Citrix · Exploitation confirmed

CISA confirms active exploitation of ten Citrix NetScaler zero-days

Sep 26, 2026 · 1 min read

Ten critical flaws affect Citrix NetScaler ADC and NetScaler Gateway, including unauthenticated remote code execution (CVE-2026-88771 and CVE-2026-88772). CISA confirms active global exploitation and lists three CVEs in the KEV catalog; CVE-2026-107406, in SAML configurations, requires 14.1-73.46+ or 13.1-64.29+. Patch internet-facing systems first and check for compromise before updating.

By HIFY Radar newsroom Updated 10/26/2026 01:38 PM Get this every day →← Back to the feed 8 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Ten critical flaws affect Citrix NetScaler ADC and NetScaler Gateway, remote access and application delivery appliances. Two allow unauthenticated remote code execution (CVE-2026-88771 and CVE-2026-88772); CISA confirms active global exploitation since September 27, 2026. A later flaw in SAML configurations (CVE-2026-107406) requires newer patch versions.

Why it matters

According to the Canadian Cyber Centre, a compromised appliance gives attackers full control, credential theft and a path into the internal network. Internet-facing systems are immediate targets, and CISA warns updates can be complex and require downtime. Patching without checking for prior compromise can leave intruders in place.

What to do

Upgrade now to 14.1-73.46+ or 13.1-64.29+ (FIPS: 14.1-73.46 FIPS; 13.1-FIPS/NDcPP: 13.1-37.283+), prioritizing internet-facing systems. Before updating, run the NetScaler Console IOC detection tool and preserve evidence; if compromised, restore a known-good backup predating the intrusion and rotate passwords, keys and certificates.

For the technical team

CVE: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778, CVE-2026-107406, CVE-2026-88779
Affected: Citrix (Cloud Software Group) Citrix NetScaler ADC e NetScaler Gateway · ADC and Gateway 14.1 before 14.1-73.37; 13.1 before 13.1-64.23; ADC 14.1-FIPS before 14.1-73.37 FIPS; ADC 13.1-FIPS and NDcPP before 13.1-37.279. CVE-2026-107406: SAML SP/IdP before 14.1-73.37 and 13.1-64.23; between 14.1-73.37 and 14.1-73.41 and between 13.1-64.23 and 13.1-64.28 (and FIPS equivalents) only as SAML IdP. Secure Private Access Hybrid deployments with NetScaler instances are also affected.
Exploitation: CISA: CVE-2026-88771 and CVE-2026-88772 added to KEV on 2026-09-27, zero-days with active global exploitation confirmed by reports and partner threat intelligence; CVE-2026-88779 added to KEV on 2026-10-04. Canadian Cyber Centre: exploitation observed across multiple Citrix customer environments worldwide, full extent unknown.
Fix: 14.1-73.46+ or 13.1-64.29+ (cover CVE-2026-107406); 14.1-73.37 and 13.1-64.23 fix CTX697096 (88771 through 88778) but not 107406; 14.1-73.46 FIPS; 13.1-FIPS/NDcPP 13.1-37.283+. Canada: updates for 88771/88772 do not remediate the SAML issue disclosed on 2026-10-02 nor 107406.
Vector: NetScaler ADC and Gateway. CVE-2026-88771: improper input validation (CWE-20), arbitrary code by a remote unauthenticated attacker. CVE-2026-88772: buffer overflow (CWE-119), code execution, memory corruption and DoS. CVE-2026-88779: DoS in SAML SP/IdP deployments; on unpatched systems it can force a reboot and accelerate execution of code previously injected via CVE-2026-88771 (CISA). CVE-2026-107406: memory overflow (CWE-119, CVSS v4.0 9.5) leading to RCE or DoS, requires the appliance configured as SAML SP or IdP.
More details: CVE-2026-107406 credited to Joshua Foote, Michael Tucker and Eugene Lim (XOR Team, JPMorgan Chase). SAML configuration check: 'add authentication samlAction' (SP) or 'add authentication samlIdPProfile' (IdP). Bulletin applies to customer-managed appliances; Citrix-managed cloud services and Adaptive Authentication already updated by the vendor. CISA recommends forwarding logs to a SIEM (local logs rotate quickly), preserving evidence before updating, restoring a backup predating compromise and rotating local account passwords, key-encryption keys and SSL certificates; it published SIGMA rules on GitHub. Patching does not remove persistence on already compromised systems (Canada). Sources cited by the bulletin include Rapid7 analysis of intrusions chaining 88771 and 88779 and Zscaler detection of coordinated exploitation attempts.