Citrix NetScaler gateways taken over without a login, now in mass attacks (CVE-2026-88771)

25 October 2026Critical 9.5Being exploited

Citrix · NetScaler ADC and NetScaler Gateway · CVE-2026-88771

Citrix NetScaler gateways taken over without a login, now in mass attacks

An input validation flaw lets an unauthenticated attacker run commands on NetScaler appliances in their default configuration. It was exploited as a zero-day alongside CVE-2026-88772 (a memory overflow reachable when DTLS is on), and after a public proof of concept appeared attacks spread widely; Censys counts around 42,000 NetScalers exposed to the internet. A further exploited flaw, CVE-2026-88779 (denial of service), followed on 4 October.

Affected: NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus FIPS and NDcPP builds before 14.1-73.37 FIPS and 13.1-37.279. CVE-2026-88779 is fixed in 14.1-73.41 and 13.1-64.28. Secure Private Access hybrid deployments using NetScaler are also affected.
What to do: Upgrade to 14.1-73.41 or 13.1-64.28 or later, which covers all three exploited CVEs. Patching does not remove an attacker who is already in: run Citrix's indicator checks and follow its compromise guidance (CTX694799), and Citrix warns its script may miss real compromises.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Exploited as a zero-day then en masse; on CISA's KEV list; NetScaler Gateway is a common remote-access front door.

Citrix NetScaler gateways taken over without a login, now in mass attacks

Affected

NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, plus FIPS and NDcPP builds before 14.1-73.37 FIPS and 13.1-37.279. CVE-2026-88779 is fixed in 14.1-73.41 and 13.1-64.28. Secure Private Access hybrid deployments using NetScaler are also affected.

What to do

Upgrade to 14.1-73.41 or 13.1-64.28 or later, which covers all three exploited CVEs. Patching does not remove an attacker who is already in: run Citrix's indicator checks and follow its compromise guidance (CTX694799), and Citrix warns its script may miss real compromises.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Exploited as a zero-day then en masse; on CISA's KEV list; NetScaler Gateway is a common remote-access front door.