Citrix Systems (Cloud Software Group)

Incident Overview

In late September 2026, Cloud Software Group (parent company of Citrix Systems) and international cybersecurity authorities issued emergency security disclosures regarding eight vulnerabilities affecting Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway).

Forensic telemetry and threat intelligence confirmed that two vulnerabilities—CVE-2026-88771 (CVSS 9.5) and CVE-2026-88772 (CVSS 9.5)—were weaponized as zero-days under active, in-the-wild exploitation by suspected state-sponsored advanced persistent threat (APT) actors prior to public disclosure:

1. CVE-2026-88771 (CVSS 9.5): An improper input validation flaw allowing unauthenticated remote code execution (RCE) on internet-facing management and gateway ports in default configurations.
2. CVE-2026-88772 (CVSS 9.5): A critical memory buffer boundary violation vulnerability allowing code execution or complete appliance denial-of-service when DTLS protocol features are active.

Telemetry audits identified that threat actors systematically exploited exposed appliances to establish persistent webshells, harvest memory artifacts, and steal cryptographic materials to bypass multi-factor authentication across victim networks. Over 50,000 vulnerable NetScaler appliances were identified as reachable across global enterprise, defense, healthcare, and telecommunications networks.

Compromised Assets & Data Scope

• Exposed Infrastructure Fleet: More than 50,000 Internet-facing NetScaler ADC and NetScaler Gateway appliances globally across commercial and government organizations.
• In-Memory Credentials & Session Tokens: Active user and administrator session tokens, SAML authentication assertions, and corporate Kerberos/Active Directory bind credentials harvested from volatile memory (nsppe process).
• Cryptographic Keys & Secrets: Device TLS private keys, server certificates, and VPN gateway tunnel configuration secrets.
• Persistence Artifacts: Execution of obfuscated webshells written to /var/netscaler/bins/ and /netscaler/ns_gui/vpn/, allowing threat actors to retain interactive terminal control even through soft firmware updates.
• Network Ingress: Unrestricted lateral traversal into backend corporate networks, domain controllers, and cloud environments.

Statutory Disclosures & Compliance

• CISA Binding Operational Directive (BOD 22-01): On September 27, 2026, CISA formally added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities (KEV) Catalog. CISA mandated that all Federal Civilian Executive Branch (FCEB) agencies apply vendor remediations or isolate vulnerable appliances from federal networks by September 30, 2026.
• UK National Cyber Security Centre (NCSC): Issued an emergency national alert advising critical national infrastructure (CNI) operators to conduct memory-dump forensic audits for webshell indicators prior to patching.
• Cloud Software Group (Vendor Advisory): Published Security Bulletin CTX697096 detailing mitigation steps, hotfix RPM packages, and command-line verification scripts for NetScaler ADC and Gateway versions 14.1, 13.1, and 13.0.