Actors exploited NetScaler zero-days before Citrix's weekend patches
Original title: This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
Citrix fixed unauthenticated RCE flaws CVE-2026-88771 through CVE-2026-88778 after admins were urged to disconnect edge systems.
Unidentified attackers began exploiting undisclosed flaws in Citrix NetScaler ADC and Gateway in mid-September 2026. Dutch government analysts and private incident responders saw suspicious traffic, and over the September 26 weekend resellers urged admins to restrict or disconnect internet-facing deployments. By Sunday Citrix patched a sequential batch of unauthenticated remote code execution bugs. The column argues faster detection and a shorter Citrix response time show a stronger edge-defense posture.
Unconfirmed: The attackers are unidentified, and further patches for the unpublished CVE gap are only the author's expectation.
- The patched issues run from CVE-2026-88771 through CVE-2026-88778.
- The author says Citrix's 2026 NetScaler disclosure window fell to 17 days from nearly 40.
- CVE-2026-88779 through CVE-2026-88787 were still unpublished when he wrote.
- He says two NetScaler issues may mark rare Sunday additions to CISA's KEV catalog.
Impact: Unauthenticated remote code execution on NetScaler edge appliances
| Product | Affected |
|---|---|
| Citrix NetScaler ADC | — |
| Citrix NetScaler Gateway | — |
- 1.Apply Citrix's emergency patches for the September NetScaler flaws.
- 2.Restrict or disconnect internet-facing NetScaler deployments until they are patched.
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88771 | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88778 | Predictable-value flaw in Citrix NetScaler ADC and Gateway | 8.8 | — |
From the original article
4 min read at securityweek.com
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us about the New Normal appeared first on SecurityWeek.
By Tod Beardsley · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.