The National Cyber Security Centre (NCSC) is urging for a prompt patch to vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, two of which are being actively exploited
Citrix has published a security bulletin detailing eight vulnerabilities affecting the two products, with CVE-2026-88771 and CVE-2026-88772 confirmed as being actively exploited. The NCSC is working to understand the impact on UK organisations in all sectors.
CVE-2026-88771 involves improper input validation allowing an unauthenticated remote attacker to execute arbitrary commands, while CVE-2026-88772 involves an improper restriction of operations within the bounds of a memory buffer, leading to remote code execution or denial of service. The remaining six include vulnerabilities enabling HTTP request smuggling, a feature policy bypass, memory overflows causing denial of service, and a predictable exact value flaw that may allow an attacker to influence integrity or availability.
Organisations using on-premises Citrix NetScaler ADC or NetScaler Gateway are affected. The affected supported versions include 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, along with FIPS and NDcPP variants.
The NCSC said it strongly urges network defenders to read the Citrix security bulletin and accompanying blog in full to determine if they have an affected system, and to isolate affected systems where possible and replace them with fully up-to-date versions. It acknowledged this may cause service outage, suggesting temporary measures such as disabling access with upstream firewalls or restricting access to the organisation's own IP range.
Defenders are advised to investigate for evidence of compromise using published indicators of compromise, and to report any suspected compromise, UK organisations can also report it to the vendor to assist their investigation. The latest updates should then be installed before affected systems are reintroduced, with ongoing monitoring and continuous threat hunting recommended.
The NCSC also pointed to its own resources, including guidance on vulnerability management and preventing lateral movement, its free Early Warning service for UK organisations to receive notifications of potential threats on their network, and its Vulnerability Disclosure Toolkit for implementing a vulnerability disclosure process.
Defenders cannot use AI agents in the same way as attackers because cyber defence is constrained less by technology than by organisational politics, the organisation recently reported.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
