Citrix NetScaler zero days have now hit customers three times since June 2026, and the latest round, disclosed on September 27, included CVE-2026-88771, which lets an attacker with no login run commands on appliances in their default configuration, and CVE-2026-88772, a memory flaw reachable when DTLS is enabled, as it is by default on VPN virtual servers. Both were exploited before a patch existed, CISA added them to the Known Exploited Vulnerabilities catalog the same day, and the advisory covered eight NetScaler ADC and Gateway flaws in all, including denial of service and request smuggling issues. For a business that uses NetScaler for remote access, the response is a checklist: patch every appliance, end existing sessions, hunt for signs of compromise, and decide whether that remote access gateway still needs to face the internet at all.
Why Remote Access Gateways Keep Getting Hit
Remote access gateways keep getting hit because they sit on the internet by design (like the office phone systems in your PBX is an internet-facing server), accept connections from anyone before checking who they are, and hold the credentials and sessions that open the rest of the network, which makes them prime targets for identity-based attacks that cost SMBs real money. A flaw in the part of the appliance that runs before login is the most valuable bug an attacker can find.
Our team has watched the same cycle repeat across clients for years. A NetScaler, VPN concentrator or firewall portal is installed so staff can work remotely. It works reliably, so it is updated rarely. Then a pre-login flaw lands, attackers scan the whole internet within hours, and organizations that patch on a monthly or quarterly rhythm find out they were compromised in the gap.
Here are the five principles behind this checklist:
- Patch within days, not cycles. Pre-login flaws on edge appliances justify an emergency window every time.
- Patching does not end sessions. Existing sessions and stolen tokens survive the update unless you end them.
- Assume the gap was used. Appliances exposed before the fix need a compromise review.
- Three times is a pattern. Repeated zero days are a reason to revisit architecture, not just the patch schedule.
- Someone must own the edge. Every internet-facing appliance needs a named owner and a response time.
This checklist is written for IT managers, operations leads and owners at organizations of 50 to 500 people that run Citrix NetScaler ADC or Gateway for remote access, application delivery or load balancing.
What the September Flaws Do
CVE-2026-88771 is an input validation flaw that lets an unauthenticated attacker run commands on any affected appliance in its default setup. CVE-2026-88772 is a memory boundary flaw in the DTLS handling used by VPN virtual servers, which most remote access deployments have turned on.
Some administrators reason that a flaw reachable only with a feature enabled is narrower. Here the feature is on by default for the most common deployment, so the practical exposure is nearly universal for organizations using NetScaler as a VPN. Treat both as critical.
Why Federal Deadlines Matter to Private Firms
CISA ordered federal civilian agencies to patch or disconnect affected appliances by September 30, three days after disclosure. Private businesses are not bound by that order, but the deadline tells you how CISA judged the risk.
A private firm might reasonably take a few extra days to schedule downtime. Taking weeks, as many do for routine updates, leaves the appliance exposed during the period of heaviest scanning.
Patching Every NetScaler Appliance
Patching every NetScaler appliance means installing the fixed firmware Citrix published in its September advisory on each ADC and Gateway, including high availability pairs, disaster recovery units and any test appliances that face the internet. Missing one unit in a pair leaves the pair exposed after a failover.
Building the Appliance List
Ask your administrator or provider to list every NetScaler instance, physical or virtual, with its role, firmware build and whether it is reachable from the internet. Cloud marketplace instances count too.
The objection that the list already exists is common, and often the list is out of date. Cross-check against the public IP addresses your organization owns and an external scan, so nothing is missed. A cyber security audit is a good occasion to reconcile the list.
Scheduling the Upgrade
Upgrading a high availability pair usually means upgrading the secondary, failing over, then upgrading the former primary, which keeps downtime short. A single appliance needs a brief outage, which an early-morning window covers for most firms.
Some teams prefer to wait for a weekend. Given exploitation before the patch existed, the safer choice is the first available window, even midweek, with users warned the night before.
Ending Sessions and Rotating Secrets
Ending sessions and rotating secrets means terminating every active session on the appliance after the upgrade, and changing credentials an attacker could have captured, because a patched appliance still honors sessions created while it was vulnerable. Previous NetScaler incidents showed attackers reusing stolen session tokens long after the patch.
Which Sessions to End
Citrix guidance after earlier incidents has been to kill all ICA, PCoIP, AAA and persistent sessions once the upgrade is complete. Users will need to sign in again, which is a small cost for removing any hijacked session.
The counterpoint is that forcing everyone to reconnect generates help desk calls. A short notice to staff explaining the sign-in prompt keeps that manageable, and security awareness training teaches staff to expect such prompts only from IT.
Which Secrets to Rotate
If there is any sign of compromise, change the passwords of administrative accounts on the appliance, rotate service account credentials it uses to reach Active Directory or other systems, and replace certificates whose private material lived on the device. Review configuration for unknown users or changed authentication settings.
Hunting for Signs of Compromise
Hunting for signs of compromise means checking the appliance and the network behind it for evidence that attackers used the window before patching. Because both September flaws were exploited as zero days, any appliance that faced the internet before the update should be reviewed.
On the Appliance
Look for unexpected files in web directories, new scheduled jobs, unfamiliar processes and changed configuration. Compare against indicators of compromise published by Citrix and security researchers, and keep a copy of logs before rebooting, since some evidence lives only in memory or temporary storage. A provider of managed security services should handle this collection.
Some teams skip this step when the patch went in quickly. If the appliance was exposed for even a day before the fix existed, a review is still warranted.
Behind the Appliance
Check authentication logs in Active Directory or your identity provider for sign-ins from the appliance’s internal address at odd hours, new accounts and unusual access to file shares or servers. A compromised gateway is often only the first step, which is why network security monitoring behind the edge matters.
Rethinking Remote Access After Three Zero Days
Rethinking remote access means asking whether every user needs a full network tunnel through an internet-facing appliance, or whether identity-based access to individual applications would serve them with less exposure. Three exploited zero days in four months is a reasonable trigger for that conversation.
Questions to Ask Your IT Provider
- Which NetScaler appliances do we run, and which face the internet?
- What firmware build is each on, and when was the September fix applied?
- Were all sessions terminated after the upgrade?
- Was each exposed appliance reviewed against published indicators?
- What would it take to move remote users to application-level access instead?
Weighing the Change
Some organizations rely on NetScaler for application delivery that is hard to replace, and keeping it with tighter controls is a fair choice. Others use it only as a VPN, and for them a zero trust access service in front of applications removes the internet-facing appliance entirely, a step covered in zero trust security for a small business. Either way, the decision deserves an owner and a date, and any move should be planned like a cloud migration without downtime.
Frequently Asked Questions
Which Citrix NetScaler flaws were exploited in September 2026?
CVE-2026-88771 and CVE-2026-88772 were exploited as zero days before Citrix released fixes on September 27. CISA added both to its Known Exploited Vulnerabilities catalog that day.
Is patching NetScaler enough on its own?
No, you should also terminate all active sessions after the upgrade, because sessions created while the appliance was vulnerable can survive the patch. Review the appliance for compromise if it was exposed beforehand.
Does CVE-2026-88772 affect our VPN?
It is reachable when DTLS is enabled, which is the default on NetScaler VPN virtual servers. Most remote access deployments should assume they are affected.
How fast should a NetScaler zero day be patched?
Within days. CISA gave federal agencies three days for the September flaws, which reflects how quickly attackers scan for exposed appliances.
Should we replace NetScaler after repeated zero days?
It depends on what you use it for. Organizations using it only as a VPN should evaluate application-level zero trust access as a replacement.
Who Stands Behind This Guidance
Mindcore Technologies manages remote access, networks and security for small and midsize organizations whose staff work from offices, homes and the road. Our team follows CISA’s Known Exploited Vulnerabilities catalog daily and turns edge-appliance advisories into patching, session cleanup and compromise reviews for the equipment our clients run. That approach reflects the priorities of Matt Rosenthal, Mindcore’s CEO, who has built the company around protecting the systems that open the door to everything else.
Work Through the NetScaler Checklist Now
Citrix NetScaler has been hit by three exploited zero days since June, and the September flaws let attackers run commands before login on appliances in their default setup. Patch every appliance including standby units, end all sessions after the upgrade, rotate secrets and review anything that was exposed, then decide whether your remote access still needs an internet-facing gateway at all. If you want help working through the checklist or planning a move to application-level access, book a free strategy call and we will go through your remote access setup with you.
