Back Kyberturvallisuuskeskus.Fi

Critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products, several ...

Kyberturvallisuuskeskus.Fi • October 1, 2026

The National Cyber Security Centre Finland (NCSC-FI) has received reports of active exploitation of critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products in Finland. Systems affected by the vulnerabilities must be updated to patched software versions without delay. Organisations must also check their environments for possible exploitation attempts and intrusions.

Varoituksen yhteenveto

Yellow alert: The situation may require action or general caution by users or administrators

Vulnerability severity: 7.0–9.5 (CVSS 4.0, high to critical)

Affected products: Citrix NetScaler ADC and Citrix NetScaler Gateway

Vulnerability identifiers: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778

Impact: Remote code execution, authentication bypass, denial-of-service conditions and other unexpected system behaviour

Remediation: Update the products immediately to versions patched by the vendor

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited In late September 2026, two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway were actively exploited, allowing remote code execution. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on September 27, 2026, with a CVSS score of 9.5. Attackers utilized custom web shells named WHIPSHOT and SLAPSHOT to gain unauthorized access to affected systems. Organizations in sectors such as government, finance, and healthcare were particularly vulnerable. Citrix has since released patches for these vulnerabilities, but the urgency of the situation has raised concerns about the effectiveness of their response. The incidents highlight the ongoing risks associated with internet-exposed edge devices and the need for rapid incident response. As of October 4, 2026, the exploitation is confirmed to be ongoing, with significant operational and compliance risks reported. 77 sources 80

Extracted Entities

Critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway products, several ...

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CVEs (8)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (2)