Citrix Zero-Days: Is Your Remote-Access Box Already Hacked?

If your staff log in from home through a Citrix NetScaler Gateway (often called "Citrix ADC" or just "the Citrix box"), treat it as a possible target and check your vendor's current guidance. Check your vendor's and your national cyber agency's current advisories to see whether your NetScaler deployment is affected. So installing the update is not enough: first check whether someone already got in, save the evidence, then patch. And whether or not you run Citrix, this is the moment to list every remote-access device your business exposes to the internet.

That is the short answer. The rest of this post explains what happened, why the usual "just patch it" advice falls short this time, and a check-before-you-patch routine a non-technical owner can hand to their IT person or provider today.

What happened with Citrix NetScaler in September

Citrix's security bulletin CTX697096 covers eight vulnerabilities in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 through CVE-2026-88778. Two of them are the problem:

• CVE-2026-88771: improper input validation that lets an unauthenticated attacker run arbitrary commands. It has a severity score of 9.5, and it affects the default configuration.
• CVE-2026-88772: a memory overflow that can lead to remote code execution or denial of service when a feature called DTLS is enabled, which is the default for VPN virtual servers.

Citrix's own wording is blunt: "Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed". According to Help Net Security, the affected builds are NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23. The fixed builds are 14.1-73.37 and later, and 13.1-64.23 and later releases of 13.1.

CISA said it received reports and partner threat intelligence confirming threat actors are actively exploiting the vulnerabilities globally, and it added both CVEs to its Known Exploited Vulnerabilities (KEV) Catalog on Sept. 27, 2026. According to BleepingComputer, CISA also ordered Federal Civilian Executive Branch agencies to secure all vulnerable Citrix appliances by September 30, as mandated by Binding Operational Directive 26-04. That is the date this post goes up.

How long has this been going on? European government sources had been warning organizations about active attacks all week, and security researcher Kevin Beaumont said the attacks have been unfolding this entire month. In plain terms, security researcher Kevin Beaumont said the attacks have been unfolding this entire month.

They describe how edge devices in general get attacked and how slowly they get fixed, which is the backdrop for everything below.

Why "just patch it" isn't enough this time

Normally, a vendor ships a fix, you install it, and you are done. A zero-day breaks that logic, because the attack happened before the fix existed. Patching closes the door, but it does not tell you whether someone already walked through it and left a key under the mat. Sophos makes the same point: applying the security updates alone may not remove attacker access from an appliance compromised before remediation.

There is a second, less obvious problem: the update itself can destroy the evidence. CISA encourages users to check for indication of compromise before patching, and says to preserve forensic evidence before applying updates because updates may cause loss of forensic visibility.

The Dutch NCSC goes further. It advised backing up device memory and logs going back at least a month before installing updates, and monitoring the devices afterward.

Two more traps to know about:

1. Don't treat turning off DTLS as a fix. Disabling it mitigates CVE-2026-88772 but does nothing against CVE-2026-88771. Disabling DTLS mitigates CVE-2026-88772 but not CVE-2026-88771. You still need the upgrade.
2. Automated checks are a start, not a verdict. Citrix warns its IOCs do not cover every technique, so a clean result is not proof an appliance was not compromised. A clean scan lowers the odds; it does not prove nothing happened.

Why this matters to a small business, not just government agencies

The broader data says otherwise. Tenable's analysis of recent breach data found:

• Vulnerability exploitation was second as an initial access vector, at 20%, two percentage points below the top vector, credential abuse.
• Edge devices and VPNs accounted for 22% of vulnerability exploits, up from 3% in the prior period, a surge of nearly eightfold.
• Organizations fully remediated only 54% of these edge vulnerabilities, and the median time to remediate was 32 days.

Put those together: attackers increasingly go after the remote-access box, and those boxes stay unpatched for weeks. A small business with no dedicated security staff tends to sit at the slow end of that curve. A clinic, law office or accounting firm whose staff work from home through a gateway is exactly the profile worth worrying about.

Do you even know what's on your network edge?

Your "edge" is every device that sits between the internet and your office network and accepts connections from outside. For many small businesses, that list may be longer than the owner expects:

The honest question is not "do we use Citrix?" It is "could we write down every one of these, with its software version, in ten minutes?" Many owners cannot answer that offhand, and that is not a character flaw. These devices get installed by a vendor, a former IT person, or the ISP, and then they run quietly until something like this week happens.

A check-before-you-patch routine: logs, memory, webshell signs

Here is an evidence-first order of operations, translated for a small business, with what to ask your IT person or managed provider at each step. Citrix has made indicators of compromise available through NetScaler Console.

Step 1: Confirm whether you're affected

Find out if you run NetScaler ADC or Gateway and which build. Affected versions are Citrix NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23. If you are on an older release line that no longer receives fixes, the answer is not to patch but to plan a migration to a supported version or a different product.

Ask: "What version is our Citrix box on, and is the VPN feature turned on?"

Step 2: Limit exposure while you check

If you can't patch right away, consider isolating the affected system and replacing it with a new, fully up-to-date one, or restricting access to only your organization's known IP range. For a small office, that might mean temporarily allowing logins only from known staff locations, or pausing remote access for a few hours. Yes, it may interrupt work. A few hours of inconvenience is cheaper than a ransomware week.

Step 3: Save the evidence before touching anything

Follow the advice NCSC-NL gave: back up the device's memory and its logs going back at least a month before installing updates, and keep monitoring afterward. Store copies somewhere off the device. If you have a cyber insurance policy, read its notice requirements and call the carrier's hotline early; they may want to involve an incident-response firm of their choosing.

Step 4: Hunt for signs of compromise

Citrix has made indicators of compromise available through NetScaler Console. Your provider should run those, and also look for:

• Unexpected files in the web-facing folders of the appliance, such as a "webshell" (a small script that gives an attacker a back door even after patching).
• Unfamiliar admin accounts or configuration changes nobody remembers making.
• Odd logins: sessions from unusual countries, at odd hours, or many sessions from one account.
• New outbound connections from the appliance to the internet, which a gateway rarely needs to make on its own.

Remember the caveat: a clean IOC result is not proof the appliance was untouched.

Step 5: Patch, then reset

Upgrade to 14.1-73.37 or later, or 13.1-64.23 or later on the 13.1 line. After patching, it is good practice to end all existing VPN sessions and reset passwords for accounts that used the gateway, so any stolen session or credential stops working.

Step 6: Report and keep watching

If you find evidence of compromise, treat it as an incident: involve your insurer and a qualified responder, and talk to your attorney about any notification duties if customer or patient data may be involved. Then keep monitoring the device for suspicious traffic after the upgrade. One clean check is not the end of the story.

Worked example (hypothetical)

Hypothetical: picture a 20-person accounting office in Orange County. Staff work from home through a NetScaler Gateway installed years ago by a former IT contractor, with DTLS on because nobody ever changed the defaults. It is a busy stretch of the year, so everyone is logged in.

• Monday morning: the managed provider confirms the build is on the 14.1 line but older than the fixed release. Affected.
• Monday, mid-morning: remote access is restricted to known staff locations. Two people work from the office for the day.
• Monday, noon: more than a month of logs and a memory capture are copied off the device.
• Monday afternoon: the provider runs Citrix's indicators and does its own manual review. Nothing unusual: no unknown files, no new admin accounts, no strange outbound traffic.
• Monday evening: upgrade, end all sessions, force password resets, reopen access.
• The following weeks: the provider reviews gateway logs weekly and watches for configuration drift.

Total disruption: roughly a working day of reduced remote access. If the hunt had found a webshell, the saved evidence would let a responder work out what the attacker touched, which is exactly what the owner, the insurer and any regulator will ask.

Common pitfalls to avoid

• "Our IT company auto-patches, so we're fine." Auto-patching closes the hole but may wipe the evidence of a break-in that already happened, and it may not evict an attacker who is already inside. Ask whether they checked first.
• "We disabled DTLS."
• "We don't use Citrix." Then the lesson still applies to whatever firewall or VPN brand you do run. Different logo, same front door.
• "The scan came back clean." Good news, not proof. Keep monitoring for at least a few weeks.
• Forgetting the old box. The appliance that "isn't really used anymore" but still answers on the internet is often the one nobody is watching.

Automating edge-device exposure checks

The deeper fix is to stop learning about your own edge from the news. Consider automating this check with a script that runs on a schedule, looks at your public IP addresses from the outside, lists what is answering, records versions, and compares them against the vendor bulletins and any known-exploited-vulnerability lists you rely on. When something on your edge matches a newly exploited flaw, you get a message that day with the device name and the fix, instead of finding out weeks later.

As part of our security and automation services, we build repeatable exposure checks for small businesses: an outside-in view of what you expose, a running edge inventory, and alerts tied to exploited-vulnerability lists, delivered in plain English to the owner and the IT provider. Where a check needs to plug into your existing tools or ticketing, our custom software development team builds the glue, and our AI automation work can turn raw scan output into a short weekly summary someone will actually read.

What we'd do for a typical SoCal office this week:

1. Map every internet-facing device from the outside, Citrix or not.
2. For any NetScaler, walk your provider through the evidence-first routine above.
3. Set up a recurring exposure check so the next edge-device zero-day shows up in your inbox before it shows up in a ransom note.

We work with businesses across the region, from the Inland Empire to San Diego; see our Southern California service area.

Next step

If you are not sure what your business exposes to the internet, or whether your remote-access box was checked before it was patched, book a free automation audit. We will help you build a picture of your edge and show you what an automated exposure check would look like for your setup.

Sources

• CISA — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (September 27, 2026)
• Citrix (Cloud Software Group) — NetScaler ADC and NetScaler Gateway Security Bulletin (CTX697096) (September 27, 2026)
• Sophos — Citrix NetScaler CVE-2026-88771 and CVE-2026-88772 in active exploitation (September 28, 2026)
• BleepingComputer — Citrix admins warned to shut down NetScalers over 2 exploited zero-days (September 27, 2026)
• BleepingComputer — CISA orders feds to patch exploited Citrix flaws by Wednesday (September 28, 2026)
• Help Net Security — Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772) (September 28, 2026)
• Infosecurity Magazine — Verizon's DBIR Reveals 34% Jump in Vulnerability Exploitation (April 23, 2025)
• Bitsight — Critical Vulnerability Alert: CVE-2026-88771 & CVE-2026-88772 Citrix NetScaler flaws under exploitation (September 28, 2026)
• CISA — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (September 27, 2026)
• Tenable — Cybersecurity Snapshot: Verizon DBIR on zero-day exploits, VPN and edge devices (April 25, 2025)
• watchTowr — Citrix NetScaler Zero-Day RCE FAQ: CVE-2026-88771 and CVE-2026-88772 (September 27, 2026)