CISA Flags Exploited Citrix NetScaler Flaws, Urges Patching

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has raised the alarm over two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that attackers are actively exploiting worldwide. The agency added the flaws, tracked as CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities (KEV) catalog on September 29, 2026, after receiving threat intelligence and partner reports confirming ongoing attacks.

Both security holes carry the highest possible severity rating of 9.5 on the Common Vulnerability Scoring System (CVSS). CVE-2026-88771 stems from improper input validation and can allow an unauthenticated user to execute arbitrary commands on the affected device. The second vulnerability, CVE-2026-88772, is a memory buffer boundary restriction flaw that can lead to remote code execution or a denial-of-service. While the first flaw affects all NetScaler ADC and NetScaler Gateway installations, the second one is only exploitable when the Datagram Transport Layer Security (DTLS) protocol is active. Crucially, DTLS is enabled by default on VPN virtual servers, which means a large number of deployments are susceptible unless administrators have deliberately turned it off.

Citrix has released software updates to resolve both issues. The patched versions include NetScaler ADC and NetScaler Gateway 14.1-73.37 and later releases, version 13.1-64.23 and later of the 13.1 branch, NetScaler ADC 14.1-FIPS in release 14.1-73.37 FIPS and later, and NetScaler ADC 13.1-FIPS plus 13.1-NDcPP in version 13.1.37.279 and subsequent updates. Recognizing that applying firmware updates to networking appliances can involve complexity and planned downtime, CISA published the alert to help organizations assess their exposure and prioritize mitigation efforts.

Independent researchers at watchTowr Labs swiftly dissected CVE-2026-88771 and confirmed that the vulnerability is rooted in a Perl script named "ns_monuploadd_err.pl." This script handles crash and error reports on the NetScaler appliance. It constructs a shell command using input that comes from data written to the appliance’s log files. An attacker can send a specially crafted HTTP POST request to the "/nf/auth/doAuthentication.do" endpoint – a pre-authentication page – where the login field contains a payload that forces the script to run system commands. Because the injected data ends up in a log entry later processed by the vulnerable Perl script, the attacker’s commands execute with root privileges, granting full control over the device. The researchers demonstrated this by sending a request that wrote a harmless file to /var/tmp, confirming code execution. This trivial exploitation means that simply leaving an unpatched NetScaler exposed to the internet can lead to a full compromise without any prior credentials.

Given the active global exploitation, CISA has given U.S. federal civilian agencies a deadline of September 30, 2026, to apply the fixes. The agency also pointed to generic indicators of compromise (IoCs) that Citrix has distributed through the NetScaler Console to help administrators check whether their appliances have already been compromised. If a compromise is suspected, the recommended response includes preserving forensic evidence, isolating the affected appliance from the network, revoking all associated credentials and access rights, investigating any connected systems for signs of lateral movement, rebuilding and updating the firmware to the latest version, rotating all local account passwords and Key Encryption Keys, replacing any restored SSL certificates, and hardening the device according to Citrix’s security guidelines.

For website operators and businesses that depend on Citrix NetScaler for load balancing or secure remote access, the message is clear: verify the installed version immediately and apply the patch. Failure to do so exposes not only the appliance itself but also the web applications, sensitive data, and internal networks that sit behind it. Organizations that rely on managed hosting providers can offload some of this risk. AEU Hosting, for instance, secures managed WordPress environments end to end, ensuring that underlying infrastructure components are continuously monitored and patched by experts, which can shield site owners from having to chase down appliance-level vulnerabilities themselves.