Citrix NetScaler

Security firm Tenable has published an FAQ and analysis on two reported zero-day vulnerabilities in Citrix NetScaler appliances that are allegedly being actively exploited in the wild. NetScaler devices are widely used by enterprises for application delivery and remote access, making these flaws a serious concern. Security teams are being urged to review the guidance, check whether their appliances are affected, and apply mitigations or patches as they become available.

Enterprise IT teams are taking Citrix NetScaler hardware offline following reports of two unpatched zero-day vulnerabilities. Security researchers say the flaws are being actively exploited for remote code execution in the wild, though Citrix has not yet confirmed them or released an official patch. Administrators are choosing to isolate the hardware rather than wait, and security communities are urging others to assess exposure immediately.

Security experts are warning organizations to take Citrix NetScaler appliances offline amid reports of two undisclosed zero-day vulnerabilities. There are no public CVEs, no patch is available yet, and only limited indicators of compromise have been shared. The affected scope is not fully clear, but the emergency guidance suggests defenders consider the risk serious enough to warrant disconnecting the devices until fixes arrive.

Citrix NetScaler ADC and Gateway appliances are under active attack through two unpatched remote code execution vulnerabilities. The Dutch cybersecurity agency NCSC and security firm watchTowr have advised organisations to take affected appliances offline, as no patches are yet available. Security teams worldwide are scrambling to assess exposure and mitigate the risk of compromise.

Security firm watchTowr reports two unpatched remote code execution vulnerabilities in Citrix NetScaler ADC and Gateway that are being actively exploited. The flaws surfaced during forensic work, marking the third NetScaler emergency since June. Citrix has issued no bulletin, CVEs, or fix yet, with patches expected early next week. Some administrators are already applying workarounds rather than waiting.

Security administrators running Citrix NetScaler appliances are being told to shut the devices down following reports of two newly discovered zero-day vulnerabilities. The warnings, circulating among security professionals, reflect fears that attackers are actively exploiting the flaws before patches are available, leaving defenders with few options beyond taking affected appliances offline until fixes are released.

Two zero-day vulnerabilities in Citrix NetScaler appliances, both allowing remote code execution, are reportedly being actively exploited by attackers. No CVE identifiers or official patches have been released yet. Administrators running NetScaler as VPN or application delivery controllers are urged to apply interim mitigation steps and watch for an official Citrix advisory.

Two unauthenticated remote code execution vulnerabilities, CVE-2026-88771 and CVE-2026-88772, are being exploited in the wild against Citrix NetScaler ADC and Gateway appliances. The first affects default configurations, while the second requires DTLS, which is enabled by default on VPN virtual servers. Patches are available, the flaws have been added to CISA's Known Exploited Vulnerabilities catalog with a federal patching deadline of September 30, and Shadowserver reports over 23,000 exposed instances online.

CISA has added CVE-2026-88771 and CVE-2026-88772, two vulnerabilities affecting Citrix NetScaler, to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. Both flaws are described as remote code execution vectors, meaning attackers can potentially run malicious code on affected appliances. Security teams are urged to check whether they run NetScaler and apply patches immediately, as exploited edge devices are a common entry point for intrusions.

Cybersecurity firms report attackers are exploiting a previously unknown vulnerability in Citrix NetScaler, tracked as CVE-2026-88772, to deploy custom web shells and tunneling malware. The attackers reportedly gain root access, steal credentials, and move into victims' internal networks. Security teams are urged to check exposed NetScaler appliances for signs of compromise and apply patches as they become available.

Google Cloud security researchers report active exploitation of two zero-day vulnerabilities, CVE-2026-88772 and CVE-2026-88771, in Citrix NetScaler ADC and Gateway appliances. Their analysis outlines defense strategies for organizations running the affected appliances, which are widely used for application delivery and secure remote access. Administrators are urged to review the guidance and protect their deployments promptly.

A pre-authentication memory overflow vulnerability, tracked as CVE-2026-88772, has been disclosed affecting Citrix NetScaler devices via DTLS. The flaw is drawing comparisons to earlier NetScaler security crises, with security commentators reacting to yet another remotely exploitable issue in widely deployed enterprise appliance software. Administrators are expected to scrutinise patch guidance while details of exploitation and severity remain limited.

Security researchers at WatchTower Labs have published details of a new vulnerability in Citrix NetScaler, tracked as CVE-2026-88772. The flaw is a memory overflow in the handling of DTLS traffic that can be triggered before authentication, meaning attackers may be able to exploit it without valid credentials. The disclosure follows another Citrix NetScaler vulnerability reported just the day before, prompting frustration among security professionals that the product continues to produce serious remotely exploitable flaws.