NetScaler Zero‑Day RCE & DTLS Overflow (CVE‑2026‑88771, CVE‑2026‑88772) Exploited in the Wild

NetScaler Zero‑Day RCE & DTLS Overflow (CVE‑2026‑88771, CVE‑2026‑88772) Exploited in the Wild

What It Is – Citrix disclosed two critical zero‑day flaws in NetScaler ADC and NetScaler Gateway. CVE‑2026‑88771 enables unauthenticated remote code execution via input validation failure; CVE‑2026‑88772 is a memory‑overflow that can lead to RCE or denial‑of‑service on the DTLS stack.

Exploitability – Both vulnerabilities have a CVSS v4.0 base score of 9.5 and are confirmed to be exploited in the wild. Palo Alto Networks’ Cortex Xpanse telemetry shows > 50 k exposed instances as of 27 Sept 2026.

Affected Products – Citrix NetScaler ADC (hardware and VPX) and NetScaler Gateway (any version prior to the vendor’s emergency patch).

Why It Matters for Trust & Control Assurance

• Demonstrates the need for a continuous vulnerability‑management control that can surface unpatched exposures before attackers exploit them.
• Provides concrete evidence for auditors that you maintain a defensible patch‑and‑remediation workflow, a key control across NIST CSF 2.0, ISO 27001 and other frameworks.
• Highlights the importance of real‑time asset discovery and exposure monitoring (e.g., Xpanse) as part of an auditable trust‑posture program.

Recommended Actions

1. Apply Citrix’s emergency patches for CVE‑2026‑88771 and CVE‑2026‑88772 immediately.
2. Verify exposure using Citrix’s “pre‑condition” checklist or a trusted external asset‑inventory tool.
3. Isolate any vulnerable NetScaler instances from production networks.
4. Preserve forensic evidence – snapshot VPX, collect syslog, console logs, support bundle, and core dumps.
5. Conduct targeted hunting for anomalous admin sessions, unexpected outbound traffic, and logging gaps.

Source: Unit 42 Threat Brief – NetScaler Zero Days