Citrix NetScaler flaws exploited, patch urgently
NCSC-NL warns of 8 NetScaler ADC/Gateway vulnerabilities, three critical, with two already exploited in the wild allowing unauthenticated RCE.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 8 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-88771 and CVE-2026-88772 as exploited in the wild.
Citrix has patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway, three of which are rated critical with CVSS scores above 9. CVE-2026-88771 (CVSS 9.5) allows an unauthenticated attacker to execute arbitrary remote commands on all NetScaler ADC and Gateway deployments without requiring any specific configuration. CVE-2026-88772 (CVSS 9.5) is a memory overflow leading to RCE or denial-of-service, exploitable when DTLS is enabled — which is the default on VPN virtual servers. CVE-2026-88773 (CVSS 9.3) is an HTTP request smuggling flaw exploitable without authentication when HTTP functionality is enabled. NCSC-NL confirms that CVE-2026-88771 and CVE-2026-88772 have already been actively exploited against NetScaler systems.
The remaining five vulnerabilities (CVE-2026-88774 through CVE-2026-88778, CVSS 7.0–8.8) involve policy bypasses, additional memory overflows leading to unpredictable behavior or DoS, and predictable TCP Initial Sequence Numbers, each requiring specific configurations such as Gateway mode, Oracle load balancing, non-HTTP Layer 7 protocols, or TCP functionality enabled. Affected versions are NetScaler ADC/Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and the corresponding FIPS/NDcPP builds. Secure Private Access hybrid deployments using NetScaler instances are also affected; Citrix-managed cloud services and Citrix Managed Adaptive Authentication are handled separately by Cloud Software Group.
Given confirmed in-the-wild exploitation, NCSC-NL urges immediate patching and recommends organizations treat any pre-patch exposed system as potentially already compromised. Before applying updates, defenders should preserve relevant logs and a memory dump to retain forensic evidence, since patching prevents future exploitation but does not remove evidence of prior compromise. This mirrors the pattern of prior NetScaler zero-days actively used for initial access and should be treated as a high-priority patching event for all customer-managed NetScaler deployments.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0394.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs