Citrix Acknowledges Active Exploitation of NetScaler Zero-Days Following Weekend of Unofficial Alerts
Citrix confirmed on Sunday that attackers were actively exploiting two newly discovered zero-day vulnerabilities in its NetScaler ADC and NetScaler Gateway products, ending a period of public silence that left defenders relying on unofficial warnings for nearly two days. The vulnerabilities, identified as CVE-2026-88771 and CVE-2026-88772, were disclosed in a security advisory accompanied by patches for these flaws and six additional defects. By the time the advisory was released, criticism had intensified among customers and security professionals who argued the delay in communication put networks at unnecessary risk.
Security Experts Condemn Communication Gap During Active Exploitation
Ben Harris, founder and CEO of watchTowr, criticized Citrix for failing to acknowledge the threat despite widespread unofficial alerts from CERTs, advisory firms, insurance providers, and researchers. "The information vacuum was most striking. Customers were receiving warnings through unofficial channels while Citrix remained publicly silent," Harris told CyberScoop. He emphasized that vendors can and should provide defensive guidance during active exploitation without revealing technical details that could aid attackers, noting that "hours matter" when attacks are underway.
Joe Toomey, vice president of underwriting at Coalition, echoed these sentiments in a LinkedIn post, calling Citrix "unconscionably irresponsible" for staying silent for more than 36 hours after exploitation rumors began circulating. He acknowledged that vendors may withhold specific details before a patch is ready but argued that once a vulnerability is confirmed to be exploited in the wild, the obligation to warn customers becomes immediate.
Technical Details Reveal High Severity and Broad Exposure
Both CVE-2026-88771 and CVE-2026-88772 carry a CVSS score of 9.5, reflecting their critical nature and potential for remote code execution. Researchers are especially concerned about CVE-2026-88771, a command-injection vulnerability that affects all NetScaler appliances in their default configuration. This widespread default exposure significantly increases the attack surface and likelihood of successful exploitation. A public proof-of-concept exploit for this flaw is already available, heightening urgency for defenders.
Palo Alto Networks reported identifying over 50,000 publicly exposed NetScaler devices potentially vulnerable to both zero-days as of Sunday. The earliest observed exploitation attempt was detected by GreyNoise on September 24, targeting a NetScaler Gateway under its control for malicious activity scanning—though researchers believe exploitation likely began earlier.
CISA Issues Alert, Adds Flaws to KEV Catalog Amid Attribution Uncertainty
Following Citrix’s public confirmation, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert and added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog. This marks the fifth time this year and the 26th time since late 2021 that Citrix vulnerabilities have appeared on the list. CISA’s action underscores the severity of the threat and provides federal guidance for mitigation.
Attribution for the attacks remains under investigation, though NetScaler has long been a favored target of financially motivated cybercriminals and state-sponsored espionage groups. Industry leaders including Charles Carmakal of Mandiant and Wendi Whitmore of Palo Alto Networks issued direct warnings on LinkedIn, reinforcing the urgency of patching and monitoring.
History of Delayed Disclosures Raises Trust Concerns
This incident echoes past controversies involving Citrix, including the CitrixBleed and CitrixBleed 2 episodes, where delayed vulnerability disclosures coincided with active exploitation. Harris noted that while Citrix eventually released patches and advisories, the pattern of delayed communication undermines customer trust. "Customers shouldn’t have to rely on unofficial warnings, security researchers, and third parties to learn that critical infrastructure may already be compromised," he said, questioning whether the company has meaningfully improved its response practices since prior crises.
Citrix has not disclosed how many customers may have been compromised, stating only that it is providing generic indicators of compromise through user consoles and referring to prior guidance for those suspecting breach. As researchers continue to assess the fallout, the incident serves as a stark reminder that timely transparency is as critical as patch availability in defending against active threats.
Source: CyberScoop