NetScaler Zero-Day Patch: Critical ADC & Gateway Fixes

Active Zero-Day Threats Explained

Citrix released emergency updates for NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway to mitigate two critical unauthenticated remote code execution zero-days under active targeting by threat actors. Because these appliances serve as primary ingress points for VPN sessions, load balancing, and identity verification, compromise gives attackers immediate footholds into enterprise perimeters.

The two actively exploited zero-days carry severe risk profiles:

• CVE-2026-88771 (CVSS 9.5): Stemming from improper input validation inside ADC and Gateway core components, this flaw enables unauthenticated threat actors to run arbitrary commands directly on the appliance operating system. It affects all deployments by default.
• CVE-2026-88772 (CVSS 9.5): A critical memory overflow vulnerability that leads to either full remote code execution or complete appliance denial of service. While it requires Datagram Transport Layer Security (DTLS) to be active, DTLS is enabled by default across standard NetScaler VPN virtual server setups.

Vulnerability Breakdown: All 8 Patched Flaws

Alongside the two critical zero-days, Citrix fixed six additional vulnerabilities spanning HTTP smuggling, sequence prediction, and memory management flaws. The table below details each CVE, CVSS severity, condition requirements, and exploitation impact.

Remediation Targets & Required Patched Builds

Citrix advises all administrators of customer-managed NetScaler ADC and Gateway appliances to deploy official maintenance builds immediately. The table below outlines supported release branches and the minimum builds required to remediate all eight CVEs.

Enterprise Impact: Lateral Movement and Persistence

Because NetScaler instances reside at the network edge, an unauthenticated RCE exploit provides attackers with root-equivalent privileges directly on the appliance. Security researchers point out that attackers exploiting these vulnerabilities typically execute several immediate secondary actions:

• Credential Harvesting: Extracting plaintext session tokens, administrative secrets, and active VPN user credentials stored in device memory.
• Persistence Mechanisms: Installing webshells, modifying configuration files, altering routing rules, and suppressing local event logging to evade detection.
• Internal Pivoting: Using the gateway as an internal jump host to query Active Directory domain controllers, Kerberos services, and enterprise databases.

Citrix has published generic Indicators of Compromise (IOCs) through NetScaler Console to assist security teams in auditing recent appliance activity for unauthorized access.

Recommended Admin Action Plan

1. Isolate or Upgrade: Update production appliances to versions 14.1-73.37 or 13.1-64.23 right away. If an appliance cannot be updated within current change windows, take the management interfaces and virtual servers offline until patches can be staged.
2. Run IOC Checks: Review NetScaler Console security reports for unexpected administrative processes, rogue virtual servers, or anomalous outbound traffic patterns originating from the appliances.
3. Enforce Enhanced ISN: Ensure TCP Enhanced Initial Sequence Number generation is turned on across virtual servers to neutralize CVE-2026-88778 sequence prediction attempts.
4. Rotate Secrets: If an unpatched appliance was internet-exposed, rotate LDAP/Active Directory service account credentials and SSL/TLS keys bound to the virtual servers as a safety precaution.

For additional advisory details, see the report on Network World.