Citrix NetScaler flaws exploited, patch urgently
Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
NCSC-NL warns of 8 NetScaler ADC/Gateway vulnerabilities, three critical, with two already exploited in the wild allowing unauthenticated RCE.
Citrix has patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway, three of which are rated critical with CVSS scores above 9. CVE-2026-88771 (CVSS 9.5) allows an unauthenticated attacker to execute arbitrary remote commands on all NetScaler ADC and Gateway deployments without requiring any specific configuration. CVE-2026-88772 (CVSS 9.5) is a memory overflow leading to RCE or denial-of-service, exploitable when DTLS is enabled — which is the default on VPN virtual servers. CVE-2026-88773 (CVSS 9.3) is an HTTP request smuggling flaw exploitable without authentication when HTTP functionality is enabled. NCSC-NL confirms that CVE-2026-88771 and CVE-2026-88772 have already been actively exploited against NetScaler systems.
The remaining five vulnerabilities (CVE-2026-88774 through CVE-2026-88778, CVSS 7.0–8.8) involve policy bypasses, additional memory overflows leading to unpredictable behavior or DoS, and predictable TCP Initial Sequence Numbers, each requiring specific configurations such as Gateway mode, Oracle load balancing, non-HTTP Layer 7 protocols, or TCP functionality enabled. Affected versions are NetScaler ADC/Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and the corresponding FIPS/NDcPP builds. Secure Private Access hybrid deployments using NetScaler instances are also affected; Citrix-managed cloud services and Citrix Managed Adaptive Authentication are handled separately by Cloud Software Group.
Given confirmed in-the-wild exploitation, NCSC-NL urges immediate patching and recommends organizations treat any pre-patch exposed system as potentially already compromised. Before applying updates, defenders should preserve relevant logs and a memory dump to retain forensic evidence, since patching prevents future exploitation but does not remove evidence of prior compromise. This mirrors the pattern of prior NetScaler zero-days actively used for initial access and should be treated as a high-priority patching event for all customer-managed NetScaler deployments.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0394.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections with the Splunk SPL and Microsoft KQL already written, the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 11,104 reports from 154 sources, 2,663 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs