Certainties in life: Death, taxes, and critical Citrix vulns under attack
Citrix says critical NetScaler flaws, including unauthenticated RCE, are under active global attack; CISA alerted defenders.
Citrix disclosed eight NetScaler vulnerabilities, including critical CVE-2026-88771 and CVE-2026-88772, both scored CVSS 9.5. CVE-2026-88771 lets an unauthenticated attacker execute arbitrary commands, while CVE-2026-88772 is a memory overflow that can cause remote code execution or denial of service. CVE-2026-88773, rated 9.3, allows HTTP request smuggling that can bypass front-end security controls, and additional bugs are rated 8.8 and 7.0. Citrix and CISA say the two critical flaws are already being exploited globally, and Citrix has issued OS refreshes with fixes.
- CVE-2026-88771 and CVE-2026-88772 are critical at CVSS 9.5 and already exploited.
- CVE-2026-88771 allows unauthenticated remote command execution on NetScaler.
- CVE-2026-88773, CVSS 9.3, enables HTTP request smuggling past front-end controls.
- CISA confirmed global exploitation and urged prioritized mitigation.
- Citrix has published OS refreshes that contain the fixes.
- Vendors
- Citrix
- Products
- NetScaler
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 | 3% | PoC ×2 |
From the original article
2 min read at theregister.comSunday NetScaler patch dump fixes trio of critical vulns and five more serious messes
By Simon Sharwood · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.