Citrix NetScaler zero-days under active attack as agencies urge urgent patching

Citrix NetScaler customers have another urgent patch job on their hands.

Citrix has confirmed active exploitation of two critical vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, according to a CERT-EU advisory released on 27 September 2026 and reporting by iTnews published on 28 September 2026.

The bugs sit among eight vulnerabilities addressed in a Citrix security bulletin on 27 September, CERT-EU said. The two most serious flaws are unauthenticated remote code execution vulnerabilities, the kind security teams do not want exposed to the internet.

The first, CVE-2026-88771, has a CVSS score of 9.5. CERT-EU described it as an unauthenticated remote code execution flaw caused by improper input validation. It said there is no precondition for exploitation, meaning it affects all Citrix NetScaler ADC and NetScaler Gateway deployments covered by the bulletin.

The second, CVE-2026-88772, also scores 9.5. CERT-EU said it is a memory overflow vulnerability that can lead to remote code execution or denial of service. It affects deployments where datagram transport layer security, or DTLS, is enabled. iTnews reported DTLS is enabled on Citrix NetScaler Gateways by default.

CERT-EU said Citrix had confirmed both critical vulnerabilities are being exploited in the wild. iTnews also reported that Citrix confirmed exploitation after alerts appeared over the weekend warning that NetScaler ADC and Gateway devices were under active attack.

The affected products are Citrix NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23, and 14.1 before 14.1-73.37. Also affected are NetScaler ADC FIPS 14.1 before 14.1-73.37 FIPS, and NetScaler ADC FIPS and NDcPP 13.1 before 13.1-37.279, according to CERT-EU.

The advisory applies to customer-managed deployments only. CERT-EU said Secure Private Access Hybrid deployments using NetScaler instances are also affected and must be upgraded.

The remaining six vulnerabilities range from CVSS 7.0 to 9.3. They include HTTP request smuggling, policy bypass, several memory overflow issues, and a TCP initial sequence number prediction vulnerability, according to CERT-EU.

The response from cyber agencies is blunt: patch now, then look for signs of trouble.

CERT-EU recommended updating all affected customer-managed appliances to fixed versions immediately. It also strongly advised compromise assessments for any internet-facing appliance running an affected build.

In guidance reported by iTnews as released on Monday morning, the Australian Signals Directorate recommended that organisations running vulnerable Citrix products review the vendor’s vulnerability details and install the security update. ASD also advised organisations to review device logs for suspicious activity consistent with the kinds of attacks enabled by each CVE, where exploitation preconditions have been met.

iTnews reported that the United States Cybersecurity and Infrastructure Security Agency has added the flaws to its Known Exploited Vulnerabilities catalogue for US government entities. The extent of exploitation was not known at the time of that report.