Cybersecurity
Citrix patches two NetScaler zero-days
Citrix said two NetScaler flaws had been exploited before it published fixes, and it listed six further vulnerabilities alongside them while urging customers to update affected appliances quickly.
- Citrix said on 27 September that two vulnerabilities in NetScaler ADC and NetScaler Gateway had been exploited and that it had released fixes for them and six other flaws.
- The exploited flaws were CVE-2026-88771, which Citrix said could let an unauthenticated attacker run commands, and CVE-2026-88772, which Citrix said could lead to remote code execution or denial of service when DTLS was enabled.
- Citrix did not say how widely the flaws had been used, who used them, or when exploitation began.
- watchTowr had said a day earlier that two unpatched NetScaler RCE flaws were being exploited, and some administrators said they had shut appliances down.
- Citrix urged affected customers to install fixed releases, including 14.1-73.37, 13.1-64.23, 14.1-FIPS 14.1-73.37 FIPS, and 13.1-FIPS and 13.1-NDcPP 13.1-37.279.
Citrix said on 27 September that two vulnerabilities in NetScaler ADC and NetScaler Gateway had already been exploited and that it had issued fixes for them. It also published repairs for six additional flaws.
The two exploited issues were CVE-2026-88771 and CVE-2026-88772. Citrix said the first could let an unauthorised attacker run commands, while the second could lead to remote code execution or denial of service on appliances with DTLS enabled.
Citrix did not say how widely the flaws had been used, who had used them, or when the activity started. It also said its bulletin was the first public notice of the problems, so the attacks happened before a fix was available.
watchTowr had posted a day earlier that two unpatched NetScaler RCE flaws were being exploited. Some administrators said in a Reddit thread that they had shut their appliances down after advice from their IT suppliers, although the source of that warning was not established.
Citrix urged customers to install the fixed releases as soon as possible. It said the bulletin covered customer-managed appliances, while its own cloud services and Citrix-managed Adaptive Authentication were upgraded separately.
Named in this story
Companies
- Citrix
- confirmed the exploitation and released fixes
- watchTowr
- said the unpatched flaws had been exploited before Citrix’s bulletin
- Cloud Software Group
- owns Citrix and NetScaler and was asked for comment
Governments and agencies
- Netherlands' National Cyber Security Centre
- previously said updating alone did not remove risk after a NetScaler zero-day
Products and systems
- NetScaler ADC
- one of the affected appliance products
- NetScaler Gateway
- the other affected appliance product
How the source tells it
The piece was mostly straight reporting, but it used an urgent security-bulletin register by stressing active exploitation and immediate patching.
- urgency it foregrounded active exploitation and urged customers to install fixes as soon as possible
- threat framing it paired zero-day remote code execution with default-enabled exposure and advice to take appliances offline