# Critical Citrix vulnerabilities actively exploited globally Eight new CVEs expose NetScaler systems to remote code execution and denial of service attacks. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-09-28 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/fcc0a643-c7b6-4a67-940c-ddea935b2463 ## Critical vulnerabilities disclosed Citrix revealed eight new CVEs affecting NetScaler ADC and Gateway products, with two critical 9.5 CVSS-rated flaws allowing remote code execution. CVE-2026-88771 enables unauthenticated attackers to run arbitrary commands, while CVE-2026-88772's memory overflow can lead to RCE or DoS. Attacks began before official disclosure, with reports suggesting some partners knew about the flaws a day earlier. The timing suggests threat actors had prior knowledge or quickly developed exploits. ## Active exploitation confirmed Both CISA and Citrix confirmed active exploitation of these vulnerabilities globally. The US cybersecurity agency issued an emergency alert, citing verified reports of attacks. This rapid weaponization follows a pattern observed in previous NetScaler vulnerabilities, which often appear in Five Eyes' most-exploited lists. The critical nature of these flaws and their pre-disclosure exploitation indicates sophisticated threat actors are targeting enterprise networks using these vectors. ## Additional high-risk vulnerabilities Beyond the two critical flaws, Citrix disclosed CVE-2026-88773 (9.3 CVSS) enabling HTTP request smuggling to bypass security controls. Three 8.8-rated memory overflow bugs can crash NetScaler appliances, while another 8.8 bug involves TCP sequence prediction. A 7.0-rated feature policy bypass completes the set. This diverse range of vulnerabilities affects different system components, requiring comprehensive patching rather than targeted fixes. ## Patching challenges Citrix acknowledges the complexity of updating NetScaler appliances, which often requires downtime. The company has released OS refreshes containing all fixes. Historical data shows many organizations delay patching due to operational constraints, despite NetScaler's notorious vulnerability history. This creates extended attack windows, as seen in 2023-2025 when similar critical flaws were rapidly exploited before patches could be widely deployed. ## Historical context NetScaler has appeared annually in Five Eyes' most-exploited vulnerabilities lists since 2020. The product experienced critical flaws in March 2026, twice in 2025, and in 2023. This pattern suggests systemic security issues in NetScaler's architecture. Despite this track record, some enterprises continue running unpatched systems, relying on compensating controls rather than addressing root causes through updates. ## Enterprise risk calculus Organizations face difficult decisions between maintaining uptime and applying security patches. While vendors develop compensating controls to secure vulnerable systems temporarily, these don't eliminate risks. The current vulnerabilities' criticality and active exploitation make this a high-priority issue. CISA's alert emphasizes incorporating these flaws into risk management frameworks, suggesting government agencies view this as particularly severe. ## Detection and mitigation Citrix provided guidance on identifying vulnerable systems and applying appropriate patches. For organizations unable to patch immediately, network segmentation and strict access controls can reduce exposure. Monitoring for anomalous traffic patterns and command executions is critical, as these vulnerabilities enable full system compromise. Security teams should prioritize investigating any NetScaler-related alerts during this period. ## Systemic security implications The recurring nature of critical NetScaler vulnerabilities highlights challenges in securing complex enterprise infrastructure. While patches exist, operational realities prevent timely deployment, creating persistent attack surfaces. This incident underscores the need for more resilient system architectures and improved patch management processes, particularly for widely deployed enterprise components like ADCs. ## Sources covering this story - https://www.theregister.com/security/2026/09/28/certainties-in-life-death-taxes-and-critical-citrix-vulns-under-attack/5299369 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._