CVE-2026-88772Vulnerability
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Reported by 23 independent sources · first reported by CISA advisories · last reported
Last reported 10 days ago
Fix due 30 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 92% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
52 reports · the newest 20, newest first · the exact sentence from each-
Top RCE Vulnerabilities“CVE-2026-88771, CVE-2026-88772”
-
September 2026 CVE Landscape“September reporting also highlighted zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 (NetScaler), as well as renewed exploitation of CVE-2026-35273 (PeopleSoft) against unpatched systems.”
-
Citrix gives NetScaler admins another critical reason to patch“Google researchers said a campaign exploiting CVE-2026-88772 had been underway since at least early September, with organizations in government, finance, legal, and education across North America and Europe likely affected.”
-
CVE-2026-107406: Citrix Fixes Critical NetScaler ADC and Gateway Vulnerability“…cently, the company confirmed active exploitation of two other flaws, respectively tracked as CVE-2026-88771 (CVSS score of 9.5) and CVE-2026-88772 (CVSS score of 9.5), on unpatched systems and urged customers to install the relevant updates as soon as possible.”
-
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability“A week before, two other NetScaler zero-days were patched: CVE-2026-88771 (leading to RCE), and CVE-2026-88772 (leading to RCE or DoS).”
-
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation“Citrix disclosed CVE-2026-88771 and CVE-2026-88772 on September 27, 2026, alongside six other NetScaler ADC and Gateway vulnerabilities.”
-
Q3 2026 Attack Techniques Trend Report“Regarding breaches of perimeter devices, exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and Gateway, as well as CVE-2026-20079 in Cisco Secure Firewall Management Center (FMC), CVE-2026-20316 were confirmed.”
-
Blinder Tunnel Campaign Targets Iraqi Infrastructure“Next: Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)”
-
Citrix NetScaler security snafus get even worse amid more 0-day reports“…e earlier eight CVEs finally disclosed by Citrix on September 27 - weeks after miscreants began abusing two of these security holes (CVE-2026-88772 and CVE-2026-88771) - watchTowr researchers told us they suspect it has been used to purposefully crash machines, making exploitatio…”
-
CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)“…es and reboots after they’ve upgraded to patch eight vulnerabilities, including two actively exploited zero-days: CVE-2026-88771 and CVE-2026-88772.”
-
5th October – Threat Intelligence Report“Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771))”
-
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline“The development also follows reports of active exploitation of CVE-2026-88771 and CVE-2026-88772 to plant web shells and tunneling tools on compromised systems.”
-
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier“…attacks were spotted just days after NetScaler administrators were warned about two actively exploited zero-days, CVE-2026-88771 and CVE-2026-88772, which forced some customers to pull the plug.”
-
Bulletin d'actualité CERTFR-2026-ACT-042 (05 octobre 2026)“CVE-2026-88772”
-
Week in review: Researcher breaks into Microsoft analytics service, NetScaler RCE 0-day exploited“Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)”
-
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes“…(CVE-2026-94127), Cisco Catalyst SD-WAN Manager (CVE-2026-76504), and Citrix NetScaler ADC and NetScaler Gateway (CVE-2026-88771 and CVE-2026-88772) have come under in-the-wild exploitation.”
-
Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.“Two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were used against organizations worldwide before a patch existed.”
-
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs“The security flaw, along with CVE-2026-88772, was disclosed last week after reports that the Dutch National Cyber Security Centre (NCSC-NL) reportedly sent a pre-notification to organizations in the Netherlands that urged organizations to shut their appliances down, citing active…”
-
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks“The vulnerabilities are tracked as CVE-2026-88771 and CVE-2026-88772, and they affect NetScaler ADC and NetScaler Gateway instances.”
-
Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)“Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772)”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-88771, CVE-2026-88779, CVE-2026-76504, CVE-2026-86950, CVE-2026-104286, CVE-2026-93616, CVE-2026-94127, CVE-2026-85102, CVE-2026-107406, CVE-2026-60004, CVE-2026-20316, CVE-2026-76461, CVE-2026-20079, CVE-2026-87902, CVE-2026-65660, CVE-2026-93952, CVE-2026-33824, CVE-2022-0847, CVE-2026-35273, CVE-2026-85046
Thanks — we review every report.