Citrix patches two critical NetScaler zero days after Dutch hospitals shut systems down

Citrix disclosed eight NetScaler ADC and Gateway vulnerabilities on September 27. Two of them, CVE-2026-88771 and CVE-2026-88772, carry a CVSS score of 9.5 each, and Citrix said it had already observed exploitation against unmitigated deployments before the advisory went out.

CVE-2026-88771 is an unauthenticated command injection reached through the /nf/auth/doAuthentication.do endpoint. It abuses ns_monuploadd_err.pl, a Perl script that processes crash logs, letting an attacker inject shell commands with no login required. CVE-2026-88772 is a memory overflow in the Packet Processing Engine's handling of DTLS handshakes, triggered by spoofing the fragment_length field small while the real payload runs larger. It needs DTLS enabled, the default on NetScaler Gateway VPN servers. Researcher Sina Kheirkhah of watchTowr published proof-of-concept research on both flaws in the days before Citrix's advisory.

CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same day, setting a September 30 patch deadline for federal agencies. Fixed builds are NetScaler ADC and Gateway 14.1-73.37 and later, and 13.1-64.23 and later, with matching 14.1-FIPS and 13.1-FIPS or NDcPP builds. More than 50,000 internet-facing instances were still counted as exposed on the day the advisory shipped.

Three Dutch hospitals felt it within hours. Amphia in Breda and Elisabeth-TweeSteden in Tilburg and Waalwijk shut down systems as a precaution. Frisius MC in Leeuwarden disabled select systems, then restored them. Patients lost online access to their records while clinicians kept theirs, a split that only works when it has been planned for in advance. Z-CERT, the Dutch healthcare cyber center, recommended the shutdowns, and the national cyber authority confirmed the flaws were resolved once the appliances were patched.

The Netherlands has been here before. A NetScaler flaw disrupted part of the country's judiciary in mid-2025, and this is the second NetScaler zero day chain in three months to put device manufacturers on notice, after CVE-2026-8452 in August.

The appliance carries no patient data and touches no device firmware, and that is exactly why it gets treated as background infrastructure until it isn't. Manufacturers running NetScaler for remote service access or VPN termination into hospital networks inherit this same clock. Citrix's own guidance says a fix does not evict an attacker who arrived first, so confirm exposure closed after checking, not after patching.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23, the builds Citrix shipped September 27 alongside its advisory on CVE-2026-88771 and CVE-2026-88772. Both flaws saw exploitation before disclosure, so treat any internet-facing appliance that ran an earlier build as potentially compromised rather than assume the patch alone closed the door. Manufacturers running NetScaler in remote-access or cloud infrastructure should confirm exposure and communicate it to customers.

Patch to the fixed builds. Move NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23, or the matching FIPS and NDcPP builds, per Citrix's September 27 advisory.
Hunt before trusting the patch. CVE-2026-88771 needs no authentication. Review crash log directories, administrator accounts, and outbound connections on any appliance that sat internet-facing on an earlier build before returning it to service.
Confirm and publish exposure status. Check whether NetScaler sits anywhere in your remote-service, VPN, or cloud control-plane path, and tell customers what you found, the way Philips did for the August NetScaler flaw.
Keep management interfaces off the internet. Restrict NetScaler management and authentication endpoints to trusted networks so a single appliance compromise cannot reach clinical or device operations segments.

For Device ManufacturersFix the class in the product

Device makers close this class at the source, not on the ward. The full engineering remediation, down to code, firmware, and hardware changes, sits in the sponsor library.

Questions & Answers

What is CVE-2026-88771 in Citrix NetScaler ADC and Gateway?

CVE-2026-88771 is an unauthenticated command injection vulnerability in NetScaler ADC and Gateway, rated CVSS 9.5. It abuses the ns_monuploadd_err.pl crash log script reachable through the /nf/auth/doAuthentication.do endpoint, and Citrix confirmed exploitation against unpatched appliances before its September 27, 2026 advisory.

Is there a patch for CVE-2026-88771 and CVE-2026-88772?

Yes. Citrix fixed both flaws in NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23, with matching FIPS and NDcPP builds, released September 27, 2026. CISA added both CVEs to its Known Exploited Vulnerabilities catalog the same day with a September 30 deadline for federal agencies.

Which hospitals were affected by the Citrix NetScaler exploitation in September 2026?

Three Dutch hospitals, Amphia in Breda, Elisabeth-TweeSteden in Tilburg and Waalwijk, and Frisius MC in Leeuwarden, shut down or disabled systems as a precaution after the NetScaler flaws were disclosed. Z-CERT recommended the shutdowns and the Dutch national cyber center confirmed the flaws were resolved once appliances were patched.

← Back to Threat Intel