Administrators were recently warned by managed service providers (MSPs), MDR vendors, and national security agencies to power down Citrix NetScaler appliances. A pre-notification without CVE IDs from the Dutch National Cyber Security Center (NCSC-NL) regarding two unpatched zero-day vulnerabilities in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway triggered the warning. Rumors began to spread via Reddit and supplier channels as defenders attempted to act on warnings they were unable to verify.
Attacks Carried Out Unseen
An advisory put out by Citrix on Sunday validated the warnings about the vulnerabilities and explained the issues for administrators to understand. Two flaws saw weeks of exploitation on unmitigated NetScaler deployments before the public disclosure was released.
The first, CVE-2026-88771, is an unauthenticated remote code execution (RCE) vulnerability with a critical CVSS score of 9.5 that occurs as a result of improper input validation. It can enable an attacker to execute arbitrary commands on compromised deployments. All NetScaler ADC and NetScaler Gateway deployments are affected, even default configurations with no additional features enabled.
The second flaw, CVE-2026-88772, is a memory overflow vulnerability, also with a critical CVSS of 9.5, that can cause RCE or denial of service (DoS). The United States Cybersecurity and Infrastructure Security Agency (CISA) added both of these vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog.
Advisory Names the Threat
The article from Citrix, CTX697096, covers a total of eight CVEs affecting various versions of NetScaler ADC and NetScaler Gateway. Beyond the two flaws described above, these vulnerabilities are CVE-2026-88773 with a CVSS score of 9.3, CVE-2026-88774 with CVSS score of 7, and CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778, all with CVSS scores of 8.8.
The DTLS precondition is on by default on VPN virtual servers, meaning the default configurations of these deployments are vulnerable to CVE-2026-88772. The release of the advisory and the addition of the two vulnerabilities already exploited to the KEV catalog triggered the federal remediation mandate that requires federal organizations to take steps to mitigate vulnerabilities within a timeframe according to Binding Operational Directive (BOD) 26-04.
Patching Isn’t the Whole Fix
It is crucial that administrators update their NetScaler ADC and NetScaler Gateway deployments to patch the disclosed vulnerabilities, but this alone is not enough to guarantee security against these flaws. There is no configuration workaround for CVE-2026-88771, so the scope of impact is massive and affects all deployments by default.
Updating to the patched versions of the affected deployments may also erase important forensic evidence. CISA urges customers to run compromise checks prior to patching to be sure that indicators of compromise are found and not erased. If a deployment of NetScaler ADC or NetScaler Gateway has in fact been compromised, an attacker’s persistent presence may linger beyond patching and go undetected.
A Familiar Pattern at the Network Edge
This is not the first time Citrix has dealt with vulnerabilities like these in NetScaler ADC and NetScaler Gateway: the discovery and disclosure of these flaws contain echoes of 2023’s CitrixBleed and 2025’s CitrixBleed 2. Remote access gateways are a favored point of initial access for attackers, recurring in many incidents as threat actors exploit vulnerabilities to gain remote access.
The fact that informal warning networks like Reddit are outpacing vendor disclosure of vulnerabilities is a strong signal of the severity of the risk and the need for faster detection and mitigation on a larger scale than just individual admins patching their deployments on time. “This fits the pattern of attacks on network gateways, but it is not simply another case of administrators neglecting updates,” says Jason Soroko, Senior Fellow at Sectigo. “Exploitation began before fixes existed.”
What Security Leaders Should Do Now
Citrix and security experts recommend a series of steps to protect against these vulnerabilities. It is crucial to hunt for indicators of compromise before taking any other action, including patching, as it may compromise forensic evidence and leave deployments compromised without any evidence. Internet-exposed appliances should be considered and treated as potentially breached, not secure by default. Every Gateway, VPN, and AAA virtual server should be inventoried. Overall, it is vital for the security ecosystem to reevaluate how edge-device warnings reach defenders.
