Citrix NetScaler Zero-Days Patched After Active Exploitation

Citrix has moved quickly to patch a set of serious vulnerabilities in its NetScaler application delivery and remote access products, including two zero-day flaws that were already being exploited in the wild when the fixes arrived. The disclosure has put pressure on administrators across the globe to patch immediately, with the two actively abused bugs representing some of the most dangerous types of flaws in enterprise networking gear.

What Happened

Over the weekend, Citrix released patches covering eight vulnerabilities affecting NetScaler ADC (Application Delivery Controller) and NetScaler Gateway, a portfolio that sits at the network edge for countless organizations and handles authentication and traffic routing for remote workforce access 12. The advisory spans a range of problem classes — remote code execution, HTTP request smuggling, denial of service, and security bypass issues — but the headline-grabbing items are the two zero-days tracked as CVE-2026-88771 and CVE-2026-88772 12.

Citrix confirmed that both of these vulnerabilities had been exploited in the wild before patches were available, which is the defining characteristic of a zero-day and the reason the company treated the release as an emergency rather than a routine monthly update 12. Both flaws carry a CVSS score of 9.5 out of 10, placing them firmly in critical territory 2.

The more alarming of the pair is CVE-2026-88771, a remote code execution vulnerability that requires no authentication to exploit. That combination — unauthenticated access plus arbitrary code execution on an internet-facing appliance — is about as bad as it gets, and the fact that exploitation was already underway before a fix existed suggests attackers understood the value of what they had found 2.

Why It Matters

NetScaler appliances are high-value targets precisely because of where they live. ADC and Gateway deployments typically sit at the perimeter, proxying and securing access to internal applications. A compromised NetScaler box is not just one more infected server — it is a foothold at the trust boundary itself, capable of intercepting credentials, session tokens, and sensitive traffic passing through it. An unauthenticated RCE in that position is effectively a skeleton key to the network edge.

Compounding the concern, the affected products include deployments in their default configuration, meaning organizations that spun up NetScaler ADC or Gateway without extensive hardening are exposed too 2. That widens the potential victim pool considerably, since default configurations are far more common in practice than fully hardened ones.

The timing also matters. Weekend emergency patches are unusual, and Citrix's decision to rush the fixes out rather than hold them for a scheduled release signals that the company believed the risk of continued exploitation outweighed the disruption of an out-of-band update. The fact that some administrators reportedly began pulling affected systems offline — disconnecting appliances from the internet while awaiting patches — underscores the severity as understood by the people running these environments day to day 1.

The Broader Pattern

This incident fits a well-established trend. Citrix products, and NetScaler in particular, have repeatedly landed in the crosshairs of both state-sponsored attackers and criminal groups because of their strategic placement and large install base. Application delivery controllers and VPN-style gateways from multiple vendors have been hammered by zero-day campaigns in recent years, and attackers have learned that a single unauthenticated flaw in these systems can open dozens, hundreds, or thousands of downstream networks at once.

The batch of eight vulnerabilities beyond the two zero-days should not be overlooked, either. HTTP request smuggling flaws, while individually less dramatic than RCE, can be chained to bypass security controls or poison caches, and denial-of-service and security bypass issues add further urgency for administrators planning their patching sequence 2.

What Organizations Should Do Now

The immediate priority is straightforward: apply the Citrix patches to all NetScaler ADC and Gateway deployments without delay. Given that the two zero-days were exploited pre-patch, organizations should not assume that updating alone closes the book on the incident. Any appliance exposed to the internet during the vulnerable window deserves a forensic review — hunting for signs of compromise such as unexpected processes, modified configurations, anomalous administrative logins, or new persistence mechanisms.

Where patching cannot happen quickly, administrators face the uncomfortable interim options: isolate the appliances, restrict management access, or follow the example of those who simply took systems offline until fixes were in hand 1. For internet-facing NetScaler deployments, the assumption that a vulnerable, unauthenticated RCE has been probed or attempted is a reasonable default posture.

Citrix's rapid response is commendable, but the episode is another reminder that perimeter appliances remain among the most contested ground in modern network security — and that attackers will find and weaponize flaws in them before vendors can ship fixes.