Citrix NetScaler Zero-Days Under Active Global Exploitation Demand Immediate Patching

Citrix has recently released patches for eight vulnerabilities affecting its NetScaler ADC (Application Delivery Controller) and NetScaler Gateway products, with two of these (CVE-2026-88771 and CVE-2026-88772) being actively exploited as zero-days. These critical flaws, both with a CVSS score of 9.5, allow unauthenticated attackers to execute arbitrary commands on vulnerable devices. CVE-2026-88771 is an improper input validation vulnerability, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service, particularly when DTLS is enabled (which is the default for VPN virtual servers). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply fixes by September 30, 2026. This development is highly significant for any organization utilizing Citrix NetScaler ADC or Gateway, as these appliances often serve as critical entry points for remote access and application delivery. The exploitation of these vulnerabilities can grant attackers full control of the gateway, providing direct access to the internal corporate network. The fact that these zero-days were exploited for weeks before public disclosure, with warnings circulating among European government sources, highlights a concerning trend where sophisticated threat actors are quick to weaponize newly discovered vulnerabilities. This makes timely patching not just a best practice, but an immediate imperative to prevent widespread compromise. Organizations that rely on these products for VPN and secure access are particularly at risk. The broader trend in network security continues to emphasize the shrinking perimeter and the increasing importance of securing edge devices. As organizations embrace hybrid and multi-cloud environments, traditional perimeter-based security models are becoming less effective. Network appliances like Citrix NetScaler, while essential for connectivity and traffic management, also represent high-value targets for attackers seeking to gain a foothold in an enterprise network. This incident echoes previous critical vulnerabilities in similar network infrastructure components, such as the GitLab path traversal flaw (CVE-2026-85706) that was actively exploited shortly after its disclosure in September, allowing unauthenticated access to sensitive files. The consistent pattern of rapid exploitation of such vulnerabilities underscores the need for organizations to have robust vulnerability management programs and incident response capabilities. In practice, practitioners should immediately identify all Citrix NetScaler ADC and Gateway deployments within their environment and apply the recommended patches. This includes versions 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, as well as corresponding FIPS and NDcPP builds. Furthermore, organizations should conduct thorough forensic investigations to determine if their systems have already been compromised, looking for indicators of compromise (IOCs) provided by Citrix. Given the potential for credential harvesting and lateral movement, a comprehensive review of access logs and user activity originating from these devices is crucial. It's also a stark reminder to minimize the attack surface by ensuring that only necessary services are exposed and that all internet-facing devices are regularly audited and updated.