Two Citrix NetScaler zero-days exploited before a patch existed

What happened

NetScaler ADC and NetScaler Gateway are appliances that sit at the edge of an organisation's network. They balance traffic between servers and give staff remote access through a virtual private network, or VPN. The first flaw, CVE-2026-88771, comes from improper checking of input. It lets an attacker who has not logged in run commands, and it affects all deployments, including default settings. The second, CVE-2026-88772, is a memory overflow. It can be exploited when DTLS is switched on, which Citrix says is the default for VPN servers.

Warnings spread before the details were public. BleepingComputer reported that administrators on Reddit said their IT suppliers and security teams had privately advised them to shut their NetScaler appliances down immediately, without explaining why. A notice from the Dutch national cyber security centre, NCSC-NL, which circulated online, said Citrix had found the flaws while investigating incidents at several customers. The notice said the information came from a European partner team, and warned that attacks could increase once patches and technical details were released. The agency declined to confirm the notice to BleepingComputer.

Citrix released fixed versions for the supported 14.1 and 13.1 branches, including special builds for government security standards. Its bulletin fixed six other NetScaler flaws at the same time. CISA added the two zero-days to its catalogue of known exploited vulnerabilities on 27 September. It later added a third flaw, CVE-2026-88779, on 4 October, and by 9 October its alert covered ten Citrix vulnerabilities in total, plus a separate bulletin for CVE-2026-107406.

The engineering behind it

Both flaws belong to old, well-known classes of bug. Improper input validation means a program trusts data from outside without checking it fully, so a specially shaped request can make it do something unintended. A memory overflow means the program writes more data into a memory area than it can hold, overwriting nearby memory. The Dutch notice said one flaw let attackers place shellcode, a small piece of attack code, directly into memory. In general, both kinds of bug are made worse when the software is exposed to the whole internet.

DTLS stands for Datagram Transport Layer Security. It is a version of the TLS encryption protocol designed for UDP, a fast network protocol that does not guarantee delivery. VPNs often use it because it handles voice and video traffic well. That convenience also means one more piece of complex code is listening for messages from anyone on the internet, which is where CVE-2026-88772 can be reached.

CISA's update showed how flaws can be chained. CVE-2026-88779 affects appliances set up for SAML, a common single sign-on system, and on its own can crash the device. CISA said that on unpatched devices, an attacker could use it to force a reboot, which could make code planted through CVE-2026-88771 run. One bug that seems only disruptive can therefore help another bug do more harm.

CISA's advice followed a specific order. First, check for signs of compromise, using indicators Citrix provided. Second, send the appliance's logs to a central log system, because local logs rotate quickly and can erase evidence. Third, preserve forensic evidence before updating, because updates can reduce what investigators can see. Then patch quickly. If compromise is suspected, restore a clean backup from before the attack and replace all passwords, encryption keys and certificates.

What it means in Nepal

The sources do not mention Nepal or any Nepali users of NetScaler. The lesson is about the type of device. Any organisation, in any country, that gives staff remote access depends on an edge device like this. Because it faces the internet and sits in front of internal systems, it is a valuable target. If an attacker controls it, they may be able to watch traffic, steal login sessions or move deeper into the network.

The case also shows that patching is not always the first step. Many people assume the right reaction to a security alert is to install the update immediately. CISA's guidance says to look for signs of attack and save evidence first, because an update can remove the traces investigators need. Knowing this order, and why it exists, is part of incident response work in any security operations team. Where patching cannot happen at once, BleepingComputer passed on the advice to reduce the device's exposure to the internet.

Students can use the CISA alert as a study case. It shows how a vulnerability moves from private warnings to public disclosure, catalogue entries, detection rules and later updates over about two weeks. Reading an alert like this, finding the affected versions and writing down the steps an organisation should take is useful practice for a career in networking or security.