Citrix NetScaler zero-days exploited: intrusions in Finland

📌 Later developments: NetScaler CVE-2026-107406: SAML IdP at risk even after patching (October 9, 2026) · NetScaler zero-days: WHIPSHOT and SLAPSHOT malware, IoCs to hunt (September 29, 2026)

On 27 September 2026 Citrix released fixes for several vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited before the patches were available. On the same day CISA added them to its Known Exploited Vulnerabilities (KEV) catalog, with a 30 September deadline for US federal agencies.

In Europe the best-documented case is Finland: the Kyberturvallisuuskeskus (NCSC-FI) received reports of successful intrusions in the country and issued an alert, updated on 3 October. The Dutch NCSC-NL also published an advisory (NCSC-2026-0394) rated H/H: high likelihood and high impact.

What happened

According to NCSC-FI, exploitation began before 27 September, so the intrusions hit systems for which no fix existed yet. The Finnish agency identified hundreds of exposed NetScaler instances in the country and contacted their operators. The Canadian Centre for Cyber Security reports exploitation observed across multiple Citrix customer environments worldwide, and notes that the full extent of the activity is not yet known.

Both agencies agree on one point: anyone exposing NetScaler to the Internet should assume the appliance may have been attacked. Patching is not enough, because an attacker who got in before the fix may have left persistence mechanisms that survive the installation of the new versions.

Technical details

• CVE-2026-88771: improper input validation (CWE-20). It allows a remote, unauthenticated attacker to execute arbitrary code on the appliance. According to the Canadian Centre for Cyber Security, successful exploitation can lead to full compromise of the appliance, unauthorised access to applications and services, credential theft and lateral movement towards internal systems.
• CVE-2026-88772: buffer overflow (CWE-119, improper restriction of operations within the bounds of a memory buffer). It can cause arbitrary code execution, memory corruption or denial of service.
• The full bulletin: according to NCSC-FI, eight CVEs were fixed on 27 September, from CVE-2026-88771 to CVE-2026-88778, with CVSS 4.0 scores between 7.0 and 9.5. They include remote code execution, HTTP request smuggling, memory corruption and bypass of protection mechanisms.
• Affected versions:
  • NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37;
  • NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23;
  • NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS;
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.279.
• Vector: network, against the exposed appliance. In MITRE ATT&CK the exploitation maps to T1190 (Exploit Public-Facing Application).
• Use in ransomware campaigns: unknown for now, according to CISA.

What came next: the SAML issue

On 2 October Citrix reported a new issue affecting appliances configured with SAML authentication: a remote attacker can make them unstable, causing denial of service, repeated reboots and possibly further exploitation. The Canadian Centre for Cyber Security states that this is a separate flaw and that the versions fixing CVE-2026-88771 and CVE-2026-88772 do not address it. NCSC-FI stresses that it depends on the configuration and does not affect every installation. We covered it in our article on the NetScaler SAML zero-day.

Impact for European and Italian companies

NetScaler Gateway is used by organisations of every size for employee remote access: a compromised appliance gives the attacker a privileged position on the perimeter and a path into the internal network. The Finnish case shows that the attacks also hit European organisations, before a patch even existed.

For NIS2 entities, a compromise of the remote access gateway is an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN. The same applies to healthcare organisations, where the gateway can open remote access to clinical systems.

What to do now

1. Update: bring every NetScaler ADC and Gateway to at least 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1-37.279 (13.1-FIPS and 13.1-NDcPP). If you use SAML, also follow Citrix’s guidance on the new issue and install the new fixed builds.
2. Preserve evidence before acting: where possible, save appliance logs, remote syslog, NetScaler Console logs and support bundles before rebooting, patching or rebuilding.
3. Look for signs of compromise: run Citrix’s indicators of compromise (IOC) tool for NetScaler Console. Check newly created accounts, scheduled tasks, services, startup scripts, web application directories and crash dumps, as well as running processes and active connections.
4. Widen the investigation: correlate the findings with firewall, DNS, authentication and endpoint logs. Look for unexpected outbound connections, unusual administrative access and suspicious activity on systems reachable from the appliance.
5. If you suspect a compromise: isolate the appliance, change administrative passwords, invalidate active sessions and replace certificates. Be ready to rebuild the appliance from trusted software and a verified configuration, and contact Citrix.
6. Assess the exposure: the Canadian Centre for Cyber Security suggests, where the risk assessment justifies it, temporarily shutting down Internet-facing appliances, weighing the risks against the impact on the service.

How ARXDOME helps

ARX Expose shows which services your company exposes on the Internet, which products are recognised on them and which have known vulnerabilities: it helps you quickly find the gateways to update. ARX Sentry collects firewall and network device logs in a central collector, so unusual connections and suspicious access stay in front of the analysts. With ARX Horizon you can look up vulnerabilities and search for indicators of compromise from the portal.

Last updated: 3 October 2026