Citrix Confirms Active Exploitation of Two NetScaler Zero-Day Vulnerabilities
Citrix has officially confirmed that two critical remote code execution vulnerabilities in its NetScaler ADC and NetScaler Gateway appliances are being actively exploited in attacks. The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, were disclosed in security bulletin CTX697096, which also includes patches for affected versions. The vulnerabilities had been the subject of private warnings from IT suppliers, security teams, and national cybersecurity agencies over the weekend prior to Citrix’s public confirmation.
Details of CVE-2026-88771: Unauthenticated Remote Code Execution via Input Validation Flaw
CVE-2026-88771 is a remote code execution vulnerability caused by improper input validation. It allows an unauthenticated attacker to execute arbitrary commands on affected NetScaler devices. Citrix rates this flaw with a severity score of 9.5 and confirms it affects all NetScaler ADC and NetScaler Gateway deployments, including those using default configurations. No additional features need to be enabled for exploitation to be possible.
Details of CVE-2026-88772: Memory Overflow Leading to RCE or DoS When DTLS Is Enabled
CVE-2026-88772 is a memory overflow vulnerability that can lead to either remote code execution or a denial-of-service condition. It also carries a severity score of 9.5. Exploitation requires DTLS to be enabled on the NetScaler ADC or Gateway appliance. Citrix notes that DTLS is enabled by default on VPN virtual servers, making this condition common in deployed environments.
Affected Versions and Recommended Updates
Citrix has identified the following versions as affected by both vulnerabilities:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
- NetScaler ADC FIPS before 14.1-73.37
- NetScaler ADC FIPS and NDcPP before 13.1-37.279
- Secure Private Access Hybrid deployments using NetScaler instances
Citrix advises that customers managing their own NetScaler ADC and Gateway appliances must upgrade to the patched builds immediately. The bulletin does not apply to Citrix-managed cloud services, which Cloud Software Group is upgrading separately.
Security Bulletin Fixes Eight Total Vulnerabilities
The security update released by Citrix addresses not only the two zero-days but also six additional NetScaler vulnerabilities, bringing the total number of flaws fixed in this update to eight. This broader patching effort aims to harden appliances against multiple known attack vectors.
NCSC-NL Issued Pre-Disclosure Warning to Dutch Organizations
Before Citrix’s public disclosure, the Dutch National Cyber Security Center (NCSC-NL) sent a pre-notification to organizations in the Netherlands warning about two critical NetScaler zero-days. The notification, which was shared online by multiple recipients, stated that the agency had received information from a European partner CERT. It described one vulnerability as allowing attackers to place shellcode directly into memory, while technical details for the second were still under investigation at the time.
The NCSC-NL noted that Citrix had discovered the vulnerabilities during incident investigations in customer environments and had confirmed active exploitation. It also stated that Citrix submitted a notification under the European Union’s Cyber Resilience Act following the discovery. While the NCSC-NL confirmed exploitation had been seen at multiple Citrix customers worldwide, it could not determine whether the attacks were widespread.
Guidance for Organizations Unable to Patch Immediately
The NCSC-NL advised that the early warning was intended to give organizations time to prepare for patching, implement temporary safeguards where feasible, and apply updates as soon as they became available. Because upgrading NetScaler appliances can cause service downtime, the agency emphasized the importance of advance planning.
Organizations that cannot apply the patches immediately should reduce Internet exposure to their NetScaler devices where operationally possible until patching can be completed. Citrix and cybersecurity authorities continue to urge prompt remediation given the active exploitation of these critical flaws in the wild.
Source: BleepingComputer