From "No CVE, No Patch" to a Confirmed, Fixed Vulnerability in 24 Hours
Less than a day after security firm watchTowr warned of two unconfirmed, unpatched Citrix NetScaler remote code execution (RCE) zero-days being actively exploited, Citrix has confirmed the reports and shipped fixes. The company's security bulletin CTX697096, published September 27, 2026, assigns CVE identifiers to the two exploited flaws — CVE-2026-88771 and CVE-2026-88772 — alongside six additional NetScaler CVEs disclosed in the same bulletin, and confirms both are being actively exploited in the wild.
This is a direct follow-up to CosmicBytez Labs' earlier coverage of watchTowr's weekend warning, which at the time carried no CVE, no vendor confirmation, and no patch. That gap has now closed — but with an important catch: the builds Citrix shipped in August to fix the previous NetScaler zero-day (CVE-2026-19490) do not fix these two new flaws.
Advisory at a Glance
| Attribute | Value |
|---|---|
| Disclosed by | Citrix Security Bulletin CTX697096, September 27, 2026 |
| Confirmed CVEs (exploited) | CVE-2026-88771, CVE-2026-88772 |
| Total CVEs in bulletin | 8 (CVE-2026-88771 through CVE-2026-88778) |
| CVE-2026-88771 | Unauthenticated remote code execution via improper input validation — CVSS 9.5 |
| CVE-2026-88772 | Memory overflow leading to RCE or denial-of-service, exploitable when DTLS is enabled — CVSS 9.5 |
| Affected products | Citrix NetScaler ADC and NetScaler Gateway (all default deployments for CVE-2026-88771) |
| Fixed builds | NetScaler ADC/Gateway 14.1-73.37+; 13.1-64.23+; 14.1-FIPS 14.1-73.37+; 13.1-FIPS/13.1-NDcPP 13.1.37.279+ |
| Prior August fix status | Builds 14.1-73.32 and 13.1-63.21 (which fixed CVE-2026-19490) remain vulnerable to these two new CVEs |
| CISA KEV status | Not yet listed for either new CVE as of publication |
| Vendor guidance | Citrix "strongly urges" immediate patching |
What Changed Since Yesterday's Warning
CVE-2026-88771: Unauthenticated RCE, Every Default Deployment
Citrix describes CVE-2026-88771 as an RCE vulnerability caused by improper input validation, exploitable by an unauthenticated attacker who can execute arbitrary commands. Critically, Citrix states that all NetScaler ADC and NetScaler Gateway deployments are affected, including those running default configuration — no optional feature (Gateway, AAA virtual server, SAML IdP, etc.) needs to be enabled for a device to be exposed. That is a notably broader exposure profile than August's CVE-2026-19490, which only affected specific configuration roles.
CVE-2026-88772: Memory Overflow via DTLS
CVE-2026-88772 is a memory overflow vulnerability that can result in either remote code execution or denial-of-service. Exploitation requires DTLS to be enabled on the appliance — and Citrix notes that DTLS is enabled by default on VPN virtual servers, meaning any standard remote-access VPN deployment is likely exposed without additional configuration changes.
The August Patch Doesn't Cover You
The most operationally significant detail in this bulletin: administrators who already updated to 14.1-73.32 or 13.1-63.21 to remediate the August authentication-bypass flaw (CVE-2026-19490) are still vulnerable to both new CVEs. Those builds predate the fixes released today. Organizations must apply the newly released 14.1-73.37 or 13.1-64.23 builds (or their FIPS/NDcPP equivalents) regardless of whether they patched in August.
How This Connects to the Weekend Warning
watchTowr's original Saturday statement said it was "rapidly reacting to rumors" of unpatched NetScaler RCE flaws, explicitly distinguishing them from the already-patched August vulnerabilities, and noted that Citrix communications and a fix were expected "early next week." That timeline held: Citrix's bulletin landed the very next day, Sunday, September 27 — faster than the informal "early next week" estimate suggested, likely reflecting pressure from the EU Cyber Resilience Act's tightened vendor-disclosure timeline noted in watchTowr's weekend commentary.
Multiple MSPs, MDR vendors, and national cybersecurity agencies had already told clients to shut down internet-facing NetScaler appliances over the weekend rather than wait — guidance that, in hindsight, aligned with the eventual confirmation that exploitation was real and ongoing.
Impact Assessment
| Impact Area | Description |
|---|---|
| Edge exposure | NetScaler ADC/Gateway sit at the network edge handling VPN, remote access, load balancing, and authentication — compromise can provide deep internal network access |
| Broad default exposure | CVE-2026-88771 affects all default deployments, and CVE-2026-88772 affects any VPN virtual server with default DTLS settings — this is not a narrow-configuration bug |
| False sense of security | Administrators who patched in August for CVE-2026-19490 may incorrectly believe they are current; they are not, against these two CVEs |
| Forensic uncertainty | Because exploitation reportedly predates today's patch, installing the fix alone does not confirm or rule out prior compromise |
| Regulatory | This is the second NetScaler bulletin in six weeks, reinforcing NetScaler appliances as a persistent, high-value target and likely a subject of continued regulatory scrutiny under the EU Cyber Resilience Act |
Recommendations
For NetScaler Administrators
- Patch immediately to 14.1-73.37, 13.1-64.23, or the relevant FIPS/NDcPP build — do not assume your August update is sufficient.
- Inventory every NetScaler ADC/Gateway instance and confirm exact build numbers now.
- If DTLS is enabled on any VPN virtual server and immediate patching isn't possible, consider disabling DTLS as a temporary mitigation while a patch window is scheduled.
- Preserve forensic evidence (VPX snapshot, offloaded logs, technical support bundle, packet-engine core dump) before remediation, per Citrix's standard compromise-response guidance.
For Security and Incident Response Teams
- Treat any NetScaler appliance that was internet-facing before today's patch as potentially already compromised, particularly given watchTowr's claim that exploitation predates the fix.
- Review authentication logs, administrative session logs, and outbound traffic from both management and data interfaces for anomalies predating September 26.
- Monitor CISA's KEV catalog — neither CVE-2026-88771 nor CVE-2026-88772 was listed at time of writing, but federal-deadline listing is likely given confirmed active exploitation.
For Leadership and Risk Owners
- Confirm patch deployment against the correct new builds — 14.1-73.37 / 13.1-64.23 — not the August builds, in any status reporting to leadership.
- Re-engage incident response and legal teams if your organization already responded to the weekend's unconfirmed warning; today's confirmation changes the reporting posture from "rumor" to "confirmed exploited vulnerability."
Key Takeaways
- Citrix confirmed and patched two actively exploited NetScaler RCE zero-days — CVE-2026-88771 and CVE-2026-88772 — within roughly 24 hours of watchTowr's initial unconfirmed warning.
- CVE-2026-88771 affects all default NetScaler ADC/Gateway deployments; no special configuration is required to be vulnerable.
- CVE-2026-88772 affects any VPN virtual server with DTLS enabled — the default setting for that configuration.
- August's patched builds (14.1-73.32, 13.1-63.21) do NOT fix these new flaws. Administrators must update again, to 14.1-73.37 or 13.1-64.23 or later.
- CISA has not yet added either CVE to its KEV catalog as of publication, but confirmed active exploitation makes near-term listing likely.
- Because exploitation reportedly predates the patch, patching alone does not confirm the absence of prior compromise — preserve forensic evidence before remediating.