CyberNew CyberNew
Vulnerabilities & CVEs Dark Reading 2 weeks ago

Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Vulnerabilities & CVEs

Analyst Takeaway

"Citrix on Sept. 27 disclosed two critical NetScaler zero-day vulnerabilities after reports of exploitation had caused alarm among customers for several days. CVE-2026-88771 is a remote code execution (RCE) flaw with a 9.5 CVSS score that stems from improper input validation, while CVE-2026-88772 is a memory overflow vulnerability, also with a 9.5 CVSS score, that can lead to RCE and distributed..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Citrix on Sept. 27 disclosed two critical NetScaler zero-day vulnerabilities after reports of exploitation had caused alarm among customers for several days.

CVE-2026-88771 is a remote code execution (RCE) flaw with a 9.5 CVSS score that stems from improper input validation, while CVE-2026-88772 is a memory overflow vulnerability, also with a 9.5 CVSS score, that can lead to RCE and distributed denial-of-service (DDoS) attacks. Both zero-days affect default configurations of Citrix's NetScaler Application Delivery Control (ADC) and Getaway products.

"Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed," Citrix said in its advisory, which strongly urged customers to update their software.

However, public reports of possible exploitation first surfaced online on Sept. 25 in a Reddit thread, and there's additional evidence that attacks began "at least a week ago," according to Benjamin Harris, founder and CEO of watchTowr.

Related:AI Agents Are Privileged Users; Who Is Auditing Their Access?

Communication Breakdowns for NetScaler Attacks

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →