Citrix has confirmed that two previously unknown vulnerabilities in its NetScaler ADC and NetScaler Gateway appliances were being actively exploited by attackers before a fix existed, and it is urging every customer running the affected software to patch immediately or take the devices offline.
The more serious of the two flaws, tracked as CVE-2026-88771, carries a CVSS score of 9.5 and lets an attacker who has not logged in at all run arbitrary commands on the device. According to Citrix, it affects every NetScaler ADC and Gateway deployment regardless of how the appliance is configured, meaning there is no optional feature that needs to be switched on for a system to be at risk. The second flaw, CVE-2026-88772, also scored 9.5 and stems from a memory overflow that can lead to remote code execution or knock the appliance offline. It only applies when DTLS is enabled, which happens to be the default setting on VPN virtual servers, a very common NetScaler use case.
Citrix said in its advisory that it found both issues while investigating security incidents, and that it had already observed exploitation of both vulnerabilities on unmitigated systems. The Dutch National Cyber Security Centre (NCSC-NL) went further, reporting that it had identified exploitation at multiple Citrix customers around the world, suggesting the attacks were not limited to a single company or region. Security firm watchTowr had separately flagged unusual NetScaler behavior on September 26, a day before Citrix published its fix on September 27.
The same security bulletin, numbered CTX697096, actually patches eight vulnerabilities in total. Alongside the two zero-days, Citrix fixed an HTTP request smuggling bug (CVE-2026-88773, CVSS 9.3), a policy bypass issue (CVE-2026-88774), three separate memory overflow flaws affecting different protocol paths including Oracle load balancing configurations (CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, all rated 8.8), and a flaw in how the appliance predicts TCP initial sequence numbers (CVE-2026-88778, also 8.8).
Fixed versions are NetScaler ADC and Gateway 14.1-73.37 and later, and 13.1-64.23 and later, with matching updates for the FIPS and NDcPP builds. Citrix is telling administrators who cannot patch right away to at least cut down the appliance’s exposure to the open internet. For organizations that suspect they may already have been compromised, Citrix published post-compromise guidance that includes preserving forensic evidence before rebooting, isolating the affected appliance from the network, rotating any credentials that passed through it, and disabling remote access to its management interface. The advisory also points to scanning scripts that NCSC-NL originally released in 2025 for checking NetScaler devices for signs of tampering.
NetScaler appliances sit at the edge of corporate networks by design, handling VPN connections and load balancing for internet-facing applications, which is exactly why unauthenticated remote code execution bugs in them are treated as emergencies rather than routine patches. Given that Citrix itself found these flaws through incident response rather than through routine testing, and that both NCSC-NL and watchTowr corroborated active exploitation, security teams running NetScaler are being advised to treat this as an incident to investigate, not just a patch to schedule.
Source: BleepingComputer, additional reporting from The Hacker News.
[…] Citrix NetScaler Hit by Two Actively Exploited Zero-Day Flaws, Patches Now Available […]