Two critical Citrix NetScaler zero-days, already exploited
Citrix disclosed two critical flaws in NetScaler ADC and Gateway allowing remote code execution, with attacks already observed.
What happened
Citrix disclosed two vulnerabilities scoring 9.5 on CVSS (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and Gateway that could allow remote code execution. They affected default configurations and attacks against unmitigated installations had already been observed.
Why it matters
These appliances sit between the internet and the corporate network, and a compromise can give access to the company environment. The article also highlights the poor communication in the first advisories.
What we recommend
Apply the Citrix updates now; if that is not possible, isolate or disable the appliance; and do not close the incident with the patch: hunt for signs of compromise and review the sessions and credentials that passed through NetScaler.
Related service: Incident response
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.