Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772)

Citrix NetScaler ADC and NetScaler Gateway

Citrix's CTX697096 bulletin fixes eight NetScaler ADC and Gateway bugs, two of them critical unauthenticated remote code execution zero-days exploited in the wild: CVE-2026-88771 (improper input validation, affects every deployment, no preconditions) and CVE-2026-88772 (memory overflow on appliances with DTLS enabled, which is the default on VPN virtual servers). Both score CVSS 4.0 9.5 and were added to CISA KEV on Sep 27. Attackers chain CVE-2026-88771 with the SAML crash CVE-2026-88779 to get root, plant PHP web shells and steal configs and keys, and exploitation was still being reported in late October. A follow-up SAML bug, CVE-2026-107406, needs newer builds (14.1-73.46 / 13.1-64.29). Patch, then run a compromise assessment: patching does not remove persistence.

Why this severity: CVSS 4.0 9.5 (Citrix); unauthenticated RCE exploited in the wild as a zero-day; CVE-2026-88771 and -88772 in CISA KEV since 2026-09-27

Started
Sep 27, 2026
CVEs
CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778CVE-2026-107406

Follow this incident

Affected

  • NetScaler ADC and Gateway 14.1 before 14.1-73.37
  • NetScaler ADC and Gateway 13.1 before 13.1-64.23
  • NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
  • NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.279
  • CVE-2026-107406 (SAML SP/IdP configs): 14.1 before 14.1-73.46, 13.1 before 13.1-64.29

Fixed in

  • 14.1-73.46 or later (covers CVE-2026-107406 too; 14.1-73.37 fixes CTX697096)
  • 13.1-64.29 or later (13.1-64.23 fixes CTX697096)
  • 14.1-73.46 FIPS
  • 13.1-FIPS / 13.1-NDcPP 13.1-37.283

Timeline5

  1. Zscaler ThreatLabz reports staged log-poisoning attacks against CVE-2026-88771 that drop web shells and a FreeBSD implant.

  2. Rapid7 details an intrusion that chained CVE-2026-88771 log poisoning with CVE-2026-88779 to get root, then installed PHP web shells, HA-aware persistence and a FreeBSD proxy agent, and staged NetScaler configs and keys for exfiltration (updated Oct 22).

  3. CISA updates its alert to include CVE-2026-107406, a separate critical SAML memory overflow (RCE or DoS) fixed in 14.1-73.46 and 13.1-64.29; earlier fixes do not cover it.

  4. CISA adds the related SAML crash CVE-2026-88779 to KEV; attackers can use it to force a reboot that runs code injected through CVE-2026-88771.

  5. Citrix publishes CTX697096 for CVE-2026-88771 through CVE-2026-88778 and confirms in-the-wild exploitation of CVE-2026-88771 and CVE-2026-88772; CISA adds both to KEV the same day.

Advisories5

News & write-ups2

Notes & caveats

CVE-2026-88779 (the SAML DoS used in the chain) has its own page: citrix-netscaler-cve-2026-88779. Google/Mandiant observed CVE-2026-88772 exploitation since at least early September (per Singapore CSA).

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo