Security teams are facing a new urgent threat after two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway were confirmed to be exploited in real-world attacks.
The vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, were disclosed by Citrix on September 27, 2026. Both flaws affect NetScaler appliances and can potentially allow attackers to execute malicious code remotely.
Citrix has confirmed that exploitation of the two vulnerabilities has been observed on unmitigated NetScaler deployments. The U.S. Cybersecurity and Infrastructure Security Agency has also added the vulnerabilities to its Known Exploited Vulnerabilities catalog following evidence of active exploitation.
Two Critical NetScaler Vulnerabilities
CVE-2026-88771 is an improper input validation vulnerability that can allow an unauthenticated attacker to execute arbitrary commands remotely.
Citrix assigns the vulnerability a CVSS v4.0 base score of 9.5, placing it in the critical severity category. The vendor states that the vulnerability does not require an additional feature to be enabled and that affected default configurations can be vulnerable.
CVE-2026-88772 is a separate memory overflow vulnerability that can lead to remote code execution or denial-of-service conditions.
This second vulnerability has a CVSS v4.0 score of 9.5. It requires DTLS to be enabled on the affected NetScaler deployment, and Citrix notes that DTLS is enabled by default on VPN virtual servers.
Why NetScaler Is an Important Target
NetScaler appliances are commonly deployed at the edge of enterprise networks, where they can provide application delivery, load balancing, remote access and VPN functionality.
Because these systems can sit directly on an organization's internet-facing infrastructure, a successful compromise can provide attackers with an important entry point into corporate environments.
The Canadian Centre for Cyber Security warned that successful exploitation of CVE-2026-88771 could result in complete compromise of the appliance, unauthorized access to applications and services, credential theft, lateral movement and further compromise of internal systems.
Attackers Exploited the Bugs Before Public Disclosure
The security situation is particularly significant because the vulnerabilities were not merely theoretical.
Security researchers and incident-response organizations reported exploitation activity against NetScaler appliances, and Citrix subsequently confirmed that exploits had been observed on unmitigated deployments.
Palo Alto Networks Unit 42 said it was aware of possible zero-day activity involving NetScaler devices and reported that exploitation had been used to deliver web shells and establish initial access and persistence.
The activity demonstrates why internet-facing infrastructure vulnerabilities can become high-priority incidents shortly after disclosure.
CISA Adds the Vulnerabilities to Its KEV Catalog
CISA's Known Exploited Vulnerabilities catalog is designed to track vulnerabilities for which there is evidence of exploitation in the wild.
The addition of the two NetScaler vulnerabilities gives security teams another important signal that these flaws should be treated as an active threat rather than a routine software update.
For U.S. federal civilian agencies, inclusion in the KEV catalog triggers remediation requirements under CISA's vulnerability-management directives.
Which NetScaler Versions Are Affected?
Citrix says affected NetScaler ADC and NetScaler Gateway releases include versions before 14.1-73.37 and 13.1-64.23, along with certain FIPS and NDcPP builds.
Citrix has released updated versions that address the vulnerabilities. The company recommends upgrading NetScaler ADC and NetScaler Gateway to 14.1-73.37 or later, or 13.1-64.23 or later, depending on the deployment branch.
Organizations using the affected FIPS and NDcPP editions should follow Citrix's specific upgrade guidance for those builds.
What Organizations Should Do
Organizations operating Citrix NetScaler ADC or NetScaler Gateway should first determine whether vulnerable appliances are present in their environment.
Security teams should prioritize internet-facing appliances because they can be directly reachable by attackers. Administrators should review Citrix's official security bulletin and upgrade affected systems to the fixed versions as soon as operationally possible.
Because exploitation has already been observed, organizations should also investigate potentially affected appliances for signs of compromise rather than assuming that applying the patch alone resolves every incident.
Security teams should review authentication activity, administrative access, unexpected configuration changes, suspicious processes, unusual outbound connections and other indicators that could suggest unauthorized access.
Why Patching Alone May Not Be Enough
When a vulnerability has already been exploited, organizations need to consider two separate questions: whether the vulnerability has been fixed and whether an attacker accessed the system before the fix was applied.
A successful attack could allow an adversary to establish persistence or obtain credentials that remain useful after the vulnerable software has been updated.
For that reason, organizations that operated exposed NetScaler appliances during the exploitation window should combine patching with incident investigation and credential-security reviews.
Citrix NetScaler Security Goes Beyond These Two Bugs
Citrix disclosed eight vulnerabilities affecting NetScaler ADC and NetScaler Gateway in its September 27 security bulletin.
While CVE-2026-88771 and CVE-2026-88772 received the highest attention because of their critical severity and active exploitation, the other vulnerabilities include HTTP request smuggling, policy bypass and additional memory-related issues.
This means administrators should review the complete Citrix security bulletin rather than addressing only the two actively exploited vulnerabilities.
The Bigger Cybersecurity Trend
The NetScaler incident highlights the continuing importance of vulnerabilities in edge infrastructure.
Security appliances, VPN gateways, application delivery controllers and remote-access platforms are attractive targets because they often operate at the boundary between the public internet and internal networks.
When a vulnerability allows unauthenticated remote code execution on such a device, attackers may be able to establish an initial foothold without first stealing an employee's password.
That makes rapid vulnerability management and continuous monitoring especially important for organizations operating internet-facing infrastructure.
What Happens Next
Security researchers are continuing to analyze the exploitation activity surrounding the two NetScaler vulnerabilities.
As additional technical details become available, defenders may gain a clearer understanding of attacker techniques, indicators of compromise and the extent of exploitation.
For organizations using NetScaler ADC or NetScaler Gateway, the immediate priority is to identify affected systems, install Citrix's fixed releases and investigate potentially compromised appliances.
The incident also reinforces a broader security lesson: when a vulnerability affects an internet-facing security appliance and exploitation is already occurring, organizations should treat remediation as an incident-response priority rather than an ordinary maintenance task.
