NetScaler Zero-Day Count Hits Four in Six Weeks: What It Means

A fourth advisory in a six-week stretch

Citrix has issued another urgent patch advisory for NetScaler ADC and NetScaler Gateway, this time for CVE-2026-107406. The flaw is distinct from the pair of zero-days the company fixed in late September, and it raises the number of critical NetScaler advisories in roughly six weeks to four. 1 For organizations that rely on these appliances for remote access and application delivery, the result has been a nearly continuous patching cycle since the end of September.

The sequence began on September 27, 2026. That day, Citrix published security bulletin CTX697096 confirming two zero-days, CVE-2026-88771 and CVE-2026-88772. Both had already been exploited against customer deployments. 3 CISA added both to its Known Exploited Vulnerabilities catalog the same day. It described them as critical flaws that can each enable remote code execution on their own, and said partner intelligence showed threat actors exploiting them globally. 4

The two bugs differ in scope. CVE-2026-88771 affects all deployments, including default configurations. CVE-2026-88772 applies only to appliances with Datagram Transport Layer Security (DTLS) enabled. 3 That makes the first one the more serious problem, because administrators cannot rule out exposure by checking their configuration.

A denial-of-service flaw, then another patch

In early October, Citrix disclosed a third exploited issue, CVE-2026-88779. It is a denial-of-service vulnerability that affects SAML-enabled deployments, and fixing it requires moving to newer builds. 3

Accounts of the timing differ slightly. Tenable dates the disclosure to October 3. 3 Tech-insider says Citrix pushed emergency patches on October 4 and describes attackers using the flaw in targeted denial-of-service campaigns. 2 The one-day gap likely reflects the difference between the advisory date and the date patches became available. Either way, customers had very little time between the September fixes and the next round.

CISA's guidance shows that the publicized zero-days are only part of the picture. The agency is amplifying Citrix's disclosure of ten vulnerabilities across NetScaler ADC and Gateway, covering CVE-2026-88771 through CVE-2026-88779 plus CVE-2026-107406. 4 It also urges organizations to review Citrix's guidance for suspected or confirmed compromises. 4 That advice implies patching may not be enough for appliances that were exposed during the exploitation window.

Edge appliances keep failing first

Citrix is not the only vendor in this position. Nine days after Citrix's early-October emergency patch, Ivanti faced its own crisis: a chain of three Connect Secure zero-days, tracked as CVE-2026-104935, that attackers could combine to gain root access. 2 Tech-insider places both incidents in a familiar pattern. Enterprise edge devices, which sit between the public internet and internal networks, keep proving to be the easiest way in. 2

Both vendors have been repeat targets since 2023, according to the same report. It adds that both recent flaws arrived with limited technical detail, incomplete patch guidance for some branches, and active exploitation that started before most customers could respond. 2 That combination is what makes these events so costly for defenders. They are handling a stream of incidents, each of which may already involve an intrusion by the time the advisory is published.

Reading the trend

The sources do not report any shift in enterprise architecture. Still, the pattern explains why the case against traditional VPN and gateway appliances is getting stronger. The appeal of zero-trust network access (ZTNA) and secure access service edge (SASE) models is that they remove a single internet-facing box that grants broad network access once compromised. Four critical advisories in six weeks, alongside a parallel Ivanti root-access chain, is the kind of record security leaders cite when arguing to retire perimeter appliances.

Some caution is warranted, though. Moving to ZTNA or SASE is a multi-year project, not a response to an incident. It also moves risk to a vendor's cloud control plane rather than eliminating it. In the near term, NetScaler customers mainly have operational work to do:

• Apply the September fixes for CVE-2026-88771 and CVE-2026-88772, prioritizing any deployment exposed to the internet. 34
• Upgrade to the newer builds needed to address CVE-2026-88779 if SAML is in use. 3
• Patch CVE-2026-107406. 1
• Treat exposed appliances as possibly compromised and follow Citrix's investigation guidance, as CISA recommends. 4

The most consequential detail is the overall count, more than any single CVE. Ten disclosed vulnerabilities, several exploited before patches existed, suggest that NetScaler's attack surface is being examined closely and successfully. 4 Organizations should assume more findings could follow and plan with that in mind, whether through faster patch pipelines, tighter exposure management, or a longer-term move away from the appliance model entirely.