler versions are vulnerable to CVE-2026-88771 and CVE-2026-88772 and what should I upgrade to?","acceptedAnswer":{"@type":"Answer","text":"Vulnerable versions are NetScaler ADC and Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, FIPS 14.1 before 14.1-73.37 FIPS, and FIPS/NDcPP 13.1 before 13.1-37.279. Organizations should upgrade immediately to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 FIPS/NDcPP, and check for signs of compromise before patching since updates can erase forensic evidence. daily.dev helps admins keep pace with urgent version upgrades like this NetScaler patch cycle."}},{"@type":"Question","name":"Why does CVE-2026-88772 in Citrix NetScaler require DTLS and what is its impact?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-88772 is a memory overflow vulnerability that requires DTLS to be enabled, and since DTLS is turned on by default on VPN virtual servers, most VPN deployments are vulnerable out of the box. Exploitation can cause remote code execution or denial of service, making internet-facing VPN gateways a high-risk target. Following DTLS-related exposure like this helps VPN admins on daily.dev act before attackers do."}}]} ```