The fixes arrived on Sunday, September 27, under security bulletin CTX697096, which addresses eight vulnerabilities in total.
The two exploited flaws, tracked as CVE-2026-88771 and CVE-2026-88772, are both rated 9.5 Critical under CVSS 4.0 and both allow remote code execution.
Citrix said it had observed exploits of both vulnerabilities against unmitigated NetScaler deployments, meaning attackers were using them before any fix existed.
Two ways in, no user needed
CVE-2026-88771 stems from improper input validation and allows unauthenticated attackers to execute arbitrary commands remotely on a vulnerable device.
It affects the default configuration of NetScaler ADC and NetScaler Gateway, and requires no user interaction to trigger.
CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled.
That precondition is common: DTLS is on by default for VPN virtual servers, so most NetScaler Gateway deployments are exposed unless administrators have explicitly disabled it.
The two flaws can be exploited independently of each other.
The Dutch National Cyber Security Centre (NCSC-NL) called the situation urgent, noting that the first vulnerability gives attackers full control of the gateway and direct access to the internal corporate network behind it.
Weeks of exploitation, a tight deadline
Security researchers report the flaws were exploited for weeks before the patches landed.
Analysis from Help Net Security found that roughly two-thirds of threat actor activity targeting Citrix NetScaler over the last seven years involved advanced persistent threat (APT) groups, with ransomware affiliates accounting for the rest — and NetScaler appliances remain prime targets because they sit at the edge of enterprise networks, handling VPN access, authentication and load balancing.
CISA has added both flaws to its Known Exploited Vulnerabilities catalog with a three-day patch deadline of September 30, signaling how seriously federal authorities treat the exposure.
The same bulletin fixes six further NetScaler vulnerabilities (CVE-2026-88773 through CVE-2026-88778) that depend on specific configurations, including an HTTP request smuggling issue rated 9.3 Critical.
Citrix advises customers to upgrade every affected appliance — NetScaler ADC and Gateway 14.1 before build 14.1-73.37, and 13.1 before build 13.1-64.23, including FIPS variants — and then check for evidence of compromise and follow incident response processes if they find signs of intrusion.
Customers using Secure Private Access Hybrid deployments with NetScaler instances are also affected.
What to do now
Administrators should treat patching as urgent: the vulnerabilities need no authentication, and NetScaler's internet-facing, privileged position makes a compromised appliance a foothold into the network behind it.
Citrix says its managed cloud services and managed Adaptive Authentication services were upgraded by the company itself.
The bulletin does not identify victims or attribute the attacks, a common gap in zero-day disclosures.
With the patch deadline landing on September 30, security teams running customer-managed NetScaler deployments have little time to waste.
By Hamza Faisal
