Cyber Authorities Warn of Active Exploitation of Citrix Vulnerabilities
Zero-day flaws in Citrix NetScaler ADC and Gateway prompt urgent patching calls.
1Critical Citrix Vulnerabilities
Two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited globally. These flaws, tracked as CVE-2026-88771 and CVE-2026-88772, allow unauthenticated actors to execute arbitrary commands or launch denial-of-service attacks. The vulnerabilities affect versions 13.1 and 14.1 of NetScaler ADC and Gateway, prompting urgent patching recommendations from cybersecurity agencies.
2Government Alerts Issued
Cybersecurity agencies in the UK, the Netherlands, and the US have issued alerts urging organizations to patch the Citrix vulnerabilities immediately. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its Known Exploited Vulnerabilities catalog, setting a fix deadline of September 30. The UK’s National Cyber Security Centre (NCSC) emphasized the need for organizations to assess potential compromises.
3Impact on NetScaler Products
The vulnerabilities affect NetScaler ADC and Gateway versions 13.1 and 14.1, as well as NetScaler ADC FIPS and NDcPP versions. Citrix released patches on September 27, but many organizations remain exposed. The flaws arise from improper input validation and memory overflow conditions, enabling remote code execution and denial-of-service attacks.
4Exploitation Confirmed
CISA confirmed that threat actors are actively exploiting these vulnerabilities globally. The flaws are critical, zero-day vulnerabilities that can independently enable remote code execution. Organizations are advised to isolate affected systems and replace them with updated versions, though this may cause significant IT outages.
5Forensic Evidence Preservation
The NCSC recommends preserving forensic evidence if compromise is suspected before applying updates. Organizations should also report incidents to national cybersecurity agencies and Citrix to assist investigations. Indicators of compromise (IoCs) have been shared to help identify potential breaches.
6Criticism of Citrix Disclosure
Citrix faced criticism for its delayed disclosure of the vulnerabilities. The Dutch NCSC and security firm WatchTowr issued alerts before Citrix acknowledged the flaws. WatchTowr described the situation as serious and emphasized the need for timely communication with customers.
7Industry Reactions
Security experts highlighted the importance of strengthening controls around vulnerable systems. Discussions on platforms like Reddit speculated about potential incidents as IT teams awaited official confirmation from Citrix. The incident underscores the challenges of managing zero-day vulnerabilities in critical infrastructure.
8Lessons for Organizations
The Citrix vulnerabilities highlight the need for proactive patch management and robust incident response plans. Organizations must prioritize timely updates and maintain open communication with vendors. This incident serves as a reminder of the risks posed by zero-day vulnerabilities in widely used enterprise products.