# Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772) · pwn.watch

> Citrix's CTX697096 bulletin fixes eight NetScaler ADC and Gateway bugs, two of them critical unauthenticated remote code execution zero-days exploited in the wild: CVE-2026-88771 (improper input validation, affects every deployment, no preconditions) and CVE-2026-88772 (memory overflow on appliances with DTLS enabled, which is the default on VPN virtual servers). Both score CVSS 4.0 9.5 and were added to CISA KEV on Sep 27. Attackers chain CVE-2026-88771 with the SAML crash CVE-2026-88779 to get root, plant PHP web shells and steal configs and keys, and exploitation was still being reported in late October. A follow-up SAML bug, CVE-2026-107406, needs newer builds (14.1-73.46 / 13.1-64.29). Patch, then run a compromise assessment: patching does not remove persistence.

Page: https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 · generated 2026-10-24T08:44:16.553Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Citrix NetScaler ADC and NetScaler Gateway
- Started: 2026-09-27
- CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-107406
- Affected: NetScaler ADC and Gateway 14.1 before 14.1-73.37; NetScaler ADC and Gateway 13.1 before 13.1-64.23; NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS; NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.279; CVE-2026-107406 (SAML SP/IdP configs): 14.1 before 14.1-73.46, 13.1 before 13.1-64.29
- Fixed in: 14.1-73.46 or later (covers CVE-2026-107406 too; 14.1-73.37 fixes CTX697096); 13.1-64.29 or later (13.1-64.23 fixes CTX697096); 14.1-73.46 FIPS; 13.1-FIPS / 13.1-NDcPP 13.1-37.283

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772/feed.xml
- JSON Feed: https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772.json
- This file: https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772/llms.txt

## Updates (newest first)
- 2026-10-22: Zscaler ThreatLabz reports staged log-poisoning attacks against CVE-2026-88771 that drop web shells and a FreeBSD implant. (https://cybersecuritytimes.com/zscaler-netscaler-rce-exploitation/)
- 2026-10-19: Rapid7 details an intrusion that chained CVE-2026-88771 log poisoning with CVE-2026-88779 to get root, then installed PHP web shells, HA-aware persistence and a FreeBSD proxy agent, and staged NetScaler configs and keys for exfiltration (updated Oct 22). (https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/)
- 2026-10-09: CISA updates its alert to include CVE-2026-107406, a separate critical SAML memory overflow (RCE or DoS) fixed in 14.1-73.46 and 13.1-64.29; earlier fixes do not cover it. (https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html)
- 2026-10-04: CISA adds the related SAML crash CVE-2026-88779 to KEV; attackers can use it to force a reboot that runs code injected through CVE-2026-88771. (https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway)
- 2026-09-27: Citrix publishes CTX697096 for CVE-2026-88771 through CVE-2026-88778 and confirms in-the-wild exploitation of CVE-2026-88771 and CVE-2026-88772; CISA adds both to KEV the same day. (https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html)

## Fix brief
# Security brief: Citrix NetScaler ADC and Gateway: two unauthenticated RCE zero-days under active exploitation (CVE-2026-88771, CVE-2026-88772)

Source: https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772 · status: live · severity: critical · updated Oct 24, 2026, 06:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Citrix's CTX697096 bulletin fixes eight NetScaler ADC and Gateway bugs, two of them critical unauthenticated remote code execution zero-days exploited in the wild: CVE-2026-88771 (improper input validation, affects every deployment, no preconditions) and CVE-2026-88772 (memory overflow on appliances with DTLS enabled, which is the default on VPN virtual servers). Both score CVSS 4.0 9.5 and were added to CISA KEV on Sep 27. Attackers chain CVE-2026-88771 with the SAML crash CVE-2026-88779 to get root, plant PHP web shells and steal configs and keys, and exploitation was still being reported in late October. A follow-up SAML bug, CVE-2026-107406, needs newer builds (14.1-73.46 / 13.1-64.29). Patch, then run a compromise assessment: patching does not remove persistence.

Severity detail: CVSS 4.0 9.5 (Citrix); unauthenticated RCE exploited in the wild as a zero-day; CVE-2026-88771 and -88772 in CISA KEV since 2026-09-27

- Product: Citrix NetScaler ADC and NetScaler Gateway
- CVE / advisory ids: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-107406

## Affected versions
- NetScaler ADC and Gateway 14.1 before 14.1-73.37
- NetScaler ADC and Gateway 13.1 before 13.1-64.23
- NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS
- NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.279
- CVE-2026-107406 (SAML SP/IdP configs): 14.1 before 14.1-73.46, 13.1 before 13.1-64.29

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 14.1-73.46 or later (covers CVE-2026-107406 too; 14.1-73.37 fixes CTX697096)
- 13.1-64.29 or later (13.1-64.23 fixes CTX697096)
- 14.1-73.46 FIPS
- 13.1-FIPS / 13.1-NDcPP 13.1-37.283

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Upgrade NetScaler ADC/Gateway to 14.1-73.46 or 13.1-64.29 (or later), which cover CTX697096 and CVE-2026-107406; FIPS: 14.1-73.46 FIPS, 13.1-37.283. Check the build with `show ns version`. SAML configs: `add authentication samlAction` (SP) or `add authentication samlIdPProfile` (IdP). Treat internet-facing appliances that were unpatched during September/October as possibly compromised: look for unexpected PHP files, cron/rc.netscaler changes and /bin/sh with setuid bits, and follow Citrix's compromise-assessment guidance before rotating keys and credentials.

## Latest updates
- Oct 22, 2026: Zscaler ThreatLabz reports staged log-poisoning attacks against CVE-2026-88771 that drop web shells and a FreeBSD implant.
- Oct 19, 2026: Rapid7 details an intrusion that chained CVE-2026-88771 log poisoning with CVE-2026-88779 to get root, then installed PHP web shells, HA-aware persistence and a FreeBSD proxy agent, and staged NetScaler configs and keys for exfiltration (updated Oct 22).
- Oct 9, 2026: CISA updates its alert to include CVE-2026-107406, a separate critical SAML memory overflow (RCE or DoS) fixed in 14.1-73.46 and 13.1-64.29; earlier fixes do not cover it.
- Oct 4, 2026: CISA adds the related SAML crash CVE-2026-88779 to KEV; attackers can use it to force a reboot that runs code injected through CVE-2026-88771.
- Sep 27, 2026: Citrix publishes CTX697096 for CVE-2026-88771 through CVE-2026-88778 and confirms in-the-wild exploitation of CVE-2026-88771 and CVE-2026-88772; CISA adds both to KEV the same day.

## Advisories
- [Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778 (CTX697096)](https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html) (Citrix (Cloud Software Group))
- [Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-107406 (CTX697191)](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-citrix-netscale.html) (Citrix (Cloud Software Group))
- [Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway](https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway) (CISA)
- [AL26-024: Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway](https://www.cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772) (Canadian Centre for Cyber Security)
- [CERT-EU 2026-014: Critical Vulnerabilities in Citrix NetScaler ADC and Gateway](https://www.cert.europa.eu/publications/security-advisories/2026-014/) (CERT-EU)

## Write-ups & news
- [Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779](https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779/)
- [Zscaler Detects Coordinated Exploitation Attempts Targeting Critical NetScaler RCE Flaw](https://cybersecuritytimes.com/zscaler-netscaler-rce-exploitation/)

## Caveats
CVE-2026-88779 (the SAML DoS used in the chain) has its own page: citrix-netscaler-cve-2026-88779. Google/Mandiant observed CVE-2026-88772 exploitation since at least early September (per Singapore CSA).

---
Machine-readable: https://pwn.watch/i/citrix-netscaler-rce-zero-days-cve-2026-88771-88772.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.