CRITICAL: Citrix NetScaler Zero-Days Patched, Now Hunt for Webshells

Update, October 5, 2026: Citrix has disclosed a further NetScaler flaw, CVE-2026-88779, a CVSS 8.7 memory overflow affecting ADC and Gateway appliances configured for SAML that is being exploited to crash devices. If you patched for the September zero-days below, you still need this one. See our CVE-2026-88779 advisory.

Update, October 1, 2026: Citrix has shipped fixes and the flaws now have CVE identifiers. The two zero-days are CVE-2026-88771 (improper input validation allowing unauthenticated remote command execution against a default configuration) and CVE-2026-88772 (a memory overflow reachable when DTLS is enabled, which it is by default on virtual VPN servers). The patched builds are NetScaler ADC and Gateway 14.1-73.37 and later and 13.1-64.23 and later, released September 27, with the FIPS variants covered separately. CISA added both to the Known Exploited Vulnerabilities catalog on September 27 and set a federal remediation deadline of September 30, which has now passed. Patching is not the end of this one. Citrix and the responders working these intrusions are explicit that the fix does not evict an attacker who was already inside: webshells were deployed per device, anti-forensics commands were run to delete the evidence, and Citrix recommends engaging forensic investigators because its own published indicators may not cover every technique in use. If your appliance was internet-facing before September 27, patch first, then assume breach and go looking. The original September 27 advisory follows, with the passages the patch has overtaken corrected in place.

If you run NetScaler at the edge of your network, this was not the weekend you were hoping for. Security firm watchTowr said on September 26 that two new remote code execution flaws in Citrix NetScaler ADC and NetScaler Gateway are being exploited in the wild as zero-days. When this was first written there was no patch, no CVE, no formal Citrix advisory, no published workaround and no public set of indicators of compromise. All of that has since changed, as the update above sets out. What there was, according to watchTowr, was "two vulnerabilities, both remote code execution, both unpatched, exploited before any fix existed, discovered during forensic investigations."

That last part is the one that should keep you up. These bugs were not found by a researcher poking at a lab box. They were found by incident responders cleaning up after real intrusions, which means somebody has already been using them against production appliances for an unknown stretch of time.

How This Surfaced

The first public hint came on September 25, when a post on the r/Citrix subreddit described a pre-notification reportedly sent by the Dutch National Cyber Security Centre (NCSC-NL) about unpatched NetScaler flaws. Administrators in the thread described the issue as remote code execution "with little effort," and some said they were pulling their internet-facing appliances offline rather than wait. A day later watchTowr went on the record, saying it had "verified the reports with authoritative sources" and confirming that both flaws had been exploited before any fix existed.

For most of Sunday, September 27, neither Citrix nor NCSC-NL had published a formal bulletin, and defenders were working from secondhand warnings and a vendor that had said nothing publicly, which is roughly the security equivalent of a smoke alarm going off in a building with no fire exits marked. Citrix closed that gap later the same day with patched builds and CVE assignments.

What We Know About the Flaws

At disclosure the honest answer was not much. CVE identifiers have since been assigned, CVE-2026-88771 and CVE-2026-88772, and the affected builds are now named: anything before 14.1-73.37 on the 14.1 train and anything before 13.1-64.23 on 13.1, plus the FIPS variants. What has been reported consistently across sources is that both bugs allow remote code execution on NetScaler ADC and NetScaler Gateway, that both were exploited as zero-days, and that no public proof of concept exists yet. I am treating this as critical anyway, and so should you. Unauthenticated or low-effort code execution on an internet-facing gateway lands at the top of the scale almost every time, and "actively exploited with no patch" is about as bad as the label gets.

It is also important to separate this from the NetScaler bug you were probably already dealing with. watchTowr was explicit that these are different from CVE-2026-19490, the authentication bypass Citrix patched on August 19. That flaw has been exploited since early September and landed in CISA's Known Exploited Vulnerabilities catalog on September 9. If you patched for CVE-2026-19490 and assumed you were done with NetScaler for the quarter, I have bad news. Being current on the August fix does not protect you from these new bugs.

There is one more wrinkle for anyone running older trains. NetScaler 13.1 reached End of Maintenance on September 15, and 13.1 is affected: the fix is 13.1-64.23. If you are still on that branch, this is a very pointed reminder that the clock on your upgrade plan has run out.

Why NetScaler Keeps Ending Up Here

None of this is surprising if you have been in the field for the last few years. NetScaler sits exactly where attackers want to be. It handles VPN and remote access, it load balances critical applications, and it brokers user authentication, which means it touches session tokens, credentials, and internal network paths all at once. Compromise the gateway and you are standing on the threshold of the whole environment with a perfectly legitimate looking position.

We saw this movie with CitrixBleed in late 2023, when session hijacking against NetScaler fed ransomware crews for months. We saw it again with the string of 2025 memory disclosure and code execution bugs. Edge devices from Citrix, Fortinet, Ivanti, Cisco, and Palo Alto Networks have become the preferred front door for both ransomware affiliates and state-backed operators, precisely because they are internet facing, hard to monitor with endpoint tooling, and patched on a schedule that rarely keeps up with the people exploiting them.

Exploitation in the Wild

No victims have been named and no indicators have been published, so there is no clean way to scan your logs for a known bad IP and call it a day. The key fact is that the flaws were uncovered during forensic investigations, which tells us exploitation has been successful against real targets. It also tells us the attackers had a head start measured in days or weeks, not hours.

That shapes the entire response. As watchTowr and others have pointed out, because these bugs were exploited before any patch existed, shutting down or patching an appliance will not evict an attacker who is already inside it. Patching closes the door. It does not tell you who walked through it last Tuesday. Historically, NetScaler intrusions have involved web shells dropped on the appliance, harvested session tokens, and stolen credentials for service accounts tied to LDAP and Active Directory. Every one of those survives a firmware update if you do not go looking for it.

What to Do Right Now

Start with an honest exposure decision. If a NetScaler Gateway or ADC management interface is reachable from the internet, you need to patch it today to 14.1-73.37 or 13.1-64.23, and then decide whether it stays online while you confirm it was not already compromised. Some organizations chose to pull their appliances offline before the fix existed. That was a defensible call for anyone who could survive a few days without remote access, and it was not an overreaction given what we now know about how long exploitation had been running.

If you cannot take the appliance offline, shrink the attack surface as far as the business will tolerate. Restrict inbound access to known employee or partner IP ranges, apply geographic blocking where it makes sense, and disable services you do not need. Several administrators suggested disabling DTLS as an interim step, and that instinct turned out to be right: CVE-2026-88772 is only reachable when DTLS is enabled, which it is by default on virtual VPN servers. Some reporting also recommended tightening any web application firewall in front of the appliance to its strictest mode. Treat all of this as risk reduction on the way to the patch, not a substitute for it.

Next, go hunting as if you have already been hit. The NCSC-NL guidance published for earlier NetScaler incidents in 2025 remains the best playbook available. Preserve VPX snapshots and logs before you change anything, isolate any appliance that looks suspicious, and run the NCSC-NL check scripts published on GitHub. Look for unexpected files in web-accessible directories, unfamiliar processes, and anything odd in the crash dump folder at /var/core and the logs under /var/nslog. Unexplained core dumps on a NetScaler are worth a very close look, because memory corruption exploits have a habit of crashing things when they misfire. On the SIEM side, review authentication activity that originated from the gateway, especially new sessions for privileged accounts, logins at strange hours, and lateral movement from the appliance's internal addresses.

If anything looks off, move to full credential hygiene. Rotate every service account password the appliance uses, including LDAP bind accounts. Revoke and reissue certificates and private keys stored on the device. Kill active sessions so any stolen tokens die with them. This is tedious work, and it is also the only part of the response that actually removes an attacker who already has what they came for.

Finally, the patch is out and the clock is already running. The gap between a NetScaler patch going public and mass exploitation of the diff has historically been measured in hours, and here exploitation ran for weeks before any fix existed. CISA's federal deadline was September 30 and it has passed; everyone else should behave as if they got the same one. Patch to 14.1-73.37 or 13.1-64.23, then treat the hunt above as mandatory rather than optional, because an appliance that was exposed before September 27 and has only been patched is an appliance that may still be hosting someone else's webshell.

The Bigger Picture

The frustrating part of this story is the information vacuum. Administrators learned about actively exploited flaws in their perimeter devices from a Reddit post and a security vendor's disclosure, not from the company that sells the product. Maybe Citrix has good reasons to hold back until fixes are ready. But when exploitation is already happening and customers are unplugging hardware on rumor, silence is not a neutral choice. It pushes defenders into guessing, and guessing is not a security strategy.

The lesson for everyone else is the same one we keep relearning. Edge devices need the same monitoring, logging, and incident response planning you give to domain controllers, because to an attacker they are just as valuable. If your plan for a NetScaler zero-day was "wait for the patch," you now know how that plan performs in practice.

MSP Angle

Clients running NetScaler, or any VPN appliance, need an edge exposure review and an assume-breach compromise assessment this week, and that is billable work you can scope today. Package it with ongoing perimeter log monitoring and a documented emergency patch SLA so the next zero-day is a managed process instead of a weekend fire drill.