Inland Sea WorksISW
← Back to Field Notes
Technology & InfrastructureInland Sea Works3 min read

A Citrix NetScaler Zero-Day Went Unpatched for Weeks, and 50,000 Businesses Were Exposed

Two actively exploited Citrix NetScaler vulnerabilities sat unpatched for weeks before anyone realized it, a reminder that remote-access appliances deserve the same patching discipline as everything else.

Citrix confirmed on September 27 that two vulnerabilities in NetScaler ADC and NetScaler Gateway, the appliances a huge number of businesses use to run VPNs and remote access, had been under active exploitation since at least early September. According to Help Net Security and SecurityWeek, the attacks were first flagged by researchers at GreyNoise and watchTowr before Citrix had a patch ready, and Palo Alto Networks counted roughly 50,000 NetScaler instances still exposed to the internet as of September 27.

What the flaws actually do. CVE-2026-88771 (CVSS 9.5) lets an unauthenticated attacker run arbitrary commands on a default NetScaler configuration, no login required. CVE-2026-88772 (also CVSS 9.5) is a memory overflow in the component that handles DTLS, which is turned on by default on virtual VPN servers, and can lead to remote code execution or a denial of service. Either one, on its own, is about as bad as it gets for an internet-facing appliance.

Why the timeline is the real story. This wasn’t a same-day patch situation. Researchers say the exploitation campaign had been running since at least early September, meaning attackers had a multi-week head start before Citrix confirmed anything publicly or shipped fixes on September 27 (versions 14.1-73.37 and 13.1-64.23). SecurityWeek reports the known victims so far skew toward government, financial services, education, and legal organizations in North America and Europe, with Mandiant describing “dozens” of confirmed compromises and researcher Kevin Beaumont citing over 100 as of late last week. Smaller businesses haven’t been called out specifically yet, but that’s cold comfort: NetScaler and similar gateway appliances show up constantly in SMB and MSP-managed environments, and a month-long gap between exploitation and public disclosure means nobody had a fair chance to patch early.

General IT Tip: Remote-Access Appliances Need the Same Patch Urgency as Servers

It’s easy for a VPN gateway or remote-access appliance to become invisible infrastructure, something set up once and left alone because “it just works.” That’s exactly the kind of device attackers look for, because it sits on the edge of the network with a direct path inward, and it’s often the last thing anyone thinks to check during routine patching. If you have any NetScaler, firewall VPN, or similar edge appliance, patching it should be treated with the same urgency as a critical Windows Server flaw, not scheduled for “whenever there’s time.”

What This Means for You

  1. If you run NetScaler ADC or Gateway, confirm you’re on 14.1-73.37, 13.1-64.23, or later, immediately if you haven’t already.
  2. Don’t assume a clean patch means a clean system. Citrix and NCSC-NL guidance both call for checking logs for signs of compromise going back at least a month before this fix shipped, not just applying the update and moving on.
  3. Take a few minutes to list every internet-facing appliance in your environment, VPN gateways, firewalls, remote access tools, and confirm each one has an actual patching owner and schedule, not an assumption that “someone” handles it.

Also Worth Knowing

Separate from this week’s big patch story, IT Brew has a good piece on “ghost assets,” the devices and accounts that are gone in practice but still sitting active in your systems: a laptop nobody turned back in, an account from an employee who left a year ago. They’re not just clutter. An abandoned account is a backdoor nobody’s watching, and a missing laptop still generating a lease or insurance payment is money quietly leaking out of the budget every month. If you’ve never done an inventory sweep comparing what you’re paying for and granting access to against what you can actually account for, it’s worth a slow afternoon.

Sources:

Keep reading