Two Critical NetScaler Flaws, Both Already Exploited
On September 27, 2026, Citrix published security bulletin CTX697096 confirming that two remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway are being actively exploited. These aren’t theoretical risks. Citrix found the flaws while investigating actual incidents in customer environments. If you run NetScaler appliances you manage yourself, this is your problem right now.
For a small or mid-size business, NetScaler is often the front door to your entire network. It handles remote access and application delivery. An attacker who compromises it doesn’t need to get past your internal defenses first, because they’re already inside the perimeter. That’s what makes these two CVEs particularly bad.
What the Vulnerabilities Actually Are
CVE-2026-88771 is an improper input validation flaw that lets an unauthenticated attacker run arbitrary commands on the device. No login required, no special feature needs to be turned on. It affects all NetScaler ADC and NetScaler Gateway deployments, including default configurations. Severity score: 9.5.
CVE-2026-88772 is a memory overflow bug that can also lead to remote code execution or a denial-of-service condition. It’s exploitable when DTLS is enabled, which it is by default on VPN virtual servers. Severity score: also 9.5. You can read the NVD entries for CVE-2026-88771 and CVE-2026-88772 for the technical specifics.
According to BleepingComputer’s reporting, the Dutch National Cyber Security Center was already sending pre-notifications to organizations before Citrix made any public announcement. That’s unusual. It signals that someone took these seriously enough to warn people quietly before the patches even existed.
Which Versions Are Affected
Citrix has confirmed the following builds are vulnerable:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
- NetScaler ADC FIPS before 14.1-73.37 FIPS
- NetScaler ADC FIPS and NDcPP before 13.1-37.279
Secure Private Access hybrid deployments using NetScaler instances are also affected. If you’re running Citrix-managed cloud services, Citrix says those are being updated on their end, so this bulletin applies specifically to customer-managed appliances.
What to Do Right Now
Patch. That’s the short answer. Upgrade your NetScaler ADC and Gateway appliances to the fixed builds listed in CTX697096. Yes, upgrades can cause downtime. Plan for it this week, not next month.
If you genuinely can’t patch immediately, reduce the Internet exposure of your NetScaler appliances where you can. That’s not a fix, it’s a delay tactic. The Dutch NCSC also warned that exploitation attempts are likely to increase now that Citrix has released patches and more technical details are public. The window for acting quietly is already closing.
One thing worth checking: DTLS is enabled by default on VPN virtual servers. If you have no operational reason to have it on, disabling it removes the attack surface for CVE-2026-88772 while you arrange the upgrade. But don’t treat that as a substitute for patching.
If you’re running other edge devices and wondering whether your broader patch process is solid, our post on actively exploited vulnerabilities and how to prioritize patching covers the decision-making side of this. And if you’ve dealt with Citrix issues before, the background in our earlier piece on Citrix NetScaler flaws affecting small businesses is still relevant context.
Keeping Internet-facing appliances patched on a tight timeline is genuinely hard when you’re running a business. If you want someone to handle that tracking and response for you, book an IT assessment with Exine and we can look at where your current gaps are.
FAQ
Does this affect my business if we use Citrix through a cloud service?
If Cloud Software Group manages your Citrix environment, they’re handling the upgrades. This bulletin applies only to customer-managed NetScaler ADC and NetScaler Gateway appliances. Check with your Citrix account contact if you’re unsure which model you’re on.
Can attackers exploit CVE-2026-88771 without any credentials?
Yes. Citrix confirmed it allows an unauthenticated attacker to execute arbitrary commands. It affects all deployments including default configurations, meaning no special setup is needed on the attacker’s side. That’s what makes a 9.5 severity score realistic here.
What happens if I can’t patch my NetScaler right away?
Reduce the device’s Internet exposure as much as your operations allow. If DTLS is enabled and not needed, disabling it limits the attack surface for CVE-2026-88772. Neither step replaces patching. The Dutch NCSC warned that exploitation attempts will likely increase after public disclosure.
