Citrix NetScaler Vulnerabilities Trigger Urgent CISA Alert

Two new zero-day flaws in Citrix NetScaler appliances are already being used to break into corporate networks, and the scramble to patch them has pulled in Dutch and American cybersecurity agencies within the same 48-hour window. The disclosure adds fresh urgency to what has become a familiar story: critical Citrix NetScaler vulnerabilities are once again under active attack before most organizations have had a real chance to respond.

Citrix disclosed eight CVEs affecting NetScaler ADC and NetScaler Gateway, with the security bulletin published on a Sunday.

Two flaws, CVE-2026-88771 and CVE-2026-88772 , carry critical 9.5 CVSS scores and allow remote code execution; both are confirmed exploited in the wild.

A third critical bug, CVE-2026-88773 , rated 9.3, enables HTTP request smuggling that can bypass front-end security controls.

The US Cybersecurity and Infrastructure Security Agency added the two exploited flaws to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by Wednesday, September 30, 2026.

Citrix has released OS refreshes containing fixes for all eight vulnerabilities, but patching NetScaler appliances can require downtime that some organizations struggle to schedule.

Critical Citrix NetScaler Vulnerabilities Now Confirmed Exploited

Citrix has confirmed that the two most severe flaws in this batch, CVE-2026-88771 and CVE-2026-88772, were exploited as zero-days against unpatched NetScaler ADC and NetScaler Gateway devices before a fix was even public. The company’s security bulletin, published on a Sunday, states plainly: “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.”

The Two Critical Remote Code Execution Flaws

CVE-2026-88771 stems from improper input validation and lets a remote, unauthenticated attacker execute arbitrary commands, with no user interaction required and no need for any special configuration — it affects even devices running default configurations. The Dutch National Cyber Security Center, NCSC-NL, described the stakes bluntly: “This vulnerability gives attackers full control of the gateway, providing direct access to the internal corporate network behind it.”

CVE-2026-88772 is a memory overflow issue that can trigger remote code execution or a denial-of-service condition. It’s exploitable without user interaction whenever DTLS is enabled on the device — and DTLS is switched on by default for virtual VPN servers, meaning a large of deployments are exposed without any extra configuration mistake on the administrator’s part. Citrix says the two bugs can be exploited independently of each other.

A third critical issue, CVE-2026-88773, rated 9.3, allows HTTP request smuggling — a technique that can slip malicious traffic past security filters sitting in front of the NetScaler appliance. Rounding out the batch are three memory overflow bugs rated 8.8 that can destabilize appliances, another 8.8-rated flaw tied to TCP Initial Sequence Number prediction, and a lower-severity 7.0-rated feature policy bypass linked to improper handling of HTTP URL-based expressions.

Global Exploitation Triggers CISA and Dutch Warnings

Reports of active attacks began circulating well before Citrix’s official disclosure, with IT suppliers and national agencies quietly telling organizations to take their NetScaler boxes offline. That early warning chain is now central to understanding how widely the flaws had already been abused.

CISA issued its own alert once Citrix confirmed exploitation, stating it “has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.” The agency added both flaws to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until Wednesday, September 30, 2026, to patch and check for signs of compromise.

Warnings Before the Official Disclosure

Chatter on surfaced Friday, fueled by administrators reporting that IT suppliers and security teams were privately urging them to shut down their NetScalers immediately, without offering technical details. Separately, an allegation circulated that at least one Citrix channel partner had learned of the flaws a day ahead of the public bulletin. According to reporting from Dutch authorities, NCSC-NL had already sent a pre-notification to organizations in the Netherlands, based on information from a European partner CERT, describing vulnerabilities that could independently lead to remote code execution — one of which allowed shellcode to be placed directly into memory. At that stage no CVE numbers existed yet, and Citrix had not published an advisory. The notification reportedly said Citrix found the flaws while investigating incidents in customer environments and had filed a notification under the European Union’s Cyber Resilience Act.

Security researcher Kevin Beaumont said European government sources had been warning organizations active attacks throughout the week, with exploitation apparently unfolding for the entire month. He suggested the activity was “probably nation state aligned as well resourced, espionage rather than teens.” Satnam Narang of Tenable offered a more cautious read, noting that “based on public reporting, it has not been determined whether exploitation has reached widespread scale,” while pointing out that roughly two-thirds of threat-actor activity against Citrix NetScaler over the past seven years has involved advanced persistent threat groups, with the remaining third tied to ransomware operators and their affiliates.

Patching Citrix NetScaler Vulnerabilities: Fixes Exist, Downtime Doesn’t Go Away

Citrix has already released OS refreshes containing fixes for all eight vulnerabilities, and its bulletin explains how administrators can detect whether their NetScaler needs updating and which patches to apply. That’s the good news. The harder part is actually rolling the fix out fast enough to matter.

CISA acknowledged the friction directly, noting that “because updating Citrix NetScaler appliances can be complex and may require downtime,” it was issuing the alert specifically to help organizations “assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.”

The affected products span current customer-managed builds: NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37, version 13.1 before 13.1-64.23, and the corresponding FIPS variants, along with Secure Private Access Hybrid deployments that rely on NetScaler instances. Cloud-managed services from Cloud Software Group fall outside the customer-side patching burden and are being upgraded separately.

A Familiar Pattern for NetScaler Security

This isn’t the first time NetScaler has landed in this position, and that history is exactly why the current wave of attacks feels less like an anomaly and more like a pattern. Citrix disclosed critical vulnerabilities that were quickly weaponized in March 2026, and the same sequence played out in 2025 and again in 2023. From 2020 through 2023, the Five Eyes alliance’s cybersecurity agencies included NetScaler flaws in their annual list of most-exploited bugs every single year.

Given that track record, one might expect near-universal urgency around patching. In practice, some organizations still delay applying updates, often because finding a maintenance window that allows for appliance downtime isn’t straightforward. That’s a reasonable operational constraint on its own. It’s harder to square, though, with the reality that NetScaler is almost constantly under attack, and that security vendors have spent years building compensating controls specifically so flawed devices can be used more safely while a patch is pending. For now, the safest read is the simplest one: unpatched, Internet-facing NetScaler appliances remain one of the more reliable ways into a corporate network, and this latest round of critical Citrix NetScaler vulnerabilities is unlikely to be the last.

What are the critical vulnerabilities discovered in Citrix NetScaler products?

Eight CVEs were disclosed, including two critical remote code execution vulnerabilities (CVE-2026-88771 and CVE-2026-88772) rated 9.5 CVSS, and a third critical vulnerability , CVE-2026-88773, rated 9.3 and related to HTTP request smuggling.

Are the critical Citrix NetScaler vulnerabilities currently being exploited?

Yes. Citrix has observed that both critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are under active attack, prompting a US CISA alert on global exploitation.

Has Citrix provided fixes for these vulnerabilities?

Citrix has released operating system refreshes containing fixes for all identified vulnerabilities.

Why is patching Citrix NetScaler appliances challenging?

Because updating NetScaler appliances can be complex and may require downtime, making it difficult for organizations to find a maintenance window for patching.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.