CISA re-warns NetScaler customers: actively exploited zero-day needs immediate patch
Three zero-day flaws in Citrix NetScaler have been exploited by state-sponsored and opportunistic attackers, and CISA is calling on operators to patch immediately.
CISA has called on the Citrix NetScaler customer base to act immediately, warning that a new remote-code-execution flaw in the widely deployed application delivery controller and gateway platform is under active exploitation. The agency's guidance is aimed at administrators running NetScaler ADC and NetScaler Gateway with SAML single-sign-on services exposed to the internet.
The vulnerability, tracked as CVE-2026-88771, is a pre-authentication command injection in the NetScaler ADC and Gateway product line. Attackers can reach it without credentials, which makes every internet-facing edge appliance a candidate target. The flaw pairs with two other zero-days, CVE-2026-88772 and CVE-2026-88779, that researchers and threat-intelligence firms report have also been exploited in the wild over the past two months.
What the flaw does
Because the vulnerability hits before authentication, an attacker does not need a valid session to execute arbitrary commands on the appliance operating system. The practical consequence is a remote code execution primitive against the edge of the corporate network. Several threat-intelligence reports describe the observed payloads as backdoors, configuration-data exfiltration, and web-shell deployment, with one campaign using a modified Platypus remote-access tool. Unit 42 and watchTowr report the affected version window as roughly between ADC 14.1 and ADC 14.137, with earlier long-life-support releases also touched.
The broader NetScaler context matters. This year's third exploited flaw (CVE-2026-88779 — a SAML DoS — disclosed 12 October) landed on top of CVE-2026-88771 and CVE-2026-88772 from the September wave. In other words, operators who patched in September and stopped are not yet caught up. CISA's fresh guidance explicitly references the third flaw, calling on customers to apply Citrix's vendor guidance and to confirm that the patch chain is complete before restoring full service exposure.
- Apply Citrix's vendor guidance for CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779 together, not just the latest one.
- Confirm that your NetScaler version matrix has moved beyond the affected window (roughly ADC 14.1 through ADC 14.137, with older LTS lines hit).
- For SAML-SSO deployments, treat the SAML service as the exposed attack surface and rotate credentials and tokens after patching.
- Hunt for backdoor artifacts (modified Platypus remote-access tool, WHIPSHOT and SLAPSHOT tooling) before declaring the incident closed.
- Document the patch timeline. CISA's guidance is a reference point if you need to explain your residual exposure to regulators or insurers.
Citrix NetScaler is one of the most widely deployed edge platforms in the enterprise. If your network runs a SAML-based SSO, your gateway is the front door to the identity system, and a pre-auth RCE on the gateway is closer to a domain-wide compromise than it looks. The practical fix is patching, but only a complete patch chain across the three zero-days will close the door. If you cannot patch, at minimum move the appliance behind a WAF that filters SAML payloads and rotate the SSO token and credential set.
What this means for you
CISA's guidance is not an abstract advisory. The agency has observed state-sponsored and opportunistic actors actively exploiting the three zero-days through targeted intrusions, and the third zero-day (CVE-2026-88779) was disclosed within the past two weeks. Patch hygiene, incident-response tooling, and rotation policy should all be re-checked this week, and the next NetScaler release should be tracked for any additional SAML or pre-auth surface changes.
Sources: CISA — Alert: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC and Gateway; BleepingComputer — Citrix Urges Immediate Patching of Critical NetScaler Vulnerability; Cybersecurity Dive — CISA calls on Citrix NetScaler customers to patch as new flaws disclosed.
Corrections: Report an error at corrections@wireshaman.com.