Hackers Exploiting Two Critical Citrix NetScaler Zero-Days
Citrix has confirmed that hackers are exploiting two critical NetScaler zero-days that allow remote code execution. The US Cybersecurity and Infrastructure Security Agency (CISA) has given federal agencies until 30 September to patch these vulnerabilities.
Details
- Flaws: Two critical flaws have been identified in Citrix NetScaler ADC and NetScaler Gateway, enabling remote command execution without login (CVE-2026-88771) and memory overflow leading to potential remote code execution or crash (CVE-2026-88772).
- Impact: These flaws affect devices used for staff remote access to internal networks. CVE-2026-88771 grants full control over the gateway, while CVE-2026-88772 can lead to network compromise.
- Timeline: Attacks have been ongoing since the beginning of September, with pre-patch warnings circulating among administrators and security researchers identifying "nation state aligned" actors behind them.
- Action Taken: Citrix released fixes and patches (versions 14.1-73.37 and 13.1-64.23), and is upgrading its managed cloud services. CISA added the vulnerabilities to its list of known exploits, advising federal agencies to address them promptly.
Context
In recent months, various critical zero-day vulnerabilities have been disclosed, including those in Cisco's Identity Services Engine and Microsoft's September updates. This underlines the ongoing challenge posed by sophisticated attackers targeting widely used technologies.