Read this if a NetScaler ADC (application delivery controller: the computer that sits in front of company apps and decides who gets through) or a NetScaler Gateway (the same family of computer, used as a VPN door) is yours to patch. That includes a NetScaler instance inside Secure Private Access Hybrid. If Citrix hosts the service, the bulletin says they are upgrading it. Morning posts that still say there is no patch are behind the bulletin.
A firewall rule is a sentence in a config file. A NetScaler is not that sentence. It is a computer, usually bolted into a rack, and it is often the first computer the public internet can touch at a company.
Citrix, the company that sells it (the product line now sits under Cloud Software Group), uses two names for that computer. ADC means it is delivering applications: it takes a web request and hands it to a server inside. Gateway means it is the VPN (virtual private network: a tunnel that lets a laptop at home act as if it were on the office network). Plenty of companies run both jobs on one box. The box is valuable because it is the edge. Get a command running on it and you are no longer outside.
On 26 September 2026, researchers were already saying the attacks were real and that no public fix existed. Kevin Beaumont put it plainly, as quoted by Tenable: “The Netscaler zero day thing is real, being used in active attacks. No patch yet, if sensitive to Netscaler vulns switch it off.” A zero-day (a flaw attackers use before the vendor has published a fix) was the right word that day. watchTowr, the firm that raised the alarm, told reporters it was “rapidly reacting to rumors” and that “details are scarce” but “the information is credible.” That quote is from BleepingComputer’s account of watchTowr. It is not a root-cause writeup.
The fact changed on 27 September. Citrix published security bulletin CTX697096. The article page prints Created Date 09-27-2026 15:22 and Last Published Date 09-27-2026 17:14. The page does not name a time zone, so I am not going to invent one. Severity is marked Critical. The bulletin gives eight CVE numbers (a CVE is a public ID for one vulnerability, so two people can talk about the same bug without describing it from scratch). Citrix says exploits have been observed for two of them. The other six ride along in the same update. If you are still acting on a morning post that says there is no CVE and no patch, you are following a fact that expired.
Citrix’s own sentence, which I am not going to paraphrase into something scarier, is this: “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.” Unmitigated means the deployment did not yet have the fix. The bulletin does not use the word zero-day. People are using that word because the weekend warnings came before this bulletin. Citrix does not say how many customers, which country, or which attacker. I do not know those things either.
The bug that does not need a feature
NetScaler CVE-2026-88771 is remote code execution (RCE: an attacker on the network gets the computer to run instructions the attacker chose). Citrix’s cause is improper input validation, catalogued as CWE-20 (CWE is a dictionary of bug types; 20 is the entry for “the program trusted a message it should have checked”).
Read the precondition slowly, because it is the whole story. Citrix says: all NetScaler ADC and NetScaler Gateway deployments, default configuration, no additional feature required. Then it says it again in the instructions: no additional features or settings need to be enabled for the deployment to be vulnerable. There is no checkbox you forgot. Leaving the box the way it shipped is enough.
Unauthenticated means the attacker does not need a password, a VPN login, or an employee to click anything. Arbitrary commands means the attacker picks the command. The vendor score is CVSS 4.0 base 9.5 (CVSS is a shared scoring recipe, not a count of victims). The vector Citrix printed is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H.
Those letters are worth unpacking once. AV:N means the attacker can come over the network, which includes the internet. AC:L means Citrix rates the attack low complexity. AT:P means “attack requirements: present,” a flag that some condition outside the attacker’s control has to hold. Citrix does not say what that condition is. Do not invent one. The sentence to obey is the precondition: every deployment, including the default. PR:N means no privileges, which is the same idea as unauthenticated. UI:N means no person has to click. The H’s at the end mean Citrix rates the impact high on the box itself (confidentiality, integrity, availability) and high on systems beyond it.
The bug that is on unless you turned it off
CVE-2026-88772 is a different shape. It is a memory overflow (the program writes past the end of the drawer of memory it set aside), catalogued as CWE-119. Citrix says the result can be remote code execution or a denial of service (the box stops doing its job, even if the attacker does not take it over). The score is also 9.5, but the vector is not a copy of the first one: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. AC:H means high complexity. Citrix is telling you this one is harder to land reliably. AT:N means the score does not add an extra attack requirement. Harder is not the same as optional. Citrix says exploits of this one have been observed too.
The precondition is DTLS (Datagram Transport Layer Security: the padlock for UDP. UDP is the “send the packet and don’t wait for a receipt” way of moving data. Ordinary TLS, the padlock you already know as HTTPS, is built for TCP, the version that does wait for a receipt). Citrix’s note is the part people skip: DTLS is enabled by default on a VPN virtual server (a virtual server here is not a whole extra computer; it is a named door on the NetScaler, with an address and a port).
A Gateway is vulnerable if DTLS is not explicitly disabled. Other virtual servers are vulnerable if their type is DTLS. Citrix printed the patterns. The addresses below are the documentation examples from the bulletin, not targets.
add vpn vserver vpn1 SSL 10.0.0.0 443 -Listenpolicy NONENo -dtls OFF. Citrix says that means DTLS is on.
add vpn vserver vpn1 SSL 10.0.0.0 443 -dtls OFF -Listenpolicy NONEDTLS is explicitly off. This precondition is not met.
add vpn vserver vs1 DTLS 10.11.1.1 443The door itself is type DTLS. On.
add lb vserver vd_dtls DTLS 10.146.111.74 443 -persistenceType NONE -cltTimeout 120A load-balancing door (a door that spreads traffic across servers) of type DTLS. On.
Green on that picture is not a reason to skip the patch. CVE-2026-88771 does not read these lines. Turning DTLS off, if you can do it without breaking the VPN, only removes the second bug’s precondition. It is not a workaround Citrix listed for the first bug. I did not find a config workaround in the bulletin for either exploited bug. BleepingComputer’s practical line, for anyone who cannot install tonight, is to reduce internet exposure until the update is on.
Six more bugs in the same update
The bulletin fixes eight flaws. Citrix’s “exploits have been observed” sentence names only 88771 and 88772. Treat the other six as “fixed in the build you are about to install,” not as “confirmed in the wild by this bulletin.” I am not going to promote them to match the headline.
| CVE | What Citrix says it is | When it applies | Score | Observed exploits, in this bulletin |
|---|---|---|---|---|
| CVE-2026-88771 | Bad input, unauthenticated commands | Every deployment, including the default | 9.5 | Yes |
| CVE-2026-88772 | Memory overflow, commands or a crash | DTLS on, which is the VPN default | 9.5 | Yes |
| CVE-2026-88773 | HTTP request smuggling | An HTTP or SSL door: load balancing, content switching, VPN, or authentication | 9.3 | Not stated |
| CVE-2026-88774 | A policy can be bypassed | A policy expression that uses an HTTP URL | 7 | Not stated |
| CVE-2026-88775 | Memory overflow, wrong behavior or a crash | Gateway (SSL VPN, ICA proxy, CVPN, RDP proxy) or an AAA virtual server | 8.8 | Not stated |
| CVE-2026-88776 | Memory overflow, wrong behavior or a crash | A load-balancing door of type Oracle | 8.8 | Not stated |
| CVE-2026-88777 | Memory overflow, wrong behavior or a crash | Load balancing, content switching, or a CGNAT-style address translation, with a non-HTTP layer-7 feature on | 8.8 | Not stated |
| CVE-2026-88778 | TCP initial sequence number can be predicted | TCP is enabled. Also needs a config change, not only the build | 8.8 | Not stated |
Two of those need a plain-language pass so the table is not a pile of product names.
HTTP request smuggling (CWE-444) means two programs on the path disagree about where one web request ends and the next begins. A request can hide inside what the first program thought was a single request. Citrix’s score is 9.3, and the precondition is ordinary: if you have an HTTP or SSL virtual server for load balancing, content switching, VPN, or authentication, you meet it. That is a lot of boxes. It is still not in the “exploits have been observed” sentence.
A policy expression is a rule you wrote, such as “only these URLs get through.” CVE-2026-88774 says a rule built from an HTTP URL expression can fail to mean what you thought. Score 7. Check whether you have that kind of expression. Do not assume every box has it.
CVE-2026-88778 is about the TCP initial sequence number (the first number in a TCP conversation; if the next number is guessable, someone else can try to step into that conversation). CWE-342 is “predictable value.” The build is not the whole fix. Citrix says deployments hit by this one should also apply the TCP change in its enhanced ISN generation doc: enhanced ISN generation. I linked the page Citrix linked. I did not re-test the setting.
ICA proxy, CVPN, RDP proxy, and AAA are doors on the same box. ICA is Citrix’s own remote-desktop protocol. RDP is Microsoft’s. AAA here means the authentication virtual server, the door that asks who you are. CGNAT and NAT64 are ways of rewriting addresses so many machines can share one, or so an older address and a newer address can talk. You only need those names if your config uses them. If it does, 88775 or 88777 applies. If it does not, 88771 still does.
The build number is the fix, and the August build is not this build
Citrix tells customers to install one of these, as soon as possible:
- NetScaler ADC and NetScaler Gateway 14.1-73.37 and later
- NetScaler ADC and NetScaler Gateway 13.1-64.23 and later releases of 13.1
- NetScaler ADC 14.1-FIPS, 14.1-73.37 FIPS and later
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP, 13.1.37.279 and later
A build (the specific cut of the software, the number after the hyphen or the last dotted number) only fixes the line it belongs to. 14.1 and 13.1 are different lines. Being current on one does not move the other.
FIPS is the US government standard for a cryptographic module. NDcPP is a certified-security profile (a checklist a product can be tested against). If your box is one of those builds, use that row. Do not install the ordinary 13.1-64.23 build onto a FIPS line and call it done. The bulletin gives 13.1.37.279, with dots, for the FIPS and NDcPP line. I am keeping the punctuation Citrix used.
There is a separate trap from last month. In August, Citrix patched a different bug, CVE-2026-19490, an authentication bypass (a way past the login). CISA (the US cyber agency) put that older bug on its Known Exploited Vulnerabilities catalog on 9 September. Tenable, writing before today’s bulletin, counted 13 NetScaler-related entries already in that catalog, and 24 for Citrix products overall. I am not going to quote an August build number I did not re-read in that older bulletin tonight. The logic that matters is simpler: if the build on the box is still below 14.1-73.37 or below 13.1-64.23 on those ordinary lines, it is not this fix. Patching in August and stopping is how a box stays vulnerable to a bug disclosed in September.
I searched CISA’s catalog for 88771 on 27 September and did not get a hit for these two CVEs. Catalogs move. “Not listed yet” is not “not exploited.” Citrix already said the exploits were observed. The catalog is a federal to-do list. It is not the bulletin.
Who has to click the upgrade
The bulletin draws a hard line. This text is Citrix’s, shortened only by a quote: the bulletin applies to customer-managed NetScaler ADC and NetScaler Gateway. Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication. If you do not run the box, you are not the person who types the build number. You can still ask the team that does.
The next sentence is for a setup people forget is theirs. “Secure Private Access Hybrid deployments using NetScaler instances are also affected.” Those instances have to move to the recommended builds. Hybrid means part of the system is Citrix’s cloud and part is a NetScaler you still operate. The part you operate does not patch itself because the cloud half does.
The Dutch NCSC (the national cyber team for the Netherlands) would not give outsiders a victim count. BleepingComputer quotes them: they monitor threats to the Netherlands, they advise organizations that are in their constituency, and “as you’re not part of our constituency, we cannot disclose any further information at this time.” The Stack reported that a text claiming to be an NCSC note circulated and was then hard to find, and that The Stack could not confirm it. I am not using a worldwide customer count from a text the agency did not stand behind in public. One Fortune 500 security chief told The Stack that a working patch existed late Saturday for some people, before the public bulletin. That is one person’s account of a private build. The build I am willing to name is the one in CTX697096.
Installing the build does not prove the box was empty
A zero-day window is the gap between “attackers are using this” and “the fix is on your box.” Citrix has now said the first half happened, on unmitigated deployments. The patch stops the old bug from accepting a new use. It does not delete a change an attacker already made, and it does not expire a secret they already copied.
This product family has taught that lesson in public before. In 2023, CVE-2023-4966, nicknamed CitrixBleed, let attackers read session tokens (the slip that says “this person already logged in”) out of memory on internet-facing NetScalers. The token could be replayed, which skips the password and skips MFA (the second check, such as a phone prompt), because those checks already happened when the token was born. The Stack’s recap of that campaign is the short version: patching the leak did not log out sessions that had already been stolen. I am using that history as a shape, not as a claim that today’s bugs are the same bug. They are not. 88771 is described as commands. 88772 is described as a memory overflow that can lead to commands or a crash. Neither description says “session token” in the bulletin.
What the bulletin also does not give you is an IOC (indicator of compromise: a filename, an address, or a log line the vendor says means “we saw the exploit”). I did not find one in CTX697096. There is nothing honest to grep for tonight except your own build number and your own odd logs. Tenable, earlier on 27 September, also said there was no public proof-of-concept (a published demo of the exploit). I am not going to go find one, and I am not going to repeat blogs that already claim a packet-engine root shell. An unattributed writeup has been describing a chain down to nobody or root inside the packet engine. That detail is not in the bulletin. I could not tie it to a named researcher or to Citrix. It does not go in the instructions.
What to do, in order
- Find out who runs the box. Customer-managed, including Secure Private Access Hybrid instances, is your upgrade. Citrix-managed cloud and Citrix-managed Adaptive Authentication is theirs, by the bulletin’s wording.
- Read the build, not the month you last patched. Ordinary lines need 14.1-73.37 or later, or 13.1-64.23 or later. FIPS and NDcPP need the matching row, 14.1-73.37 FIPS or 13.1.37.279.
- Do not talk yourself out of 88771 with a feature list. Default qualifies.
- For 88772, look for a VPN virtual server that does not say
-dtls OFF, and for any virtual server whose type is DTLS. Turning DTLS off is not a substitute for the build. - If you cannot install tonight, reduce internet exposure. That is the interim step in the reporting. It is not a Citrix workaround I found for these two bugs.
- After the build is on, treat a box that faced the internet as possibly already used. Kill sessions you cannot explain. Look for admin accounts and config changes you did not make. The bulletin will not hand you a search string.
- If TCP matters on that box, also apply the enhanced ISN setting Citrix linked for CVE-2026-88778. The build alone is not the instruction they printed for that one.
- Ignore a writeup that names a root shell, a packet engine, and a bypass of ASLR (address space layout randomization: a defense that shuffles where code sits in memory) unless Citrix or a named researcher you can check says the same thing. The useful document tonight is CTX697096.
Where this came from
The build numbers, the preconditions, the config patterns, the cloud-versus-customer line, the Secure Private Access Hybrid line, and the sentence about observed exploits are from CTX697096, as published on the Citrix support page on 27 September 2026. BleepingComputer’s confirmation piece is the source for the watchTowr quote, the NCSC-NL quote, and the “reduce internet exposure” interim step. The Stack is the source for the single Fortune 500 account of a private Saturday patch, for the note that a supposed NCSC text could not be confirmed, and for the short CitrixBleed history I am using only as a shape. Tenable’s FAQ is the source for the Beaumont quote and for the “13 NetScaler KEV entries” count, and that FAQ was written while it still believed no patch existed. I checked CISA’s catalog search for 88771 on 27 September and did not see these two CVEs. I did not test an exploit. I did not count victims. If the bulletin moves, the build number on that page wins over this draft.
Common questions about NetScaler CVE-2026-88771
Does NetScaler CVE-2026-88771 need a special feature enabled?
No. Citrix says every NetScaler ADC and Gateway deployment is in scope in the default configuration. No additional feature is required.
Is turning DTLS off enough?
No. Turning DTLS off can remove the precondition for CVE-2026-88772 only. It is not a workaround Citrix listed for CVE-2026-88771. Install the build.
Which build fixes it?
Ordinary lines: 14.1-73.37 or later, or 13.1-64.23 or later. FIPS and NDcPP need the matching row in CTX697096, including 13.1.37.279 for those certified lines.