CVE Tools
Track your stack

Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

SecurityWeekBy Eduard Kovacs

Reported exploitedCitrix NetScaler ADCCitrix NetScaler Gateway

Our summary

Citrix was forced into an emergency weekend patch after NetScaler administrators began shutting down appliances on their own, following unexplained warnings from IT suppliers and incident-response teams. The company's advisory lists eight flaws in NetScaler ADC and NetScaler Gateway, but confirmed that two of them, CVE-2026-88771 and CVE-2026-88772, are already being exploited, both carrying a CVSS score of 9.5. CVE-2026-88771 is an unauthenticated remote code execution bug hitting every default deployment, while CVE-2026-88772 is a memory-overflow issue exploitable for RCE or denial of service on systems with DTLS enabled, the default for VPN virtual servers. The panic traces back to a restricted Dutch NCSC-NL alert describing attacks against multiple Citrix customers worldwide, and CISA has since added both CVEs to its Known Exploited Vulnerabilities catalog, urging organizations to check for compromise indicators before applying the fixes.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. Dark ReadingKiteworks & Citrix Incidents Show Challenges of Zero-Day ResponseCVE-2026-19490, CVE-2026-88771 +2
  2. watchTowr LabsHere We Go Again (Citrix NetScaler DTLS Preauth Memory Overflow CVE-2026-88772)CVE-2026-8452, CVE-2026-88771 +2
  3. BleepingComputerCISA orders feds to patch exploited Citrix flaws by WednesdayCVE-2026-19490, CVE-2026-88771 +2
  4. watchTowr LabsOh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)CVE-2026-88771, CVE-2026-88772 +1
  5. Help Net SecurityCitrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)CVE-2026-88771, CVE-2026-88772 +1
  6. The Hacker NewsCISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws GloballyCVE-2026-88771, CVE-2026-88772 +1
  7. NCSC UKExploitation of vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler GatewayCVE-2026-88771, CVE-2026-88772 +1
  8. Palo Alto Unit 42Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the WildCVE-2026-88771, CVE-2026-88772 +1
  9. BleepingComputerCitrix warns admins to patch new NetScaler RCE flaw immediatelyCVE-2026-88771, CVE-2026-88772
  10. SecurityWeekCitrix Urges Immediate Patching of Critical NetScaler VulnerabilityCVE-2026-88771, CVE-2026-88772

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure