CVE-2026-88772(citrix / netscaler_application_delivery_controller)

‼️ BREAKING: Citrix confirms two NetScaler flaws have been exploited and has released fixes. CVE-2026-88771 and CVE-2026-88772 were observed exploited on unmitigated deployments. The new advisory covers eight CVEs affecting NetScaler ADC and Gateway. New Details → https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html

‼️ Citrix has released a security bulletin regarding zero-day attacks targeting Citrix NetScaler ADC and Citrix NetScaler Gateway. More info: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778

⚠️ CISA says attackers are actively exploiting two critical Citrix NetScaler flaws globally. CVE-2026-88771 can allow unauthenticated command execution. CVE-2026-88772 can enable RCE when DTLS is enabled. Citrix has fixes and IoCs. Read: https://thehackernews.com/2026/09/cisa-says-attackers-are-exploiting-two.html

🔴 Citrix NetScaler'da CVSS 9.5 kritik DTLS açığı: CVE-2026-88772 için @murrezsec tarafından PoC yayınlandı. NetScaler ADC ve NetScaler Gateway'de DTLS işleme mekanizmasındaki memory overflow açığı, uzaktan RCE veya DoS saldırılarına yol açabiliyor. ⚠️ Citrix, CVE-2026-88772'nin aktif olarak sömürüldüğünü bildiriyor. Bu PoC; NetScaler Gateway/ADC fingerprinting, build sürümü kontrolü, UDP/443 DTLS kontrolü ve benign DTLS ClientHello probe içeriyor. Memory overflow'u tetikleyen weaponized paket PoC'de bulunmuyor. Düzeltilen sürümler: • NetScaler 14.1 -> 14.1-73.37+ • NetScaler 13.1 -> 13.1-64.23+ ⚠️ Önceki 14.1-73.32 ve 13.1-63.21 sürümleri bu açığı gidermiyor. PoC: https://github.com/murrez/CVE-2026-88772

Official comms and patches from Citrix are out! Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/

🚨 Citrix has confirmed active exploitation of two NetScaler RCE flaws. CVE-2026-88771 | CVSS 9.5 CVE-2026-88772 | CVSS 9.5 8 vulnerabilities disclosed. Patches are now available. 🔎 CVE-2026-88771: https://exploitgrid.net/vulnerabilities/CVE-2026-88771 CVE-2026-88772: https://exploitgrid.net/vulnerabilities/CVE-2026-88772

Citrix confirmed two new NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5 and exploited before patches were available. https://securityaffairs.com/199873/security/citrix-confirmed-two-new-netscaler-flaws-exploited-as-zero-day.html

Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks. They have now released security updates. Our article is updated, and the Citrix advisory is here: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096

The broader update includes flaws that can lead to remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under specific conditions. Only CVE-2026-88771 and CVE-2026-88772 are confirmed exploited. https://t.co/taRQw0NXT9

🚨 CITRIX NETSCALER — OFFICIAL PATCHES FOR TWO EXPLOITED RCE ZERO-DAYS (CVE-2026-88771 / CVE-2026-88772) Cloud Software Group (Citrix) published security bulletin CTX697096 covering eight NetScaler ADC / NetScaler Gateway flaws, including two critical remote code execution vulnerabilities that the vendor says have been exploited on unmitigated deployments. Lead issues (vendor CVSS v4 Base Score 9.5 each): • CVE-2026-88771 — Improper input validation → unauthenticated remote command execution. Affects ALL NetScaler ADC and NetScaler Gateway deployments, including default configuration (no extra features required). • CVE-2026-88772 — Memory overflow → remote code execution or denial of service when DTLS is enabled (DTLS is enabled by default on VPN virtual servers unless explicitly set to OFF). Fixed builds (install ASAP): • NetScaler ADC / Gateway 14.1-73.37 and later • NetScaler ADC / Gateway 13.1-64.23 and later (13.1) • NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS and later • NetScaler ADC 13.1-FIPS / 13.1-NDcPP 13.1.37.279 and later Also addressed in the same bulletin: CVE-2026-88773 through CVE-2026-88778 (HTTP request smuggling, policy bypass, additional memory overflows, TCP ISN prediction). ⚠️ Analyst Note: This is the official Citrix confirmation + patch set for the weekend’s unpatched NetScaler RCE warnings. Separate from the earlier auth-bypass CVE-2026-19490 (Aug builds 14.1-73.32 / 13.1-63.21 do NOT include these new fixes). Vendor wording: “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.” No public attribution, victim count, or full IOC package in the bulletin at publish time. Patching alone does not prove a previously exposed appliance was clean — treat internet-facing units as potentially compromised until forensics say otherwise. CISA had not listed CVE-2026-88771 / CVE-2026-88772 in KEV as of this post (catalog still 2026.09.25). Prefer the Citrix bulletin over secondary media. Official Citrix bulletin (CTX697096): https://support.citrix.com/external/article/CTX697096/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-and-cve-2026-88772.html #Citrix #NetScaler #ZeroDay #RCE #CVE202688771 #CVE202688772 #Vulnerability #CyberSecurity #ThreatIntel #DDW

Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised. https://www.deyda.net/index.php/de/2026/08/28/netscaler-cve-checkliste-updates-sicherheitspruefung-und-incident-response/ #DeydaConsulting #NetScaler #Citrix

Utilizas Citrix NetScaler ADC y NetScaler Gateway? FELIZ DOMINGO! Expotación activa de CVE-2026-88771 y CVE-2026-88772 permite RCE en el dispositivo. PARCHEA! https://blog.segu-info.com.ar/2026/09/explotacion-activa-de-dos-zero-day-rce.html

⚠️⚠️ CVE-2026-88771 (CVSS 9.5) + CVE-2026-88772 (CVSS 9.5): Citrix NetScaler ADC/Gateway zero-day RCE — now actively exploited in the wild 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJOZXRTY2FsZXItQUFBIg== 🎯42.7K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="NetScaler-AAA" 🔖Refer: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 #OSINT #FOFA #CyberSecurity #Vulnerability

‼️ تحذير عاجل اذا تستخدم Citrix NetScaler تواصل مع مزود الخدمة وحدث لاخر نسخه لوجود ثغرتين Zero-Day تستغل حالياً CVE-2026-88771 CVE-2026-88772 المصدر https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleURL=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778 https://t.co/SvnP19FnFv

🚨 CISA ADDS TWO KNOWN EXPLOITED VULNERABILITIES — CITRIX NETSCALER CVE-2026-88771 / CVE-2026-88772 CISA has added two critical Citrix NetScaler zero-days to the Known Exploited Vulnerabilities catalog and issued a dedicated Alert confirming active global exploitation. • CVE-2026-88771 — Citrix NetScaler improper input validation (unauthenticated remote command execution) • CVE-2026-88772 — Citrix NetScaler memory buffer restriction flaw (RCE / denial of service) • Both independently enable remote code execution; federal BOD due date 2026-09-30 • CISA: threat actors are actively exploiting these vulnerabilities globally • Vendor bulletin CTX697096 covers eight NetScaler ADC / Gateway CVEs (88771–88778); fixed builds include 14.1-73.37+ and 13.1-64.23+ ⚠️ Analyst Note: This is the CISA KEV / Alert escalation for the Citrix NetScaler RCE story already covered via official CTX697096 patches earlier today — not a rehash of the vendor bulletin. CISA also urges checking for compromise before patching where possible (updates can destroy forensic evidence) and points to Citrix IoC guidance via NetScaler Console. Preserve evidence if compromise is suspected, then patch urgently. CISA KEV alert: https://www.cisa.gov/news-events/alerts/2026/09/27/cisa-adds-two-known-exploited-vulnerabilities-catalog CISA Citrix zero-day Alert: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway Citrix bulletin CTX697096: https://support.citrix.com/external/article/CTX697096/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-and-cve-2026-88772.html CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #DarkWeb #CISA #KEV #Citrix #NetScaler #ThreatIntelligence #CyberSecurity

Citrix confirmed two NetScaler RCEs are being exploited. Public DTLS PoC dropped with the bulletin!! CVE-2026-88771 (CVSS 9.5): unauth command execution on every affected ADC/Gateway. No extra feature required. CVE-2026-88772 (CVSS 9.5): DTLS memory overflow → RCE or DoS. DTLS is on by default on VPN vServers unless -dtls OFF. Fingerprint + probe script is public. Fixed: 14.1-73.37 / 13.1-64.23. August builds 14.1-73.32 and 13.1-63.21 do not cover this. https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #NetworkSecurity #KEV #RCE

🚨 CVE-2026-88772 — Citrix NetScaler ADC/Gateway DTLS memory overflow (UDP/443) → RCE/DoS. Active exploitation reported (CTX697096). Patch: 14.1-73.37+ / 13.1-64.23+. 📖 https://pocbit.org/pocs/cve-2026-88772 #CVE #Citrix #NetScaler #CyberSecurity #VPN #InfoSec

⚠️ Alerte CERT-FR ⚠️ Les vulnérabilités CVE-2026-88771 et CVE-2026-88772 sont activement exploitées et permettent une RCE pré-authentification sur Citrix NetScaler ADC et Gateway. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-011/

🚨 Citrix NetScaler ADC/Gateway: 8 kritik/yüksek güvenlik açığı için yama yayınlandı! 🔴 CVE-2026-88771 — CVSS 9.5 Unauthenticated RCE. Varsayılan yapılandırmalar dahil tüm NetScaler ADC/Gateway kurulumları etkileniyor. 🔴 CVE-2026-88772 — CVSS 9.5 Memory overflow -> RCE/DoS. DTLS etkin sistemler etkileniyor; VPN vServer'larda DTLS varsayılan olarak açık. 🟠 CVE-2026-88773 — CVSS 9.3 HTTP Request Smuggling. 🟠 CVE-2026-88774 — CVSS 7.0 Policy bypass. 🟠 CVE-2026-88775 — CVSS 8.8 Memory overflow -> DoS/öngörülemeyen davranış. 🟠 CVE-2026-88776 — CVSS 8.8 Memory overflow -> DoS. 🟠 CVE-2026-88777 — CVSS 8.8 Memory overflow -> DoS. 🟠 CVE-2026-88778 — CVSS 8.8 TCP Initial Sequence Number (ISN) prediction. ⚠️ CVE-2026-88771 ve CVE-2026-88772'nin aktif olarak istismar edildiği Citrix tarafından doğrulandı. Çözüm: 14.1-73.37+ veya 13.1-64.23+ sürümüne güncelleyin. FIPS/NDcPP sürümleri için ilgili güncel build'ler de uygulanmalı. Citrix güvenlik bülteni: https://support.citrix.com/external/article/CTX697096

#UPDATE @citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day Citrix confirmed active exploitation of CVE-2026-88771 (CVSS score of 9.5) and CVE-2026-88772 (CVSS score of 9.5) on unpatched systems and urged customers to install the relevant updates as soon as possible