If you run a Citrix NetScaler ADC or NetScaler Gateway, upgrade to 14.1-73.37 or 13.1-64.23 now, and read the compromise section below before you do it. Two of the eight flaws Citrix published on Sunday were already being used against real deployments, so the patch is the second job. The first is finding out whether anyone got in before it existed.

If you do not run one, the second half of this article is the part for you, and it is a counting exercise rather than a scare. September is not over and CISA has already added more exploited vulnerabilities this month than in any other month of 2026. Seventeen of the forty one are perimeter network devices, from nine different vendors. Two of those nine sell to small offices rather than to banks.

Everything below was checked on September 28, 2026. Where a fact could come from the organization that published it, we took it from there and we say which one. The scoring analysis and the catalogue counts are ours, and the method for each is written out so they can be re-run.

What shipped, and in what order

The sequence matters here, because the fix arrived after the exploitation, after the warnings, and on a Sunday.

When What
September 26 (Saturday) watchTowr publicly warns that unpatched NetScaler remote code execution flaws are being exploited, before any CVE identifier exists
Over that weekend NetScaler operators report being telephoned by suppliers, CERTs and national agencies advising them to shut the appliances down. NCSC-NL issues a pre-notification
September 27, 16:02:07 UTC The CVE record for CVE-2026-88771 is published, assigned by NetScaler as its own CNA
September 27, 16:09:56 UTC The CVE record for CVE-2026-88772 is published
September 27 Citrix publishes bulletin CTX697096, covering CVE-2026-88771 through CVE-2026-88778
September 27, 17:16 UTC Both records appear in NVD
September 27 CISA publishes its alert and adds both to the KEV catalogue, deadline September 30
September 27 Canada’s Cyber Centre publishes alert AL26-024
September 28, 12:22 UTC NVD finishes analysis on both and attaches its own CVSS 3.1 scores

Citrix’s wording in the bulletin is short and unambiguous: “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.”

The acknowledgement line at the foot of the bulletin credits Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov. A bank’s own offensive research team found two zero-days in the appliance that fronts a large part of corporate remote access. Neither CVE record carries any credit field at all, so if you read the machine-readable data rather than the web page, those names are not there.

The eight, as Citrix describes them

This is the bulletin’s own table, reproduced so you can match a CVE to whether your configuration is in scope. The preconditions column is the one to read first.

CVE What it is Precondition Citrix states CWE CVSS 4.0
CVE-2026-88771 Unauthenticated remote code execution via improper input validation All ADC and Gateway deployments. Default configuration, no additional feature required CWE-20 9.5
CVE-2026-88772 Memory overflow leading to RCE or denial of service DTLS enabled, which is the default on a VPN vServer CWE-119 9.5
CVE-2026-88773 HTTP request smuggling HTTP configuration enabled CWE-444 9.3
CVE-2026-88774 Feature policy bypass through HTTP URL based expressions Any policy expression using an HTTP URL based expression CWE-16 7.0
CVE-2026-88775 Memory overflow, erratic behaviour or denial of service Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server CWE-119 8.8
CVE-2026-88776 Memory overflow, erratic behaviour or denial of service A load balancing virtual server of type Oracle CWE-119 8.8
CVE-2026-88777 Memory overflow, erratic behaviour or denial of service LB/CS or CGNAT-LSN/NAT64 with a non-HTTP L7 protocol feature enabled CWE-119 8.8
CVE-2026-88778 TCP initial sequence number prediction TCP configuration enabled CWE-342 8.8

Fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, and 13.1-37.279 for FIPS and NDcPP. Secure Private Access hybrid deployments that use NetScaler instances are affected too and need the same upgrade.

One thing this bulletin does not say, which previous NetScaler bulletins did: we searched the page for “12.1”, “13.0” and “end of life” and got zero hits for all three. Older branches are simply not mentioned. If you are running one, the bulletin gives you nothing, and the honest reading is that there is no fixed build coming.

The scoring is wrong, and it is wrong in the direction that matters

Both critical flaws are published at 9.5. Read the two vectors next to the preconditions Citrix states for each, and something does not line up.

CVE-2026-88771  CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE-2026-88772  CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The metric to look at is AT, Attack Requirements. FIRST’s CVSS 4.0 specification defines it as the metric that “captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack.” AT:N means “the successful attack does not depend on the deployment and execution conditions of the vulnerable system.” AT:P means it does.

Now put that next to Citrix’s own preconditions column. CVE-2026-88771 works against every deployment in its default configuration with no feature enabled, which is the textbook description of AT:N. It is published as AT:P. CVE-2026-88772 requires DTLS to be enabled, which is a deployment condition, which is the textbook description of AT:P. It is published as AT:N.

The AC metric, Attack Complexity, is separately correct on both: 88771 is AC:L and 88772 is AC:H, which matches what Citrix has told researchers about reliability. Only AT is transposed.

This is not a pedantic point, because AT feeds the score. We computed all of this with the cvss Python package, version 3.6, and validated it first by feeding it six of the eight published vectors and checking that it reproduced Citrix’s own published numbers. It reproduced 9.5, 9.5, 9.3, 7.0, 8.8 and 8.8 exactly. Then:

Vector Base score
CVE-2026-88771 as published (AT:P) 9.5 Critical
CVE-2026-88771 with AT:N, as the preconditions describe it 10.0 Critical
CVE-2026-88772 as published (AT:N) 9.5 Critical
CVE-2026-88772 with AT:P, as the preconditions describe it 9.5 Critical

The unauthenticated, no-preconditions, default-configuration remote code execution flaw that is being exploited right now is a 10.0. It is published as a 9.5. The correction costs the other one nothing, because at AC:H the score is already pinned. So the neat symmetry of “two critical 9.5s” that every write-up is repeating, this one included until we did the arithmetic, is an artefact of one metric being set backwards on one CVE.

If your patching process sorts by CVSS, and a great many do, half a point is the difference between the top of the queue and the middle of it.

Four sources, four different answers

We pulled the same two vulnerabilities from every place a defender would look. They disagree more than they should for something forty eight hours old.

CWE. Citrix’s bulletin says CWE-20 for 88771. The CVE record says CWE-20. NVD says CWE-20, sourced from the CNA. Canada’s Cyber Centre says CWE-20. CISA’s KEV entry files it under CWE-119, which is the classification belonging to the other CVE in the pair. KEV lists CWE-119 for both.

The reference link. The KEV note for CVE-2026-88771 is a long string of URLs, and the last one is https://nvd.nist.gov/vuln/detail/CVE-2026-88772. The NVD link on the 88771 entry points at 88772. The 88772 entry has the same link, correctly. A reader who follows the link from the entry for the more dangerous of the two flaws lands on the other one.

Missing CWEs. Five of the eight CVE records carry no CWE at all: 88772, 88774, 88775, 88776 and 88777. The classification exists, Citrix published it in its own bulletin table, and the CNA that published the bulletin is the same organization that published the records. The data that a vulnerability management tool reads is thinner than the web page a human reads.

Severity. NVD ran its own analysis and attached CVSS 3.1 as the primary metric, while Citrix’s 4.0 scores stay as secondary. NVD scores 88771 at 9.8 Critical and 88772 at 8.1 High. So the same two flaws that Citrix presents as an identical pair of criticals are, in the system that most scanners still key off, a critical and a high, three quarters of a point down from the critical threshold. If your scanner reports one of these as High and you triage on severity labels, that is why.

The one source that is unambiguous is CISA’s structured assessment. Both entries carry an SSVC decision dated September 27 from the CISA Coordinator role reading exploitation: active, automatable: no, technical impact: total, and both are flagged for mandatory forensic triage with a three day deadline of September 30.

The one that the upgrade does not fix

CVE-2026-88778, the TCP initial sequence number prediction flaw, is the only one of the eight where installing the new build is not the end of the job. The bulletin is explicit: deployments affected by it must also apply a TCP configuration change, enabling Enhanced ISN Generation.

The check Citrix gives is one line on the appliance:

show ns tcpparam | grep "Enhanced ISN Generation"

If that returns Enhanced ISN Generation: DISABLED and you have any of the listed virtual server types configured (the list runs to HTTP, SSL, SSL_BRIDGE, TCP, SSL_TCP, FTP, NNTP, RTSP, RDP, DNS_TCP, DOT, SIP_TCP, SIP_SSL, DIAMETER, SSL_DIAMETER, MYSQL, MSSQL, ORACLE, SMPP, MQTT, MQTT_TLS, MONGO, MONGO_TLS, PROXY, SSL_PROXY, USER_TCP and USER_SSL_TCP), the upgrade alone has left you exposed. This is an 8.8 with a VI:H integrity impact, and it is the detail most likely to be missed, because it sits at the bottom of a table whose first two rows are on fire.

Patching does not evict anybody

This is the part that matters more than the version number, and it is the part a three line news item cannot carry.

Both flaws were exploited before the fix existed. If your appliance was reachable from the internet last week, the patch closes the door but tells you nothing about who is already inside. Citrix’s own compromise guidance, CTX694799, is a rebuild-and-rotate document, not a patch-and-carry-on one. Read in full, the steps it sets out are:

  • Preserve evidence first. Snapshot the VPX instance. Record system time, timezone and NTP configuration before isolating anything. Pull logs from remote syslog and from NetScaler Console as well as locally. Generate a technical support bundle and a Packet Engine core dump, noting that the core dump warm-restarts the appliance. For MPX and SDX hardware, image the disks with a write blocker and keep two copies with a documented chain of custody. Citrix states plainly that it does not perform forensic investigations.
  • Isolate the device from the network.
  • Revoke credentials and access. Every service account password and secret stored on the NetScaler, changed on the system it belongs to: LDAP service accounts, RADIUS shared secrets, OAuth tokens, API keys, SNMP community names. Every user account that authenticated through a Gateway or AAA virtual server. Every certificate and private key on the appliance, revoked.
  • Investigate what it talked to. Authentication servers, sensitive systems, web tier, management jump hosts.
  • Rebuild rather than clean. Wipe and reinstall an MPX, replace a VPX, upgrade the firmware, and only then restore a configuration backup that predates the compromise.

Canada’s Cyber Centre adds the same instruction in its own words, and one that is easy to skip: investigate for signs of compromise “particularly where evidence of suspicious activity predates the release of vendor fixes.” That is the whole point. Your detection window opens before Sunday, not after it.

Two notes on the indicators of compromise, because both advisories point at a list and neither page carries one. CISA’s KEV note says “Running the provided IOCs in the NetScaler console may help identify indicators of exploitation.” The bulletin it links to, CTX697096, has no IOC section. It links onward to an anchor on a Citrix community blog post, and that page returned HTTP 403 to every automated request we made, so we cannot tell you what is on it. The Cyber Centre alert says “Review the attached list of indicators of compromise” and its public page has no attachment. Neither is a reason to wait. The forensic steps above do not depend on anyone’s hash list.

One more line in the Cyber Centre alert is worth reading carefully rather than literally. It suggests considering temporarily shutting down internet-facing NetScaler appliances “until vendor guidance and security updates become available.” The updates became available the same day the alert was published. Patch, do not power off, unless your own investigation gives you a reason to.

Now the month

Here is the part that applies whether or not the word NetScaler means anything to you.

We downloaded CISA’s Known Exploited Vulnerabilities feed directly. Catalog version 2026.09.27, released September 27 at 21:30:35 UTC, 1,728 entries, 244 of them added during 2026, 361 flagged as used in ransomware campaigns. The counts below are our analysis of that file.

September 2026 is the busiest month of the year, with two days still to run.

Month Entries added
January 17
February 28
March 26
April 31
May 21
June 23
July 26
August 31
September (to the 27th) 41

Then we classified every entry by what kind of thing it is. We counted as a perimeter network device anything that terminates the internet connection or the remote access session: firewalls, VPN and remote access gateways, application delivery controllers and load balancers, SD-WAN controllers, routers and switches, secure mail gateways. We deliberately excluded endpoint management tools, remote support software, phone systems, cameras and storage, all of which are somebody’s problem but not the edge of the network.

Seventeen of September’s forty one entries are perimeter network devices. That is 41 per cent of the month, across nine vendors.

Added CVE Device
September 2 CVE-2026-83548, CVE-2026-83549 SonicWall SMA1000
September 9 CVE-2026-19490 Citrix NetScaler
September 9 CVE-2025-25249 Fortinet, multiple products
September 9 CVE-2026-20079 Cisco Secure Firewall Management Center
September 10 CVE-2026-86060, CVE-2026-67277 MikroTik RouterOS
September 14 CVE-2026-76461 Cisco Secure Email Gateway
September 16 CVE-2026-76460 Cisco Identity Services Engine
September 21 CVE-2026-7273 Zyxel GS1900 switches
September 22 CVE-2026-93952 Arista VeloCloud Orchestrator
September 22 CVE-2026-94127 F5 BIG-IP APM
September 22 CVE-2026-93616, CVE-2026-85102 Check Point, multiple products
September 25 CVE-2026-67279 MikroTik RouterOS
September 27 CVE-2026-88771, CVE-2026-88772 Citrix NetScaler

Run the same classification across every year the catalogue has existed and it is not a spike, it is a slope.

Year Perimeter devices as a share of KEV additions
2021 38 of 311, 12 per cent
2022 86 of 555, 15 per cent
2023 30 of 187, 16 per cent
2024 33 of 186, 18 per cent
2025 45 of 245, 18 per cent
2026 to date 55 of 244, 23 per cent

Nearly a quarter of everything confirmed exploited this year is the box in the rack by the front door. Five years ago it was one in eight.

The deadlines moved with it. We have been tracking what BOD 26-04 did to CISA’s remediation clocks since June, and the September figures are the sharpest yet. In January, 15 of 17 entries got 21 days. In September, 33 of 41 got three.

Month, 2026 3 days 14 days 21 days
January 2 0 15
April 8 23 0
July 22 4 0
September 33 8 0

You do not own a NetScaler. Somebody holding your data does

A NetScaler ADC starts in the thousands of dollars and is bought by organizations with a data centre. Almost no Toronto small business has one. That is not the same as not being exposed to one.

What to actually do this week, in order.

1. Check the two vendors on that list who sell to you. MikroTik routers and Zyxel GS1900 switches are small office equipment, sold through the same channels as everything else in your comms cabinet, and both are on September’s exploited list. MikroTik is on it three times. If either is in your office, the management interface should not be reachable from the internet, and the firmware should be current. The MikroTik chain we wrote up in September is a working example of how that goes wrong, and one of its component flaws is still not in the KEV catalogue today, which we re-checked this morning.

2. Find out whether your suppliers patched. The people who run NetScaler Gateway are payroll bureaus, clinics, law firms, accountants, insurers, managed service providers and banks. If you log in to a supplier’s remote access portal and the browser sends you to a path like /vpn/index.html, that redirect is NetScaler Gateway behaving normally, and it is the most common tell. You are entitled to ask. A short email works better than a long one:

Do you operate Citrix NetScaler ADC or Gateway? If so, have the appliances been upgraded to 14.1-73.37 or 13.1-64.23 for CVE-2026-88771 and CVE-2026-88772, and has the environment been reviewed for compromise predating September 27?

An answer of “we patched on Sunday” is good. An answer of “we patched on Sunday and we reviewed logs back to the start of September” is the right one. No answer at all inside a week is itself an answer.

3. Ask what happened to the sessions. Anything that compromises a gateway compromises the sessions passing through it. If a supplier tells you they were affected, the follow-up question is whether they invalidated active sessions and rotated the secrets stored on the appliance, because that is the step CTX694799 spells out and the one most likely to be skipped. The same failure mode, from a different starting point, is what makes adversary in the middle session theft so effective, and what happened when an MSP’s remote management platform was breached is the version of this story where the supplier is the attack path.

4. Do the arithmetic on your own edge. If your business exposes anything to the internet that answers unauthenticated requests on port 443, that thing is in the same category as a NetScaler, whatever it cost. A router with its admin page open, a NAS with remote access turned on, a camera recorder, an old VPN box nobody has logged into since the person who installed it left. Those are in the 23 per cent. Everything else in your stack gets patched when something reminds you. Those need a calendar entry.

The short version

Citrix published eight NetScaler flaws on Sunday. Two were already being exploited, one of them against every deployment in its default configuration. Upgrade to 14.1-73.37 or 13.1-64.23, apply the separate TCP configuration change if CVE-2026-88778 applies to you, and treat any appliance that was internet-facing last week as potentially compromised, which means rotating the LDAP, RADIUS, OAuth, API and SNMP secrets stored on it and revoking its certificates rather than only installing a build.

The published score on the worst of the eight is a 9.5 because one CVSS metric is set backwards against the vendor’s own preconditions table. Corrected, it is a 10.0. The KEV entry for it carries the wrong CWE and a link to the wrong CVE. Five of the eight CVE records omit a classification their own vendor published. None of that changes what you should do, and all of it is a reason to read the bulletin rather than the score.

And if none of this is your equipment, the number to keep is the one from the catalogue: 41 per cent of everything CISA confirmed exploited this month was the device at the edge of a network, from nine vendors, two of whom sell to small offices. That share has risen every year since 2021.

If you want someone to work out which of these actually touches your business, get in touch. We will tell you what we find, including when the answer is that you are not affected.

Sources

  • Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771 through CVE-2026-88778, article CTX697096, Cloud Software Group, retrieved September 28, 2026, for the eight-row table quoted above including every precondition, CWE and CVSS vector, the fixed build numbers, the Secure Private Access hybrid note, the verbatim “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed”, the Enhanced ISN Generation requirement and its show ns tcpparam check with the full virtual server type list, the DTLS configuration patterns, and the acknowledgement of Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team and Maxim Suhanov. The absence of any mention of 12.1, 13.0 or end of life is our own search of that page
  • Steps to Take if NetScaler ADC is Suspected to be Compromised, article CTX694799, retrieved September 28, 2026, for every step in the compromise section: the VPX snapshot, the time and NTP documentation, the syslog and Console log preservation, the support bundle and Packet Engine core dump with its warm restart, the MPX and SDX disk imaging and chain of custody, the statement that Cloud Software Group does not support forensic investigations, the isolation step, the full credential revocation list of LDAP service accounts, RADIUS shared secrets, OAuth tokens, API keys and SNMP community names, the certificate and private key revocation, the connected systems list, and the rebuild, firmware upgrade and pre-compromise backup restore sequence
  • Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway, CISA, September 27, 2026, for the eight identifiers, the two KEV additions, and the statement that threat actors are actively exploiting them globally
  • Known Exploited Vulnerabilities Catalog JSON feed, CISA, catalogue version 2026.09.27, released 2026-09-27T21:30:35Z, 1,728 entries, downloaded September 28, 2026, for the full CVE-2026-88771 and CVE-2026-88772 records including the September 30 due date, the forensic triage flag, the verbatim required action and notes, the CWE-119 classification on both and the nvd.nist.gov/vuln/detail/CVE-2026-88772 link on the 88771 entry. Every count in this article, the monthly totals, the perimeter device classification and share by year, and the deadline gap tables, is our own analysis of that file, using the classification rule stated in the text
  • CVE-2026-88771 and CVE-2026-88772, CVE Program records assigned by NetScaler, published 2026-09-27T16:02:07Z and 2026-09-27T16:09:56Z, queried September 28, 2026, for the titles, descriptions, affected version ranges including the FIPS and NDcPP builds, the CVSS 4.0 vectors, the CWE-20 on 88771, the absence of any CWE on 88772, and the absence of any credit field on either. The records for CVE-2026-88773 through CVE-2026-88778, queried the same way, for their publication times, scores and the absence of a CWE on 88774, 88775, 88776 and 88777
  • NVD records for CVE-2026-88771 and CVE-2026-88772, queried through the NVD API on September 28, 2026, for the Analyzed status, the September 27 publication and September 28 last-modified timestamps, the primary CVSS 3.1 scores of 9.8 Critical and 8.1 High from nvd@nist.gov, the secondary CVSS 4.0 from the CNA, the CWE-20 sourced from the CNA on 88771 and the CWE-119 added by NVD on 88772, and the SSVC 2.0.3 decision from the CISA Coordinator role dated 2026-09-27 reading exploitation active, automatable no, technical impact total
  • AL26-024, Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway, Canadian Centre for Cyber Security, September 27, 2026, for the CWE-20 and CWE-119 classifications, the statement that exploitation has been observed across multiple Citrix customer environments worldwide while the full extent remains unknown, the full suggested actions list including the quoted instruction about evidence predating the vendor fixes, the credential reset and certificate replacement preparation, the shutdown consideration and its “until vendor guidance and security updates become available” wording, and the reference to an attached indicator list that the public page does not carry
  • CVSS v4.0 Specification Document, FIRST, for the quoted definitions of Attack Requirements and its None and Present values, and of Attack Complexity Low and High
  • The cvss Python package, version 3.6, used for every score in the scoring section. Validated before use by computing six of the eight published vectors from CTX697096 and confirming it reproduced Citrix’s published 9.5, 9.5, 9.3, 7.0, 8.8 and 8.8 exactly. The 10.0 figure for CVE-2026-88771 with AT:N is ours
  • Citrix NetScaler Zero-Day RCE FAQ and the CVE-2026-88771 advisory, watchTowr, for the September 26 public warning ahead of the bulletin and CVE identifiers, and for the note that the upgrade alone does not address CVE-2026-88778
  • Zero-Day Exploitation of Citrix NetScaler ADC and Gateway, Rapid7, for the vendor’s statement that CVE-2026-88771 has low attack complexity and CVE-2026-88772 high, and that 88771 affects the default configuration with no additional product features required
  • Citrix confirms two NetScaler RCE zero-days exploited in attacks, BleepingComputer, September 27, 2026, for the weekend reports of operators being contacted by suppliers, CERTs and national agencies, and for the NCSC-NL pre-notification
  • nFactor for gateway authentication, NetScaler documentation, for the /vpn/index.html redirect being expected behaviour on a Gateway virtual server
  • Publicly reported figures for the number of internet-facing NetScaler instances vary widely between outlets, from roughly 22,000 to figures an order of magnitude higher. We could not reach Shadowserver’s dashboard to check any of them at source, so we have quoted none