Over the weekend, Citrix rushed out patches for two critical NetScaler zero-day vulnerabilities that have already been exploited.
The company’s advisory covers eight vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including remote code execution, HTTP request smuggling, DoS, and security bypass issues.
The two zero days for them Citrix confirmed the exploitation are tracked as CVE-2026-88771 and CVE-2026-88772. Both have a CVSS score of 9.5.
CVE-2026-88771 is a remote code execution vulnerability that can be exploited without authentication. It affects all NetScaler ADC and Gateway deployments, including those in the default configuration.
CVE-2026-88772 is a memory overflow that can be exploited for remote code execution or DoS attacks. This affects appliances with DTLS configuration enabled, which is the default setting on VPN virtual servers.
Citrix has provided Indicators of Compromise (IoCs).
On the weekend NetScaler administrators said on Reddit that their IT vendors, CERT teams, and MDR providers had told them to turn off their devices immediately, often without providing any reason.
Some of these warnings followed a private advance notification from the Dutch National Cyber Security Center (NCSC-NL), which was reportedly shared under TLP:AMBER restrictions.
According to a copy posted in the Reddit thread, NCSC-NL said it learned about the two zero-days from a European partner CERT and that exploitation had been identified at several Citrix customers worldwide. Several administrators took their NetScalers offline, while others said they received no official notification.
CISA rushed over add Add CVE-2026-88771 and CVE-2026-88772 to the KEV catalog. The agency also issued an alert, warning that “threat actors are actively exploiting these vulnerabilities around the world.”
“Given the potential consequences of a successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to read Citrix’s advisory. Where possible, users are encouraged to look for evidence of compromise before patching,” CISA said.
CISA’s KEV catalog currently contains over a dozen Citrix NetScaler vulnerabilities, including the recently added vulnerabilities CVE-2026-19490 and CVE-2026-8452.
Related: Microsoft SharePoint bug CVE-2026-65660 is now being exploited in attacks
Related: “SalesBleed” error in zero-click data exfiltration enabled by Salesforce Agentforce
Related: Roundcube webmail vulnerability in attackers’ crosshairs
