DEV Community

Cyber Updates 365
Cyber Updates 365

Posted on Originally published at cyberupdates365.com

Citrix NetScaler Zero-Days: CVE-2026-88771 & CVE-2026-88772 Actively Exploited for Pre-Auth RCE

#security #sysadmin #devops #vulnerability

Citrix has issued security bulletin CTX697096 confirming active adversary exploitation of two critical zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway appliances: CVE-2026-88771 and CVE-2026-88772. Both vulnerabilities carry a CVSS v4.0 score of 9.5 Critical and allow unauthenticated remote attackers to execute arbitrary code on exposed gateway appliances.

Most alarmingly, Citrix confirmed that CVE-2026-88771 affects all default NetScaler deployments—requiring no non-standard configuration or specialized features for an attacker to achieve code execution.

🔗 Original Technical Breakdown & Firmware Advisory:

Read the complete architectural analysis, affected build matrix, and perimeter hardening checklist on CyberUpdates365: Citrix NetScaler CVE-2026-88771 & CVE-2026-88772 RCE.

Key Attack Mechanics & Severity

  1. CVE-2026-88771 (Default Ingress Flaw): An improper input validation flaw affecting all NetScaler ADC and Gateway appliances. Because it impacts default installations, any unpatched internet-facing NetScaler appliance is immediately susceptible to unauthenticated takeover.
  2. CVE-2026-88772 (DTLS Memory Overflow): A memory overflow vulnerability triggered when Datagram Transport Layer Security (DTLS) is enabled, allowing attackers to force a crash (DoS) or hijack execution flow for remote code execution.
  3. Active Exploitation in the Wild: Citrix confirmed active exploitation against unmitigated appliances, following research warnings of edge appliance targeting across enterprise and government perimeters.
  4. Distinct from Earlier CVE-2026-8452: This is a brand new set of critical vulnerabilities requiring fresh remediation, completely separate from the SAML memory-overflow flaw disclosed earlier this year.

For continuous vulnerability intelligence and enterprise mitigation tracking, visit our centralized CyberUpdates365 Enterprise CVE Vulnerabilities Hub. Administrators managing edge devices should also cross-reference our advisories on NetScaler CVE-2026-8452 Pre-Auth Root RCE and F5 BIG-IP CVE-2026-94127.

Emergency Action Items for NetScaler Administrators

  • Deploy Fixed Firmware Builds Immediately: Upgrade to NetScaler ADC / Gateway 14.1-39.40+, 13.1-59.23+, or the corresponding patched releases specified in CTX697096.
  • Audit Appliance Ingress Logs: Inspect edge firewalls and NetScaler access logs for anomalous unauthenticated traffic spikes, core dumps, and unrecognized process execution in the underlying FreeBSD shell.
  • Lock Down Management Interfaces: Verify that the NetScaler Management IP (NSIP) and Subnet IP (SNIP) interfaces are strictly inaccessible from untrusted external networks.

Full technical details, affected version baselines, and authoritative vendor links are documented at CyberUpdates365.

Top comments (0)