Citrix NetScaler Zero-Day CVE-2026-88771 Under Mass Exploitation

Key points

• CVE-2026-88771 affects Citrix NetScaler ADC and NetScaler Gateway.
• Attackers are remotely exploiting the flaw at scale against devices missing fixes.
• Public proof-of-concept and root-cause write-ups followed the initial attacks.
• IT teams should apply mitigations immediately and hunt for signs of compromise.

Threat researchers are tracking active abuse of a previously unknown vulnerability, CVE-2026-88771, in Citrix NetScaler ADC and NetScaler Gateway. The flaw allows attackers to reach vulnerable systems remotely, and unidentified actors have been hammering exposed appliances since the final days of last week.

By September 29, 2026, the campaign had grown into a broad, indiscriminate effort. Rather than targeting specific victims, the intruders appear to be spraying exploits across the internet, hoping to land on any device that still lacks the vendor's patch. The result is widespread opportunistic compromise.

Two developments accelerated the danger. First, a public proof-of-concept appeared, giving less skilled attackers a ready-made tool. Second, a root-cause analysis went public, offering deep technical detail about the bug's inner workings. Together, these disclosures lower the barrier to entry and likely fuel further scanning.

Organizations running NetScaler ADC or Gateway at the network edge are most at risk. These appliances often sit directly on the internet, making them attractive targets. An exploited device can become a foothold for deeper intrusion, data theft, or lateral movement into internal systems.

Citrix has not yet released a fix as of the latest information, so unpatched deployments remain exposed. Administrators should treat any internet-facing instance as potentially compromised until proven otherwise. Watch for an official patch, updated indicators of compromise, and evidence of post-exploitation activity. Until a fix arrives, mitigation and monitoring are the only defenses.

What to do now

1. Inventory every internet-facing NetScaler ADC and Gateway instance, then isolate any appliance that cannot be patched or mitigated right away.
2. Apply Citrix's emergency mitigation guidance immediately; if no patch exists, restrict management interfaces and disable unnecessary features.
3. Hunt for compromise signs such as unusual outbound connections, new local accounts, altered configurations, web shells, and unexpected processes.
4. Review logs from late last week through September 29, 2026 for exploitation attempts and successful intrusions.
5. Block known malicious IPs and domains from threat intelligence feeds, and enable enhanced logging and alerting on all NetScaler systems.
6. Reset credentials and rotate secrets for any appliance that may have been exposed, and enforce multi-factor authentication where supported.
7. Prepare an incident response plan if indicators are found, including forensic imaging, containment, and notification procedures.

CVE references

• CVE-2026-88771

Original source

Help Net Security