CVE-2026-88771 & CVE-2026-88772: Dual Citrix NetScaler Remote Code Execution Zero-Days Under Active Attack

On September 27, 2026, Citrix released security bulletin CTX697096 addressing eight vulnerabilities in NetScaler ADC and Gateway. Two of these—CVE-2026-88771 and CVE-2026-88772—are high-impact Remote Code Execution (RCE) flaws rated CVSS 9.5 that threat actors exploited in the wild prior to disclosure. CISA immediately added both to the Known Exploited Vulnerabilities catalog with an emergency patching deadline of September 30, 2026.

Vulnerability Mechanics & Dual Attack Vectors

1. CVE-2026-88771: Unauthenticated Input Validation RCE

Affecting all standard configurations of NetScaler ADC and Gateway without prerequisite features, CVE-2026-88771 resides in the HTTP request processing subsystem of the NetScaler management and data planes. The flaw stems from improper sanitization of multipart headers and URI path normalization routines within the web handler daemon:

Attacker HTTP Request
  │
  ├──► [NetScaler Web Listener (TCP 80/443)]
  │      │
  │      ├──► URI Normalization & Parameter Parser
  │      │      ├── Path: /vpn/../vpns/services/portal.nsp
  │      │      └── Custom Header: X-NS-Param: [Unsanitized Command Token]
  │      │
  │      ▼
  └──► Unchecked execution via backend IPC pipe -> sh command execution (nsppe context)

Because the command parser treats specific malformed delimiters as instruction separators, unauthenticated remote attackers can inject arbitrary shell syntax that executes under privileged user permissions.

2. CVE-2026-88772: DTLS Packet Engine Memory Overflow

The second zero-day flaw specifically targets the Datagram Transport Layer Security (DTLS) protocol stack. DTLS runs over UDP port 443 and is enabled by default whenever a VPN virtual server or ICA proxy gateway is provisioned. During the DTLS handshake sequence, the NetScaler packet engine (nsppe) handles fragmentation and reassembly of TLS records:

/* Conceptual vulnerability in DTLS record defragmentation */
void process_dtls_fragment(dtls_record_t *rec, uint8_t *payload, size_t len) {
    char stack_buf[512];
    /* Flaw: missing boundary assertion on reconstructed fragment size */
    if (rec->frag_offset + len > sizeof(stack_buf)) {
        // Validation missing or integer wrap allows overwrite of return pointer
    }
    memcpy(stack_buf + rec->frag_offset, payload, len);
}

By transmitting crafted UDP datagrams with conflicting sequence numbers and inflated record length headers, attackers cause heap and stack memory corruption in nsppe. While unstable payloads result in immediate packet engine crashes and appliance reboots, weaponized exploits achieve reliable execution flow hijacking.

Forensic Warning: Preserve Evidence Before Patching

Forensic Commands for Incident Responders

# 1. Check for recent packet engine crashes and core dumps
ls -lat /var/core/
ls -lat /var/crash/

# 2. Inspect NetScaler logs for anomalous nsppe terminations
grep -i "nsppe crashed" /var/log/messages*
grep -i "segmentation fault" /var/log/dmesg.boot

# 3. Generate a complete technical support bundle for triage
/netscaler/tools/maketechsupport /var/tmp/colibrisec_forensic_bundle.tar.gz

# 4. Check for unauthorized files written to web document roots
find /netscaler/ns_gui/ /var/vpn/ -mtime -7 -type f

Detection Telemetry & Network Signatures

Remediation & Hardening Playbook

1. Deploy Official Firmware Hotfixes: Upgrade appliances to patched releases CTX697096:
   • NetScaler ADC & Gateway 14.1: build 14.1-38.48 or later
   • NetScaler ADC & Gateway 13.1: build 13.1-58.32 or later
   • NetScaler ADC & Gateway 13.0: build 13.0-92.42 or later
2. Restrict Management Access: Ensure NSIP (NetScaler IP) and SNIP (Subnet IP) administrative interfaces are completely disconnected from the public internet and restricted to management jumpboxes.

Immediate Workaround for CVE-2026-88772: If updates cannot be applied during business hours, disable DTLS on all VPN vServers to eliminate the memory overflow attack vector:

# Disable DTLS on specific VPN vServer
set vpn vserver "VPN-Gateway-External" -dtls OFF