Citrix NetScaler Zero-Days Hit Default Configs. CISA Gave Agencies Three Days.

Opening & At a Glance

On Saturday, 26 September 2026, some NetScaler admins were still waiting for CVE IDs when their suppliers told them to shut the appliances down. By Sunday, Citrix had published security bulletin CTX697096, confirmed that two critical remote-code-execution bugs were already being exploited, and CISA had put both on its Known Exploited Vulnerabilities catalog. If you run a customer-managed NetScaler ADC or Gateway on the internet, this is not a next-patch-window story. It's forensics first, then upgrade. BleepingComputer reports CISA ordered federal civilian agencies to secure vulnerable appliances by 30 September.

What Happened, in Plain English

NetScaler sits at the edge: VPN, load balancing, auth for people reaching internal apps. When it breaks open, the attacker starts on the perimeter, not inside a SaaS tenant.

Citrix's bulletin lists eight CVEs. The two already in the wild are the ones that matter this week. CVE-2026-88771 is improper input validation that lets an unauthenticated attacker run arbitrary commands on every NetScaler ADC and Gateway deployment in the default configuration. No extra feature flag. CVE-2026-88772 is a memory overflow that can lead to RCE or denial of service when DTLS is enabled. Citrix notes DTLS is enabled by default on VPN virtual servers unless you turn it off.

Fixed builds from the same bulletin: 14.1-73.37 and later, 13.1-64.23 and later, plus matching FIPS / NDcPP builds. Versions 12.1 and 13.0 are end-of-life; migrate those. Six further flaws (88773–88778) depend on specific configs. Only 88771 and 88772 are confirmed exploited so far.

The weekend timeline is messy in a familiar way. BleepingComputer reports national CERTs and suppliers were privately telling customers to take appliances offline before Citrix's public post. watchTowr says it warned on 26 September that unpatched NetScaler RCE bugs were being exploited. Citrix and CISA went public on the 27th.

Confirmed vs Contested — Keep the Labels Honest

I'd treat the Shadowserver map as a reminder that the attack surface is large, not as a count of how many boxes will get owned this week. Exposure and vulnerability are different numbers.

What Operators Should Actually Do

CISA's advice is blunt: check for compromise before you patch if you can, because the update can wipe forensic evidence. Citrix ships IoCs through NetScaler Console and has published compromise-assessment guidance. It also warns those IoCs "might be of limited forensic value and might fail to identify actual compromises." A clean scan is not a clean bill of health.

Practical order that matches the vendors: preserve logs, a snapshot, a support bundle. Run whatever compromise check you have. Install the fixed build for your branch. Rotate secrets and certificates that lived on or through the appliance. Keep management interfaces off the public internet.

Edge appliances keep landing on the KEV list because they concentrate trust. Patching faster helps. Designing so one compromised box isn't a free pass into the estate helps more. If you're building around evaluation and security tooling, the Snorkel AI raise piece is a reminder that capital is pouring into AI evaluation while plenty of smaller openings still sit around knowing what you exposed last weekend. And if you're shopping for a security brand rather than another point tool, a category-flexible name like RogueGhost.com survives product pivots better than a feature-named domain. That's opinion. The CVEs aren't.

Questions Readers Are Likely to Ask

If I already patched CVE-2026-19490, am I done? No. watchTowr notes appliances patched for that earlier KEV entry remain vulnerable to 88771 and 88772 unless they run a fixed build from CTX697096.

Is there a workaround? Citrix has not published one for either bug. Upgrade is the fix. Disabling DTLS may clear the precondition for 88772; it does nothing for 88771. BOD 26-04 binds federal civilian agencies only, but CISA still encourages everyone else to treat KEV listings as emergency work.

Closing & Sources

The durable facts are on Citrix's bulletin and CISA's alerts: eight NetScaler CVEs disclosed, two critical RCEs already exploited, fixed builds named, KEV listing on 27 September. The 30 September federal due date and ~23,000 internet-facing fingerprint count are as reported by BleepingComputer (Shadowserver for the scan). No public actor attribution yet.

• Citrix / Cloud Software Group — Security Bulletin CTX697096 (27 Sep 2026)
• CISA — "Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway" (27 Sep 2026; revised 28 Sep)
• CISA — "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (27 Sep 2026)
• BleepingComputer — Sergiu Gatlan, "CISA orders feds to patch exploited Citrix flaws by Wednesday" (28 Sep 2026)
• Rapid7 — Zero-Day Exploitation of Citrix NetScaler ADC and Gateway (28 Sep 2026)
• watchTowr — Citrix NetScaler Zero-Days FAQ (27 Sep 2026)

Methodology Note: Editorial synthesis of Citrix CTX697096 (primary), CISA alerts, BleepingComputer, Rapid7 and watchTowr. Exposure counts and federal due-date detail attributed to secondary reporting where the primary page did not state them. RogueGhost is not affiliated with Citrix, Cloud Software Group or CISA. Analysis labelled as analysis.