Citrix has confirmed that two critical remote code execution vulnerabilities in NetScaler are being exploited in the wild and has released patches covering them. Both flaws carry a severity score of 9.5, affect customer-managed NetScaler ADC and NetScaler Gateway appliances, and can be triggered without authentication, putting Internet-facing edge devices at immediate risk.<\/p>\n
The two vulnerabilities are tracked as CVE-2026-88771 and CVE-2026-88772. Citrix’s security bulletin CTX697096 confirms both are zero-days that have been used against unmitigated deployments.<\/p>\n
CVE-2026-88771 is an improper input validation flaw that allows an unauthenticated attacker to execute arbitrary commands on the appliance. Citrix says it affects all NetScaler ADC and NetScaler Gateway deployments, including those using the default configuration, and does not require any additional feature to be enabled.<\/p>\n
CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or a denial-of-service condition. It can be exploited when DTLS is enabled on a NetScaler ADC or NetScaler Gateway. DTLS is enabled by default on VPN virtual servers, which broadens the exposed footprint for many deployments.<\/p>\n
The bulletin also fixes six other NetScaler vulnerabilities, for a total of eight flaws addressed in this update.<\/p>\n
Secure Private Access Hybrid deployments using NetScaler instances are also affected and must be upgraded to the recommended builds. Citrix notes the bulletin applies only to customer-managed NetScaler ADC and NetScaler Gateway appliances. Cloud Software Group is upgrading Citrix-managed cloud services and Citrix-managed Adaptive Authentication separately.<\/p>\n
NetScaler appliances are commonly deployed as Internet-facing edge devices that provide remote access and application delivery for internal corporate networks. Compromising one gives an attacker a foothold at the network perimeter and a potential path into internal systems without first breaching an endpoint inside the organization.<\/p>\n
The first public signals came from Citrix administrators reporting on Reddit that IT suppliers and security teams were privately contacting their organizations and advising them to shut down NetScaler appliances. Other administrators said law enforcement, CERTs, and national cybersecurity agencies had reached out about the issue.<\/p>\n
Cybersecurity firm watchTowr later stated publicly that it was responding to rumors of multiple unpatched Citrix NetScaler remote code execution vulnerabilities being exploited, after verifying the information with what it called authoritative sources.<\/p>\n
Before Citrix disclosed the flaws publicly, the Dutch National Cyber Security Center reportedly sent a pre-notification to organizations in the Netherlands warning of two critical NetScaler zero-days. Multiple people shared copies of the notification online. The notice said the agency had received information from a European partner CERT about two vulnerabilities that could independently lead to remote code execution.<\/p>\n
The notice described one flaw as allowing attackers to place shellcode directly into memory, with technical details on the second still being researched at the time. No CVE identifiers had been assigned and Citrix had not yet published an advisory. According to the notification, Citrix identified the vulnerabilities while investigating incidents in customer environments and confirmed the attacks, then submitted a notification under the European Union’s Cyber Resilience Act.<\/p>\n
The Dutch NCSC said exploitation had been observed at multiple Citrix customers worldwide, although it could not say whether the attacks were widespread, and warned that exploitation attempts could increase once Citrix released patches and additional technical details. Because NetScaler upgrades can cause downtime, the agency aimed to give organizations time to prepare, implement safeguards where possible, and install patches quickly once available. The Dutch NCSC declined to confirm the advisory to outside press, citing its role serving its national constituency.<\/p>\n
With fixes available and active exploitation confirmed, administrators should upgrade affected NetScaler ADC and NetScaler Gateway appliances to the patched versions as soon as possible. Organizations that cannot apply the updates immediately should reduce Internet exposure where operationally feasible until the appliances can be patched. Because both flaws can be triggered without authentication, leaving unpatched appliances reachable from the Internet carries direct risk of remote compromise.<\/p>\n
Review Secure Private Access Hybrid deployments that use NetScaler instances and confirm they are on the recommended builds. For environments where DTLS is in use, CVE-2026-88772 should be treated as immediately relevant since DTLS is enabled by default on VPN virtual servers.<\/p>\n
They are two critical NetScaler remote code execution vulnerabilities, both scored 9.5, that Citrix confirmed are being exploited as zero-days. CVE-2026-88771 is an unauthenticated input validation flaw, while CVE-2026-88772 is a memory overflow exploitable when DTLS is enabled, and DTLS is enabled by default on VPN virtual servers.<\/p>\n
NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, NetScaler ADC FIPS before 14.1-73.37 FIPS, and NetScaler ADC FIPS and NDcPP before 13.1-37.279. Secure Private Access Hybrid deployments using NetScaler instances are also affected.<\/p>\n
NetScaler appliances are typically deployed as Internet-facing edge devices providing remote access and application delivery. Both vulnerabilities can be exploited without authentication, giving an attacker a direct path from the perimeter into internal systems.<\/p>\n