Citrix Releases Emergency Patches for Two Actively Exploited NetScaler Zero-Days
Over the weekend, Citrix issued urgent security updates addressing two critical zero-day vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances. The vulnerabilities, identified as CVE-2026-88771 and CVE-2026-88772, are being actively exploited in the wild, according to confirmation from both Citrix and the Cybersecurity and Infrastructure Security Agency (CISA). Both flaws carry a CVSS v3.1 base score of 9.5, reflecting their critical severity and potential for widespread impact.
CVE-2026-88771: Unauthenticated Remote Code Execution Flaw
The first vulnerability, CVE-2026-88771, is a remote code execution flaw that can be exploited without authentication. Citrix confirmed that this issue affects all NetScaler ADC and Gateway deployments, including systems running in their default configuration. Because it requires no prior authentication and can lead to full system compromise, it represents a significant threat to exposed appliances.
CVE-2026-88772: Memory Overflow Leading to RCE or DoS
The second vulnerability, CVE-2026-88772, is a memory overflow issue that could allow attackers to achieve remote code execution or launch denial-of-service (DoS) attacks. This flaw specifically impacts NetScaler appliances with Datagram Transport Layer Security (DTLS) enabled, which is the default setting on VPN virtual servers. As a result, a large number of NetScaler Gateway deployments are potentially vulnerable unless DTLS has been manually disabled.
Global Exploitation Triggered Emergency Advisories and Appliance Shutdowns
Reports from NetScaler administrators on Reddit indicated that IT suppliers, Computer Emergency Response Teams (CERTs), and Managed Detection and Response (MDR) providers had advised them to shut down their appliances immediately over the weekend. Many of these warnings originated from a private alert issued by the Dutch National Cyber Security Centre (NCSC-NL), which was shared under Traffic Light Protocol (TLP):AMBER restrictions.
According to a copy of the NCSC-NL notice posted in the Reddit thread, the agency learned of the two zero-days through a European partner CERT and confirmed that exploitation had been observed at multiple Citrix customer environments worldwide. While some administrators took their NetScaler systems offline as a precaution, others reported receiving no official notification from Citrix or their vendors prior to the public advisory.
CISA Adds Vulnerabilities to KEV Catalog and Issues Federal Alert
In response to the confirmed active exploitation, CISA rapidly added both CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalog. The agency also issued an accompanying alert stating that "threat actors are actively exploiting these vulnerabilities globally."
CISA urged organizations to review Citrix’s security advisories and, where feasible, check for indicators of compromise (IoCs) before applying patches. The agency emphasized that early detection of compromise could help prevent further harm, even in environments where immediate patching is not possible.
"Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix’s advisories. If possible, users are encouraged to check for indication of compromise prior to patching."
Citrix made available IoCs to assist administrators in identifying potential compromise. The company’s security advisory covers a total of eight vulnerabilities in NetScaler ADC and Gateway, including the two zero-days, as well as additional flaws related to HTTP request smuggling, denial of service, and security bypass conditions.
Context: Rising Trend of Citrix NetScaler Exploits in KEV Catalog
The addition of CVE-2026-88771 and CVE-2026-88772 brings the total number of Citrix NetScaler vulnerabilities listed in CISA’s KEV catalog to over a dozen. Recent additions include CVE-2026-19490 and CVE-2026-8452, underscoring a persistent trend of threat actors targeting NetScaler appliances for initial access and post-exploitation activities.
These vulnerabilities are frequently exploited in conjunction with other recent threats, such as the Microsoft SharePoint flaw (CVE-2026-65660), zero-click data exfiltration issues in Salesforce Agentforce (dubbed ‘SalesBleed’), and active targeting of Roundcube webmail servers—highlighting a broad campaign against critical infrastructure and enterprise applications.
Source: SecurityWeek