What’s going on with the NetScaler vulnerabilities and what do they mean?
What Is Going On?
On Sunday September twenty-seventh, Citrix released an advisory announcing new vulnerabilities to their NetScaler ADC and NetScaler Gateway platforms. CISA then followed up and added these vulnerabilities as official Common Vulnerabilities and Exposures (CVEs). These aren’t the first vulnerabilities from Citrix NetScaler that have received CVE entries, and while vulnerabilities aren’t particularly surprising to anyone in this industry, it is never a good sign to see this many at once. CISA announces new CVEs daily and sometimes they are pretty high on the criticality rating. So, why has everyone been talking about the Citrix NetScaler vulnerabilities so much?
There are a few reasons. A big one is that these vulnerabilities were rumored for a while before Citrix addressed them and subsequently patched the issues. Now, whether you want to throw blame or not, the reality is that these vulnerabilities created quite a wide, unsecured, opening in many large networks. In total there are nine CVEs that CISA has tracked and two of those were added to their Known Exploited Vulnerability (KEV) catalog to boot. The other alarming component is that reports are saying that in the US alone, there are around 13,549 hosts reportedly using NetScaler of some kind [1]. And when the big names using NetScaler include Google, Microsoft, and Amazon web service, that is something to worry about [2].
Overview of the Events
In total, CISA has assigned nine CVEs in the past several days for NetScaler ADC and Gateway. The first two, and the last one, are known to be exploited in the wild, though CVEs 88773-8 haven’t been confirmed yet as being used in active attacks. Any one of these vulnerabilities could pose major issues for a network though.
| CVE Name | Known Exploitation | CVSS Score | What It Allows |
|---|---|---|---|
| CVE-2026-88771 | Yes | 9.5 (Critical) | Remote Code Execution (RCE) |
| CVE-2026-88772 | Yes | 9.5 (Critical) | RCE, Denial of Service (DOS) |
| CVE-2026-88773 | No | 9.3 (Critical) | HTTP Request Smuggling |
| CVE-2026-88774 | No | 7.0 (High) | Policy Bypass |
| CVE-2026-88775 | No | 8.8 (High) | DOS |
| CVE-2026-88776 | No | 8.8 (High) | DOS |
| CVE-2026-88777 | No | 8.8 (High) | DOS |
| CVE-2026-88778 | No | 8.8 (High) | TCP ISN Prediction |
| CVE-2026-88779 | Yes | 8.7 (High) | DOS |
What is NetScaler
NetScaler is a web-based Application Delivery Controller, meaning they can act as a load balancer, firewall, or remote gateway for companies that are running their own applications and need to secure how their systems are accessed. What does that mean? The short answer is that they offer network edge security systems to enterprise companies for application infrastructure. Which brings up an interesting point. Who is really impacted by these attacks?
Obviously, if you use NetScaler for application security in some way, you need to secure your infrastructure to make sure that your client’s data is safe, your data is safe, and that you are able to keep services running for all your users. We’ll look at the details shortly, but Citrix released patches that will address these risks.
If, however, you manage the tech department for a public sector organization, a small to medium sized business, or educational institution, chances are you aren’t running NetScaler and won’t have to implement any of the recommended changes yourself, though you could be the exception. Regardless, this is still a peek behind the curtain on how vendors are handling application security and how those decisions will affect you in the end. This is a great example of what we often say here at Scinary, it may not be the first or third party risks you need to consider, but the fifth party’s.
Essentially, look at this as a reason to make sure that you know who is accessing your network, when, and how. Because while there isn’t any confirmation, this could potentially lead to supply chain compromises if things go south. Then even small organizations might find they are seeing “weird behaviors” at odd times.
CVE-2026-88771
That’s enough pessimistic speculation. Let’s dive in on the specifics and take a look at the first vulnerability tracked as CVE-2026-88771. It is a critical vulnerability with a CVSS score of 9.5 that allows an unauthenticated attacker to execute arbitrary commands on the appliance. Immediately, that doesn’t sound good, but unlike the next CVE this works on any of the affected versions of NetScaler ADC or Gateway whether it’s running default configurations or not.
This issue comes out of improper input validation that allows the attacker to build a Perl code line that can turn a previous error message into a string of commands. When the NetScaler appliance reads the “message” it reformats things then assembles the command and executes it. It is classified as an input validation issue because the reworked error message doesn’t match with the conventions of how such a message should be formatted. If you want to see an example of this and get a more in-depth explanation, check out the article that Watchtower Labs put together [3].
CVE-2026-88772
Now let’s look at the other known exploited vulnerability from this advisory CVE-2026-88772. It’s another CVSS 9.5 critical vulnerability, but it opens up the potential for remote code execution and denial of service. This CVE hits a different area though. Where 88771 came from improper input validation, 88772 is a DTLS memory overflow vulnerability. This means that DTLS must be enabled for this vulnerability to impact you, unfortunately DTLS is enabled by default in NetScaler’s VPN servers.
As the “memory overflow” moniker would tell you, the way that this attack works is by manipulating the DTLS handshake to create an oversized message that, when the NetScaler appliance tries to read, send the overflow into another part of memory that will allow the execution of code. Sometimes this doesn’t work out to the attacker’s favor but then you still have to deal with issues because things are being done that the system doesn’t know how to resolve. As well, there is the large amount of messages and multiple attempts to contend with, that create the DOS problem. Again, check out the associated Watchtower Labs article to get the deeper dive on this [4].
CVE-2026-88779
This particular CVE is a break from the others. While CVEs 88771-8 were announced at the same time on September 27th, 88779 here was disclosed on October 4th. Unfortunately, that does mean that the patches for the previous issues won’t fix this one, but more on that shortly. Citrix has put out updates to cover affected versions, and these will also patch the previous vulnerabilities as well. There isn’t as much info out about this one yet, but checking out the Citrix bulletin is still a good start [5].
Now, how does this issue work? The short answer is that it uses more memory overflow to cause a denial of service. In that way, it’s similar to CVE-2026-88772. However, the area targeted is different. In this case, the attacker has to find a customer managed NetScaler appliance that’s operating as a SAML service provider or SAML identity provider. SAML is the target of the memory overflow, and it needs to be customer managed because Citrix patches things automatically for the appliances they take care of. Also, because this was found after the previous patches were pushed, they aren’t going to stop this new vulnerability. So, it will require a new patch if this does impact your appliances.
How to Protect Yourself
If you are one of the groups currently running an affected NetScaler system, then there is good news. Citrix has released patches that are supposed to close off these vulnerabilities. Below are the patched versions that Citrix recommends updating to for the earlier CVEs. Because there is also a late arrival to the party, the versions that address CVE-2026-88779 will be listed separately. You can also look at their bulletin addressing these vulnerabilities here [6]. But as is so often the case, the best step is to patch. Though in this case, that will present some challenges given the nature of what NetScaler is doing for those using it. That is part of why some reports were showing that only 10% of NetScaler instances are patched against these vulnerabilities [7]. Citrix has also suggested using their global deny list to help close off some connections seen by these vulnerabilities, but patching remains the best way to reduce your risk.
Summary
This isn’t going to be anything revolutionary either on the exploitation or the remediation. If you are running NetScaler, patch as quick as you possibly can. If you aren’t, keep alert to what is going on in the cyber world. If we see any further compromise or exploitations from this, it’s better to know sooner. The bulletins from Citrix, announcements from CISA, and the many articles out there are all pointing to this being more vulnerabilities that need patching right now. Once that’s done, make sure you have a team watching out for anything that could be possible exploitation.
Secure if You Don’t Use SAML
Secure for CVE-2026-88779
References
