Citrix NetScaler Zero-Days Enable Unauthenticated Remote Code Execution

Threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances to execute code remotely. The campaign targets internet-exposed edge devices that sit between corporate networks and the public internet. According to Cyber Security News, attackers use these flaws to deploy a modified version of the Platypus remote access tool, securing persistent control over compromised infrastructure.

Root cause

The campaign leverages CVE-2026-88771, an improper input validation flaw, and CVE-2026-88772, a memory overflow issue. Both vulnerabilities carry a CVSS v4 score of 9.5. According to GBHackers, CVE-2026-88771 allows unauthenticated attackers to run commands by injecting shell commands into values written to NetScaler logs. A vulnerable error-handling script processes this logged content, potentially executing the payload.

Attack path

Attackers submit crafted data resembling crash messages from the NSPPE packet engine to trigger CVE-2026-88771. Any NetScaler component logging attacker-controlled HTTP input, such as headers or User-Agent strings, can provide a pathway. GBHackers notes that payload execution may be delayed by up to 24 hours until the monitoring script runs. For CVE-2026-88772, attackers send malformed DTLS handshake fragments to cause a memory overflow in systems with DTLS enabled.

Affected versions

• Citrix NetScaler ADC appliances with default configurations are vulnerable to CVE-2026-88771.
• NetScaler Gateway appliances are also affected by the improper input validation flaw.
• NetScaler VPN virtual servers with Datagram Transport Layer Security (DTLS) enabled are vulnerable to CVE-2026-88772.
• DTLS is enabled by default on VPN virtual servers unless administrators explicitly disable it.

Mitigation

• Apply the emergency updates released by Citrix for affected NetScaler products immediately.
• Verify whether DTLS is active on NetScaler virtual servers using configuration checks provided by the vendor.
• Review CISA’s Known Exploited Vulnerabilities catalog for guidance on prioritizing remediation efforts.
• Ensure all customer-managed NetScaler deployments are patched, as exploitation has been confirmed globally.

Signals worth monitoring

Teams usually monitor for unusual outbound connections from edge devices, as compromised appliances may attempt to download implants. Check whether log files contain unexpected shell commands or script executions, particularly in error-handling logs. Look for new binary files in temporary directories or paths resembling legitimate appliance files. Verify that no unauthorized remote administration tools are running. Investigate any delayed execution patterns in monitoring scripts, as attackers may time their payloads to evade immediate detection.

What to do and how to stay safe: Citrix

• Audit all internet-facing Citrix NetScaler ADC and Gateway appliances for the presence of CVE-2026-88771 and CVE-2026-88772.
• Review system logs for signs of command injection or unauthorized script execution, especially in error-handling processes.
• Check for unknown binary files or modified configurations in temporary and local directories on NetScaler appliances.
• Once the vendor provides an update, apply it promptly and verify that no residual backdoors remain on the system.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-88771?

CVE-2026-88771 is an improper input validation flaw in Citrix NetScaler that allows unauthenticated remote code execution via command injection.

Does CVE-2026-88772 require specific configuration?

Yes, CVE-2026-88772 requires Datagram Transport Layer Security (DTLS) to be enabled, which is default on VPN virtual servers.

Has Citrix released a fix?

Yes, Citrix released emergency updates for the affected products after confirming exploitation of unpatched deployments.