orca.securityadvisoryCritical Citrix NetScaler Zero-Days Under Active Exploitation
Analysis of two CVSS 9.5 Citrix NetScaler ADC/Gateway zero-days, CVE-2026-88771 (unauthenticated RCE through improper input validation in the management interface, affecting default deployments) and CVE-2026-88772 (memory overflow in DTLS, enabled by default on VPN virtual servers). It lists six more high-severity flaws patched in advisory CTX697096, the affected and fixed versions, and the CISA KEV listing with a federal deadline of 2026-09-30. It advises checking for compromise before patching, since patching can destroy forensic evidence, and gives response steps: isolate, revoke credentials, rebuild firmware, rotate keys and certificates.
What it is
Citrix advisory CTX697096 patches eight NetScaler ADC/Gateway flaws. Two are exploited zero-days, both CVSS 9.5 and both in CISA KEV: CVE-2026-88771 and CVE-2026-88772. The page says exploitation was observed globally before disclosure.
How it works
- CVE-2026-88771: insufficient sanitization of user-supplied data in the management interface gives unauthenticated arbitrary code execution through crafted requests.
- CVE-2026-88772: a memory overflow gives RCE or DoS. It requires DTLS, which is on by default on VPN virtual servers.
Six further flaws are fixed in the same advisory. The page does not say whether any of them is exploited:
| CVE | CVSS | Issue |
|---|---|---|
| CVE-2026-88773 | 9.3 | HTTP request smuggling that bypasses front-end security controls. Affects load balancing, content switching, VPN and authentication virtual servers. |
| CVE-2026-88774 | 7.0 | Feature policy bypass via improper HTTP URL-based expression usage |
| CVE-2026-88775 | 8.8 | Memory overflow causing DoS on Gateway or AAA virtual servers |
| CVE-2026-88776 | 8.8 | Memory overflow on Oracle-type load balancing virtual servers |
| CVE-2026-88777 | 8.8 | Memory overflow in non-HTTP L7 protocols (FTP, RTSP, DNS64, NAT64) |
| CVE-2026-88778 | 8.8 | TCP Initial Sequence Number predictability |
Preconditions / Affected
- CVE-2026-88771: every default ADC and Gateway deployment is affected. No extra features or configuration are needed.
- CVE-2026-88772: requires DTLS, so most VPN deployments are exposed out of the box.
- Vulnerable versions:
- 14.1 before 14.1-73.37
- 13.1 before 13.1-64.23
- FIPS 14.1 before 14.1-73.37 FIPS
- FIPS/NDcPP 13.1 before 13.1-37.279
- Citrix Secure Private Access Hybrid deployments that use affected NetScaler instances are also impacted.
What to do
- Check for compromise before patching. Citrix warns that updates may erase forensic evidence. The page gives no detection commands or indicators.
- Upgrade to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1-37.279 (FIPS/NDcPP), matching your branch.
- If you suspect compromise: - Isolate the device. - Revoke credentials. - Investigate connected systems. - Rebuild the firmware. - Rotate passwords, encryption keys and SSL certificates.
Caveats
- The federal KEV remediation deadline was 2026-09-30, which has already passed. Any unpatched appliance is overdue, and in the exposure window for exploitation that began before disclosure.
- The page gives no IOCs, log queries or fixed-version guidance for other branches. It also lists no workaround for those who cannot patch.
- The page's pitch for Orca's asset-exposure view is vendor marketing and adds no technical content.
Organisations named here
- CTX697096
CVEs named here
- CVE-2026-88771
- CVE-2026-88772
- CVE-2026-88773
- CVE-2026-88774
- CVE-2026-88775
- CVE-2026-88776
- CVE-2026-88777
- CVE-2026-88778
Technologies named here
- CISA Known Exploited Vulnerabilities Catalog
- Citrix NetScaler
- VPN
- CISA KEV
Techniques named here
- HTTP request smuggling bypassing front-end security controls
- TCP Initial Sequence Number predictability
Related in Cloud & Infra
orca.securityarticleOrca Security: GenAI Risks in Cloud Environments
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
attackthesoc.comarticle