Skip to content
Indene
en

Alertas de segurança

Citrix and Cisco Confirm Exploitation of Vulnerabilities in NetScaler and SD-WAN Manager

Three critical vulnerabilities in NetScaler, used as a VPN, and Catalyst SD-WAN Manager, which controls branch networks, are being actively exploited. For NetScaler, attacks began before the public advisory: updating is necessary but does not guarantee that no unauthorized access occurred.

By Leonardo Araujo IevaAnalista de segurança ofensiva

4 min read

Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título Patched is not the same as clean.
Rede de pontos ligados por traços finos sobre fundo escuro esverdeado, com um único nó em âmbar aceso e o título Patched is not the same as clean.

Citrix and Cisco confirmed, between September 27 and 30, 2026, the exploitation of critical vulnerabilities in two products that serve as corporate network entry points: NetScaler ADC and Gateway, used for VPN and remote access, and Catalyst SD-WAN Manager, which controls branch office networks. CISA has included all three vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog. In the case of Citrix, exploitation began weeks before the public advisory, making updates necessary but not sufficient.

What is known

CVE Product Severity KEV since US federal deadline Fixed version
CVE-2026-88771 Citrix NetScaler ADC and Gateway CVSS v4.0 9.5 September 27 September 30 14.1-73.37 and 13.1-64.23
CVE-2026-88772 Citrix NetScaler ADC and Gateway with DTLS active CVSS v4.0 9.5 September 27 September 30 14.1-73.37 and 13.1-64.23
CVE-2026-76504 Cisco Catalyst SD-WAN Manager CVSS v3.1 9.8 September 30 October 3 according to branch (advisory table)

Citrix NetScaler. CVE-2026-88771 allows unauthenticated command execution and affects the default configuration, without requiring any additional features. CVE-2026-88772 is a buffer overflow that leads to code execution or device shutdown when DTLS is active, which is the default for the VPN virtual server. Affected versions include 14.1 prior to 14.1-73.37 and 13.1 prior to 13.1-64.23, as well as FIPS and NDcPP editions. Citrix published the bulletin on September 27, after discovering the flaws while investigating customer incidents.

Exploitation predates the bulletin. Unit 42, from Palo Alto Networks, recorded reconnaissance attempts starting August 21 and two exploitation chains in September, before the disclosure. The company counted 50,277 exposed instances that could be vulnerable on September 27. According to Mandiant, cited by Cybersecurity Dive, dozens of organizations in North America and Europe were affected, across sectors including government and financial services, and in some cases, attackers installed web shells and advanced into the internal network.

Cisco Catalyst SD-WAN Manager. A flaw in URL encoding handling during API authentication allows remote access with administrator privileges, without credentials. It affects on-premises installations and the Cisco-managed cloud service, across branches from 20.9 to 26.2. Cisco learned of the exploitation in September, published the advisory on September 30, and states that there is no alternative mitigation: the only fix is an update. The first fixed versions are 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1; versions prior to 20.9 need to migrate to a fixed branch.

Why this matters for financial institutions

This is the second wave of exploited vulnerabilities in edge devices in two weeks. The pattern repeats: the device that authenticates remote access or controls the network becomes the entry point, and whoever controls it does not need a password for the rest of the network. NetScaler Gateway is often the VPN for employees and vendors. SD-WAN Manager configures the network for all branches at once. This is a scenario of exploiting an internet-exposed asset, with a direct path to corporate account compromise.

The difference this time lies in the timing. Those who updated NetScaler on the day of the bulletin may have been affected earlier. CISA requires US agencies to perform forensic triage, not just remediation, and Citrix has published its own roadmap for suspected compromise (CTX694799). Updating closes the door; it does not indicate whether someone has already entered.

Both products are also frequently operated by third parties: network providers, integrators, managed services. The question about version and signs of access applies to the vendor as much as to the internal team.

What to do now

  1. Verify if your institution, or a vendor operating the network on its behalf, uses NetScaler ADC, NetScaler Gateway, or Catalyst SD-WAN Manager, and if the interface is accessible via the internet.
  2. Apply the corrected version indicated in Citrix bulletin CTX697096 and Cisco's advisory. For SD-WAN Manager, there is no alternative mitigation: until updated, the management interface should not be exposed.
  3. Look for signs of unauthorized access since August 21 on NetScaler, following roadmap CTX694799, and review SD-WAN Manager API access logs as indicated in Cisco's advisory.
  4. If there are signs of compromise, isolate the equipment and preserve logs and images before reinstalling: this allows determining how far the attacker progressed.
  5. Document the remediation and verification with date and responsible party: this is the evidence auditors will request.

References

Topics

Keep reading

All news