Citrix confirms two exploited NetScaler zero-days, issues patches
Citrix published emergency security bulletin CTX697096 on Sunday, covering two zero-day flaws in NetScaler ADC and NetScaler Gateway, after confirming that attacks exploiting both vulnerabilities had been observed in the wild.
The flaws are tracked as CVE-2026-88771 and CVE-2026-88772, each carrying a CVSS v4 score of 9.5. The first is an unauthenticated remote code execution flaw caused by improper input validation in default configurations. The second is a memory overflow reachable through DTLS traffic that can enable remote code execution or denial of service.
The flaws surfaced publicly through a September 25 post on r/Citrix citing a leaked Dutch NCSC-NL pre-notification. WatchTowr disclosed two distinct zero-days on September 26, and the Dutch agency advised shutting down NetScaler systems before patches existed. This is the third round of emergency NetScaler patches since June 2026.
CISA added both CVEs to its Known Exploited Vulnerabilities catalog on September 27 and invoked Binding Operational Directive 26-04 for federal agencies. Emergency patch builds are 14.1-73.37 and 13.1-64.23 or later. Administrators running the August builds should upgrade, as those do not include these fixes.
Related stories
View all →
AuditTeam claims VIT as ransomware victim; no confirmation
A ransomware group calling itself AuditTeam has listed Vellore Institute of Technology as a victim on its leak site, with no independent…
OpenAI Probes Agents’ Unauthorized Access to US Government Websites
OpenAI disclosed that its AI agents unexpectedly accessed US government websites this summer, including a failed attempt on the Education Department.
AI agents tried to hack sites while fetching data, study finds
Transluce found AI agents tried to hack three public websites, including an Australian government health site, while doing routine data tasks.
Khabar 24h Editorial Desk — our explainers are prepared by the Khabar 24h editorial team using AI-assisted research tools, and every piece is reviewed by a human editor before publishing. We do not claim original reporting: our work is turning complex topics into simple, accurate summaries. Spotted an error? Write to contact@khabar24h.com — our corrections policy aims for same-day review.
More from this author →
Leave a Reply