Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.

CVE-2026-88772 is a critical flaw in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. It is reachable over the network with no privileges and no user interaction, though attack complexity is rated high; successful exploitation can fully compromise the appliance and affect systems behind it. Affected builds are ADC before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP, and Gateway before 14.1-73.37 and before 13.1-64.23. Organizations running those releases as internet-facing ADC or VPN gateways are at risk. Citrix-linked reporting describes active zero-day exploitation; no public proof-of-concept is known and the issue is not listed in CISA KEV.

Do: Upgrade NetScaler ADC and Gateway to 14.1-73.37 or 13.1-64.23 (or later), and FIPS/NDcPP ADC builds to 14.1-73.37 FIPS or 13.1.37.279 FIPS and NDcPP (or later). Treat unpatched internet-facing appliances as potentially compromised: review admin and VPN logs, config changes, and unusual processes, and restrict management interfaces until patched.