# Citrix NetScaler flaws exploited, patch urgently

Published: 2026-09-27 · Severity: severe · Sectors: technology, government-national, infrastructure
Canonical: https://vorant.io/reports/205bba18-b018-57f2-9f7f-e04dd4d21536/citrix-netscaler-flaws-exploited-patch-urgently

> NCSC-NL warns of 8 NetScaler ADC/Gateway vulnerabilities, three critical, with two already exploited in the wild allowing unauthenticated RCE.

Citrix has patched eight vulnerabilities in NetScaler ADC and NetScaler Gateway, three of which are rated critical with CVSS scores above 9. CVE-2026-88771 (CVSS 9.5) allows an unauthenticated attacker to execute arbitrary remote commands on all NetScaler ADC and Gateway deployments without requiring any specific configuration. CVE-2026-88772 (CVSS 9.5) is a memory overflow leading to RCE or denial-of-service, exploitable when DTLS is enabled — which is the default on VPN virtual servers. CVE-2026-88773 (CVSS 9.3) is an HTTP request smuggling flaw exploitable without authentication when HTTP functionality is enabled. NCSC-NL confirms that CVE-2026-88771 and CVE-2026-88772 have already been actively exploited against NetScaler systems.

The remaining five vulnerabilities (CVE-2026-88774 through CVE-2026-88778, CVSS 7.0–8.8) involve policy bypasses, additional memory overflows leading to unpredictable behavior or DoS, and predictable TCP Initial Sequence Numbers, each requiring specific configurations such as Gateway mode, Oracle load balancing, non-HTTP Layer 7 protocols, or TCP functionality enabled. Affected versions are NetScaler ADC/Gateway 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, and the corresponding FIPS/NDcPP builds. Secure Private Access hybrid deployments using NetScaler instances are also affected; Citrix-managed cloud services and Citrix Managed Adaptive Authentication are handled separately by Cloud Software Group.

Given confirmed in-the-wild exploitation, NCSC-NL urges immediate patching and recommends organizations treat any pre-patch exposed system as potentially already compromised. Before applying updates, defenders should preserve relevant logs and a memory dump to retain forensic evidence, since patching prevents future exploitation but does not remove evidence of prior compromise. This mirrors the pattern of prior NetScaler zero-days actively used for initial access and should be treated as a high-priority patching event for all customer-managed NetScaler deployments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-88771 (KEV), CVE-2026-88772 (KEV), CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0394.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/205bba18-b018-57f2-9f7f-e04dd4d21536/citrix-netscaler-flaws-exploited-patch-urgently.
In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup