Citrix NetScaler Zero-Day Exploited Globally
Two critical Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are being actively exploited globally for unauthenticated remote code execution. Attackers chain an HTTP buffer overflow (CVE-2026-88771) with a TLS handshake ASLR bypass (CVE-2026-88772) to achieve unauthenticated RCE on NetScaler ADC and Gateway. Exploitation in the wild may have started as early as September 24. CISA has added both vulnerabilities to the KEV catalog.
Detection / Hunteropenrouter
Immediate Actions
- Apply official Citrix patches to all affected NetScaler ADC and Gateway appliances immediately.
- Disable DTLS on VPN virtual servers if not required to mitigate CVE-2026-88772.
- Isolate NetScaler systems using network access controls to limit exposure.
Key Takeaways
- CVE-2026-88771 affects all NetScaler ADC and Gateway deployments without exception.
- CVE-2026-88772 requires DTLS enabled, which is default on VPN virtual servers.
- Exploitation chains malformed HTTP overlapping block fragments with rapid TLS handshakes to bypass ASLR.
- GreyNoise detected exploitation activity starting September 24 against a target in Japan.
- Patches are available in versions 14.1-73.37 and 13.1-64.23.
Attack Chain
- Initial Access: Unauthenticated attacker sends malformed HTTP requests with overlapping block fragments to NetScaler.
- Exploit: Buffer overflow occurs when packet processor fails to validate reassembled stream size against memory buffer.
- Defense Evasion: Attacker sends rapid succession of TLS handshakes to overwrite memory pointer, bypassing ASLR.
- Execution: Overwritten pointer directs execution to staged shellcode, achieving arbitrary remote code execution.
Affected Systems
- Citrix NetScaler ADC and Gateway 14.1 before 14.1-73.37
- Citrix NetScaler ADC and Gateway 13.1 before 13.1-64.23
- Citrix NetScaler ADC FIPS before 14.1-73.37 FIPS
- Citrix NetScaler ADC FIPS and NDcPP before 13.1-37.279
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler ADC and Gateway | Critical | Improper input validation allows unauthenticated attacker to execute arbitrary commands. |
| CVE-2026-88772 | Citrix NetScaler ADC and Gateway (DTLS enabled) | Critical | Buffer overflow allows remote code execution or denial-of-service. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | NetScaler is a network appliance; EDR coverage depends on vendor support and access to underlying OS logs. |
| Network Visibility | High | Exploit uses malformed HTTP and rapid TLS handshakes visible in network traffic to the appliance. |
| Detection Difficulty | Hard | Requires parsing low-level HTTP fragment reassembly and TLS handshake timing anomalies on network appliances. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for anomalous HTTP requests containing overlapping block fragments targeting NetScaler appliances (T1190). | NetScaler HTTP logs, WAF logs, full PCAP. | Initial Access | |
| Hunt for rapid succession of TLS handshakes from a single source followed by suspicious process execution (T1190). | NetScaler TLS connection logs, network flow data. | Defense Evasion |
Required Log Sources
- NetScaler ADC/Gateway HTTP logs
- NetScaler ADC/Gateway TLS logs
- Network IDS/IPS traffic logs
- Web application firewall logs
Key Behavioral Indicators
- Overlapping HTTP block fragments in requests to NetScaler
- Rapid succession of TLS handshakes from single source IP
- Unauthenticated arbitrary command execution on NetScaler host
- Unexpected processes or shell sessions on NetScaler appliance
Control Gaps
- Signature-based WAF rules may miss malformed HTTP fragment reassembly attacks.
- Network IDS may not correlate HTTP overflow with TLS handshake timing bypass.
False Positive Assessment
Medium — Detecting malformed HTTP and TLS anomalies may trigger on legitimate clients with poor network conditions or legacy applications.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Upgrade NetScaler ADC to 14.1-73.37 or 13.1-64.23 or later.
- Block anomalous HTTP requests with overlapping fragments at upstream WAF.
- Monitor for and alert on rapid TLS handshake patterns targeting NetScaler.
User Protection
- Revoke unused user accounts on NetScaler systems.
- Reset authentication credentials for active NetScaler accounts.
- Enable and collect all host and network logs from NetScaler and surrounding systems.
MITRE ATT&CK Mapping
Initial Access
Execution
Privilege Escalation
Plain-Language Summary
Hackers are actively attacking a security flaw in Citrix NetScaler networking devices to take full control without needing a password. The attack works by sending specially crafted web traffic that overflows a memory buffer, then bypassing memory protections to run malicious code. Organizations using Citrix NetScaler should update to the latest patched versions immediately and review their systems for compromise.
- cveCVE-2026-88771Improper input validation allows unauthenticated attacker to execute arbitrary commands.
- cveCVE-2026-88772Buffer overflow allows remote code execution or denial-of-service.