Citrix has confirmed that attackers are exploiting two NetScaler zero-days that allow remote code execution. The company has released security updates for affected NetScaler ADC and NetScaler Gateway appliances and urges administrators to upgrade promptly.
The vulnerabilities, CVE-2026-88771 and CVE-2026-88772, each carry a severity score of 9.5. Their disclosure follows private warnings from security teams, IT providers and cybersecurity agencies over the weekend.
Two Critical Flaws Allow Remote Code Execution
CVE-2026-88771 stems from improper input validation. It allows an attacker to execute arbitrary commands without authentication.
According to Citrix, the vulnerability affects all NetScaler ADC and NetScaler Gateway deployments running vulnerable versions, including default configurations. It requires no additional features.
Meanwhile, CVE-2026-88772 involves a memory overflow that can cause remote code execution or denial of service.
Attackers can exploit this second flaw when DTLS is enabled. Citrix notes that VPN virtual servers enable DTLS by default.
The company confirmed that attackers exploited both vulnerabilities before patches became available.
NetScaler Zero-Days Put Network Edge Devices at Risk
Organizations commonly use NetScaler appliances for remote access and application delivery. These devices often face the internet and provide connections to internal corporate resources.
Consequently, a compromised appliance can give attackers an initial foothold at the network perimeter. It may also provide a route towards internal systems.
Before Citrix published its advisory, administrators reported receiving urgent calls from suppliers and security teams. Some said those contacts advised them to shut down their NetScaler appliances immediately.
Security company watchTowr subsequently issued a public warning after checking reports of multiple unpatched vulnerabilities with sources it considered authoritative.
Citrix Lists Affected Versions and Security Updates
Citrix’s security bulletin identifies the following affected releases:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37.
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23.
- NetScaler ADC FIPS before 14.1-73.37 FIPS.
- NetScaler ADC FIPS and NDcPP before 13.1-37.279.
Secure Private Access Hybrid deployments that use NetScaler instances also require upgrades to the recommended builds.
The bulletin applies to customer-managed appliances. Meanwhile, Cloud Software Group is upgrading Citrix-managed cloud services and Adaptive Authentication.
In addition to the two actively exploited flaws, the updates address six other vulnerabilities.
Dutch Agency Reportedly Issued Advance Warning
Copies of a notification circulating online suggest that the Dutch National Cyber Security Center warned organizations before Citrix’s public disclosure.
According to that notice, a European partner CERT supplied information about two critical vulnerabilities. Each could independently allow remote code execution.
The notification also said Citrix discovered the flaws while investigating incidents affecting customers. It described exploitation at multiple customer organizations worldwide, although the extent of the attacks remained unclear.
However, the Dutch agency declined to authenticate the circulating notice when BleepingComputer contacted it. It said it could not provide further information outside its constituency.
Administrators Urged to Upgrade Promptly
With patches now available, administrators should upgrade affected appliances as soon as possible.
Organizations that cannot immediately install the updates should reduce internet exposure where operationally possible until they can patch.
Advance warnings highlighted potential upgrade downtime. Therefore, affected teams should prepare for service interruptions while prioritizing the security updates.
0 responses to “Citrix Confirms Two NetScaler Zero-Days Under Active Attack”