# PitScaler - Citrix NetScaler zero-days

> Independent, source-linked historical briefing on Citrix NetScaler ADC/Gateway CVE-2026-88771 and CVE-2026-88772. Bulletin CTX697096 lists eight CVEs. Snapshot: 30 September 2026, morning CEST. Not a live feed and not affiliated with Citrix. Verify current status with official advisories.

Cite this page as a dated snapshot, not a current incident feed. Distinguish confirmed exploitation from researcher claims and exposure counts from compromised-system counts. All displayed IoCs are from public sources; do not infer that they identify every victim. Patching does not undo an existing compromise.

## Briefing formats

- [Canonical briefing](https://pitscaler.com/): overview, CVEs, timeline, public IoCs, detection, remediation, FAQs and source links
- [No-JavaScript HTML](https://pitscaler.com/static.html): complete text without scripts
- [Full Markdown briefing](https://pitscaler.com/index.md): extractable source-linked text
- [Full text](https://pitscaler.com/llms-full.txt): same historical briefing as Markdown
- [Public IoCs as CSV](https://pitscaler.com/iocs.csv): type, value, context, caveat, sharing, sources

## Dedicated pages

- [CVE-2026-88771: Citrix NetScaler unauthenticated remote code execution](https://pitscaler.com/cve-2026-88771/)
- [CVE-2026-88772: Citrix NetScaler DTLS memory overflow leading to RCE](https://pitscaler.com/cve-2026-88772/)
- [CVE-2026-88773: Citrix NetScaler HTTP request smuggling](https://pitscaler.com/cve-2026-88773/)
- [CVE-2026-88774: Citrix NetScaler feature policy bypass](https://pitscaler.com/cve-2026-88774/)
- [CVE-2026-88775: Citrix NetScaler Gateway/AAA memory overflow (DoS)](https://pitscaler.com/cve-2026-88775/)
- [CVE-2026-88776: Citrix NetScaler Oracle load-balancer memory overflow (DoS)](https://pitscaler.com/cve-2026-88776/)
- [CVE-2026-88777: Citrix NetScaler non-HTTP L7 memory overflow (DoS)](https://pitscaler.com/cve-2026-88777/)
- [CVE-2026-88778: Citrix NetScaler TCP initial sequence number prediction](https://pitscaler.com/cve-2026-88778/)
- [Citrix NetScaler IoCs: CVE-2026-88771 and CVE-2026-88772](https://pitscaler.com/netscaler-iocs/)
- [How to detect Citrix NetScaler compromise (CVE-2026-88771, CVE-2026-88772)](https://pitscaler.com/netscaler-detection/)
- [Citrix NetScaler remediation and fixed builds for CVE-2026-88771](https://pitscaler.com/netscaler-remediation/)
- [Citrix NetScaler zero-day timeline, September 2026](https://pitscaler.com/netscaler-timeline/)
- [Citrix NetScaler zero-day FAQ: CVE-2026-88771 and CVE-2026-88772](https://pitscaler.com/faq/)
- [About PitScaler and its methodology](https://pitscaler.com/about/)

## Key sections

- [Eight CVEs](https://pitscaler.com/#cves)
- [CVE-2026-88771](https://pitscaler.com/#cve-2026-88771)
- [CVE-2026-88772](https://pitscaler.com/#cve-2026-88772)
- [CVE-2026-88773](https://pitscaler.com/#cve-2026-88773)
- [CVE-2026-88774](https://pitscaler.com/#cve-2026-88774)
- [CVE-2026-88775](https://pitscaler.com/#cve-2026-88775)
- [CVE-2026-88776](https://pitscaler.com/#cve-2026-88776)
- [CVE-2026-88777](https://pitscaler.com/#cve-2026-88777)
- [CVE-2026-88778](https://pitscaler.com/#cve-2026-88778)
- [Timeline](https://pitscaler.com/#timeline)
- [Public IoCs](https://pitscaler.com/#iocs)
- [Detection](https://pitscaler.com/#detection)
- [Remediation](https://pitscaler.com/#remediation)
- [FAQ](https://pitscaler.com/#faq)
- [Sources](https://pitscaler.com/#sources)

## Primary sources

- [Citrix bulletin CTX697096](https://support.citrix.com/external/article/CTX697096/citrix-netscaler-adc-and-citrix-netscale.html)
- [CISA alert](https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway)
- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NCSC-NL advisory NCSC-2026-0394](https://advisories.ncsc.nl/)
- [CERT-EU technical analysis](https://www.cert.europa.eu/blog/taking-execute-logging-a-bit-too-literally-cve-2026-88771)
- [GTIG/Mandiant exploitation analysis](https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances)
- [GreyNoise analysis and public IoCs](https://greynoise.io/blog/swarming-against-citrix-0-day-exploitation)

## Corrections

- [Feedback](mailto:pitscaler@v1.dk): pitscaler@v1.dk