Citrix NetScaler vulnerabilities being actively exploited

Citrix has patched eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, two of which have been confirmed as being actively exploited.

The first of the two, CVE-2026-88771 is a remote code execution (RCE) flaw, in which improper input validation enables an unauthenticated attacker to execute arbitrary commands. It affects all NetScaler ADC and NetScaler Gateway deployments and has a severity score of 9.5.

Meanwhile, CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or denial of service. It affects any deployment with DTLS configuration enabled – which it is, by default, on VPN virtual servers. This, too, has a severity score of 9.5.

"Both are critical, zero-day vulnerabilities that can independently enable remote code execution," said the US Cybersecurity and Infrastructure Security Agency (CISA). "CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally."

The UK's National Cyber Security Centre (NCSC) said there could now be an increase in exploitation attempts, following the release of patches and additional technical details.

The other vulnerabilities are:

• CVE-2026-88773: Inconsistent interpretation of HTTP requests (HTTP request/response smuggling), which may allow an attacker to manipulate or bypass security controls.
• CVE-2026-88774: Improper HTTP URL-based expression usage leading to a feature policy bypass.
• CVE-2026-88775: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.
• CVE-2026-88776: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.
• CVE-2026-88777: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.
• CVE-2026-88778: Predictable exact value vulnerability that may allow an attacker to influence integrity or availability.

The NCSC advises isolating any affected systems and replacing them with a new, fully up-to-date system. However, the NCSC also notes this may cause a service outage, as it could mean temporarily disabling access to the service with upstream firewalls, disabling the vulnerable components, or restricting access to only the organization's IP range.

Security teams should fully investigate for evidence of compromise using the published indicators of compromise (IoCs), and report anything they find. They should install the latest available updates, re-enable or reintroduce the affected systems and continue to monitor the Citrix security bulletin and perform continuous threat hunting activities.

They can also, said the NCSC, use NetScaler Console File Integrity Monitoring to help detect unauthorized or unexpected changes to monitored files on managed NetScaler instances.

"There are no additional details or proof-of-concepts available as of now. Based on the available CVSS scores, exploiting CVE-2026-88772 is more difficult than CVE-2026-88771," said Mayuresh Dani, security research manager at Qualys. "It is also imperative to know that patching does not remove an existing webshell that has been placed on a compromised device."

He also pointed out that a recommendation from Citrix to forward NetScaler logs to an external logging or SIEM platform may indicate that attackers can maintain persistence and alter vulnerable devices. All these devices, he added, should be kept under strict observation for at least 90 days.