NetScaler under attack: two critical CVEs and how to harden the gateway post-patch

If you manage a Citrix NetScaler ADC or NetScaler Gateway exposed to the internet and haven't yet applied the late September patch, the problem isn't theoretical: two critical vulnerabilities are already being exploited in the wild before Citrix even published a fix.

The Citrix advisory CTX697096 from 27 September 2026 patched eight flaws. The two most severe:

CVE	Description	CVSS v4.0	Precondition
CVE-2026-88771	Unauthenticated command execution due to improper input validation	9.5 Critical	None, default configuration
CVE-2026-88772	Memory overflow with RCE or DoS	9.5 Critical	DTLS enabled (default on VPN vServer)

Exploits for CVE-2026-88771 and CVE-2026-88772 targeting unpatched NetScaler installations have been observed, and Cloud Software Group has urged NetScaler ADC and NetScaler Gateway customers to deploy updated versions immediately. According to industry research, exploitation has been occurring from early September through to CISA's revised alert of 9 October. A documented attack vector involves malicious POST requests to the /nf/auth/doAuthentication.do endpoint, injecting shell commands via the login parameter.

CISA added both CVEs to its KEV catalogue on 27 September, setting a remediation deadline of 30 September 2026 for federal agencies covered by its mandate, with instructions to check for any compromise and preserve forensic evidence before updating where possible. Further Citrix advisories on 3 and 8 October covered additional flaws tied to SAML configurations.

What to do beyond patching

Cloudflare released an emergency WAF rule on 1 October for those unable to update immediately, but the key point of their post is different: a public login page remains a target even after patching. The proposed measures work across three layers that you can replicate with any stack: access control (SSO/Zero Trust) in front of the gateway, WAF inspection on requests, and blocking direct connections to the origin via outbound tunnels or IP restrictions and mutual TLS, so the attacker sees only the proxy login page and never the real Citrix server.

For anyone running an exposed NetScaler instance: verify the installed version immediately, apply the update to 14.1-73.37 or 13.1-64.24, and perform compromise assessment before and after the update as specified in advisory CTX697096.