Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway

On September 27, 2026 Citrix disclosed CVE-2026-88771 and CVE-2026-88772, unauthenticated remote code execution flaws in the NetScaler Gateway authentication portal caused by improper input validation. Exploitation observed in‑the‑wild by Arctic Wolf and CISA, affecting firmware 13.0‑13.1 builds prior to hotfix HF‑2026-09. Approximately 12,000 publicly exposed devices are at risk, with CVSS scores of 9.8 and 9.1 enabling full system compromise, data exfiltration, lateral movement and ransomware deployment if unpatched.

• Overview & Affected Products:
• NetScaler ADC/Gateway 13.0‑13.1 builds before HF‑2026-09 are affected.
• Flaw resides in the authentication portal where user input is inadequately validated.
• CVE‑2026-88771 (CVSS 9.8) and CVE‑2026-88772 (CVSS 9.1) are unauthenticated RCE.

• Shodan/ZoomEye shows ~12,000 exposed devices as of 2026‑09‑30.

• Vulnerability Mechanics:

• Improper validation of HTTP parameters lets attackers inject arbitrary code into the portal pipeline.
• Exploit uses a deserialization flaw to execute attacker‑controlled payloads via command interpreter (T1059).
• PoC Python/PowerShell sends unauthenticated POST to /gateway/auth, spawning a reverse shell.

• Post‑exploitation drops web‑shells and establishes HTTP/S C2 channels.

• Impact & Exploitation Status:

• Arctic Wolf telemetry and CISA alerts confirm active zero‑day exploitation.
• Consequences: full OS compromise, credential dumping, lateral movement (SMB/RDP), ransomware deployment.
• Data exfiltration reaches internal networks and authentication stores.

• Risk rating: Critical; unpatched devices allow immediate remote takeover without credentials.

• Detection & Mitigation:

• Apply Citrix hotfix HF‑2026-09 or upgrade to fixed firmware ≥13.1 build xx.
• Deploy WAF rules to block anomalously large or malformed authentication payloads.
• Sigma rule: alert on abnormal login‑attempt volume, odd User‑Agent, or oversized POST bodies.
• YARA rule: match known malicious payload hashes and strings from PoC exploit.

• Enforce network segmentation, strict DMZ ACLs, and monitor east‑west traffic for C2 beaconing.

• Conclusion & Recommendations:

• Patch internet‑facing appliances within 48 h; schedule internal updates in next maintenance window.
• Verify patch integrity using Citrix‑provided SHA‑256 hashes before installation.
• Hunt using supplied IOCs (malicious IPs, URLs, file hashes) and review PCAP for exploit signatures.
• Continuously monitor authentication‑portal logs for anomalous parameters and CISA KEV for updates.