Citrix Sunday confirmed that attackers are exploiting two previously unknown vulnerabilities in its NetScaler ADC and NetScaler Gateway appliances and released fixes for those and six other flaws, BleepingComputer reported. The disclosure came after IT suppliers, CERTs and national cybersecurity agencies had spent the weekend privately advising customers to shut the devices down.

What Happened

Security bulletin CTX697096, published Sept. 27, covers eight vulnerabilities. The two under active attack are CVE-2026-88771 and CVE-2026-88772, both rated 9.5 under CVSS version 4. Citrix said it has observed exploits of both on deployments that had not been mitigated.

CVE-2026-88771 is an improper input validation flaw that lets a remote, unauthenticated attacker execute arbitrary commands, and it affects appliances in their default configuration. CVE-2026-88772 is a memory overflow that can lead to remote code execution or denial of service when DTLS is enabled, which is the default setting on Gateway VPN virtual servers.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

The other six issues include CVE-2026-88773, an HTTP request smuggling bug rated 9.3, a policy bypass rated 7.0, three memory overflow bugs that can cause denial of service, and a TCP initial sequence number prediction flaw. The last four are each rated 8.8.

Fixed releases are 14.1-73.37 and 13.1-64.23 and later, with separate fixed builds for the FIPS and NDcPP editions. According to Security Affairs, builds 14.1-73.32 and 13.1-63.21, which administrators installed to address NetScaler flaws disclosed in August, are still vulnerable.

Why It Matters

NetScaler appliances sit on the internet edge and broker remote access into corporate networks, so an unauthenticated command execution bug gives attackers a direct foothold inside an organization. Palo Alto Networks’ Unit 42 said it counted more than 50,000 internet-exposed NetScaler instances potentially vulnerable to both zero-days as of Sunday.

The exploitation also predates the fix by days or longer. Security firm watchTowr warned on Sept. 26 that unpatched NetScaler remote code execution bugs were being exploited, and its chief executive, Benjamin Harris, said evidence pointed to attacks beginning at least a week earlier. GreyNoise, which monitors internet scanning traffic, reported that the earliest attempt it saw, an unsuccessful one, came on Sept. 24.

CISA added both CVEs to its Known Exploited Vulnerabilities catalog Sunday and ordered federal civilian agencies to remediate by Sept. 30.

A Disclosure That Ran Behind the Warnings

Before Citrix went public, many administrators heard about the problem through unofficial channels. BleepingComputer quoted one administrator whose IT supplier’s security team called and told them to take their NetScalers offline right away. The Netherlands’ NCSC-NL separately notified Dutch organizations of two critical zero-days before the bulletin appeared.

That sequence left defenders deciding whether to disconnect remote access gateways based on private tips, without CVE numbers, affected-version lists or patches. Citrix has not said who is behind the attacks or how many customers were compromised.

NetScaler has a long record as a target. The 2023 CitrixBleed session-hijacking bug and a 2025 successor dubbed CitrixBleed 2 were both widely exploited, and Citrix products have appeared on CISA’s exploited-vulnerabilities list many times.

What to Watch

Citrix is urging customers to upgrade immediately; organizations that cannot do so quickly face a choice between leaving vulnerable appliances online and cutting remote access. Because exploitation began before the patch, applying the update does not answer whether a device was already breached, so incident responders will be looking for signs of persistence on appliances that were exposed during September. Further guidance from national cybersecurity agencies, and any attribution of the attacks, are the next developments to follow.