On 27 September 2026, Citrix published a bulletin covering eight NetScaler ADC and NetScaler Gateway vulnerabilities. It applies to customer-managed appliances; Cloud Software Group updates Citrix-managed cloud services. Two of the flaws, CVE-2026-88771 and CVE-2026-88772, are critical and are being actively exploited. Their configuration requirements differ: CVE-2026-88771 affects all deployments, while CVE-2026-88772 requires DTLS to be enabled. They affect an access boundary that is often internet-facing: the gateway publishing applications or remote access.
What the advisories confirm
CVE-2026-88771 is an unauthenticated remote code execution flaw rated CVSS 9.5; it affects every NetScaler configuration. CVE-2026-88772 is a memory-overflow flaw, also rated 9.5, that can lead to code execution or denial of service when DTLS is enabled. DTLS is enabled by default on VPN vServers unless explicitly disabled. CISA added both CVEs to its KEV catalog, while CERT-EU recommends patching and checking for compromise.
Severity scores are not enough to assess this situation: active exploitation and the gateway’s role make an accurate appliance inventory more urgent than waiting for a normal maintenance cycle.
The scope to review
List NetScaler ADC and Gateway appliances, versions, builds and network exposure. Include standby, test and provider-managed environments. Add NetScaler instances used in Secure Private Access Hybrid deployments, which Citrix also says are affected. Record virtual servers, authentication profiles, VPN access and published applications.
Do not assume an instance is out of scope because it is not used as a VPN: the Citrix matrix and the real configuration determine applicability. Review filtering rules and administrative paths as well.
Patch, then look for evidence
For standard branches, Citrix lists NetScaler ADC and Gateway 14.1-73.37 and later, or 13.1-64.23 and later. For FIPS variants, the threshold is 14.1-73.37 FIPS; for 13.1 FIPS and NDcPP, it is 13.1-37.279. The Australian Cyber Security Centre recommends reviewing for signs of exploitation dating back to at least September 4. If compromise is suspected, check indicators and preserve forensic evidence before updating, because the update may reduce visibility. Then install the fixed build with a verified backup and rollback plan.
After updating, review access logs, account creation, configuration changes and unexpected processes. A patch does not prove that earlier exploitation did not occur. Have your security team or managed service provider assess the indicators.
In its pre-disclosure analysis, Unit 42 reports .deb web shells under /vpn/scripts/linux/ and a PHP shell in /var/netscaler/logon/LogonPoint/custom/. Treat these as indicators to investigate alongside other evidence, not proof of compromise on their own; activity after public disclosure may differ.
Accounts and secrets to review
Inventory administrator accounts, certificates, API keys and service secrets used by published applications. Prepare a coordinated rotation if the investigation shows that configuration was read or changed. Review fallback accounts too: they can remain active after a migration. For shared accounts and rotation rules, see our team password-sharing guide and SMB password policy guide.
The workflow should separate software remediation, compromise assessment and access re-establishment. Completing only one does not replace the other two.
How Soclyde fits
Soclyde does not patch NetScaler and cannot determine whether an appliance was compromised. It can help keep administrator and service access in a local-first encrypted vault, using distinct credentials for each purpose.
That organization supports rotation after the investigation without turning the vault into a detection tool or a substitute for Citrix remediation.
Key takeaway
Two NetScaler zero-days are being exploited and require urgent operational treatment. Inventory gateways, apply Citrix builds, search for evidence and review secrets. To prepare a rotation, see the secure password generator or contact Soclyde.
