Citrix patches two exploited NetScaler flaws

Citrix published security bulletin CTX697096 and said it had found active exploitation of two NetScaler remote code execution flaws. It released patched builds for affected NetScaler ADC and NetScaler Gateway appliances.

Reports had circulated over the weekend from researchers, IT providers and national cyber agencies, and some Citrix administrators said they had been told privately to shut appliances down. watchTowr later said it was responding to rumours after checking the information with authoritative sources.

Citrix said CVE-2026-88771 stemmed from improper input validation and could let an unauthenticated attacker run commands. It said CVE-2026-88772 involved a memory overflow that could lead to remote code execution or denial of service when DTLS was enabled, and that DTLS was on by default on VPN virtual servers.

Citrix listed affected versions of NetScaler ADC and NetScaler Gateway, along with some FIPS and NDcPP builds, and said Secure Private Access Hybrid deployments using NetScaler instances were also affected. The bulletin also fixed six other NetScaler issues, bringing the total to eight.

Before the public disclosure, the Dutch National Cyber Security Center reportedly warned organisations in the Netherlands about two critical zero-days after receiving information from a European partner CERT. The notice said Citrix had found the issues while investigating customer incidents, and the report said organisations should patch quickly and reduce internet exposure where they could.