Over the weekend, administrators who run Citrix NetScaler appliances began getting unusual phone calls. Their IT suppliers, and in some countries their national cyber agencies, were urging them to switch the devices off, and would not say exactly why.
On Sunday the reason became public. Citrix confirmed that two critical flaws in NetScaler were already being used in real attacks, and published fixes for both. The company rates each of them at 9.5 out of 10 for severity, and says it has seen them exploited on devices that had not yet been protected.
Two flaws, both serious
The first, CVE-2026-88771, is a remote code execution flaw caused by the appliance failing to check its input properly. An attacker who has not logged in at all can use it to run commands on the device. Citrix says it affects every NetScaler ADC and NetScaler Gateway deployment, including those left in the default configuration, and that nothing special has to be switched on for it to work. That combination, no login required and no unusual setup, is what makes it so dangerous.
The second, CVE-2026-88772, is a memory overflow that can be turned into either remote code execution or a crash that knocks the device offline. It can be reached when a feature called DTLS is active, and Citrix notes that DTLS is on by default for the virtual servers that handle VPN connections, so many appliances will be exposed without their owners having changed anything.
Why NetScaler is such a prize
NetScaler boxes are attractive to attackers because of where they sit. Organizations put them at the edge of the network, facing the internet, to handle remote access and to route traffic to internal applications. Taking one over hands an intruder a foothold on the perimeter, and from there a possible route into the systems behind it, without ever having to trick an employee or compromise a laptop inside the building. That is the same reason a string of earlier NetScaler flaws have been seized on so quickly.
How the warnings spread
The story became visible before Citrix said anything. Administrators began posting that suppliers and security teams were telephoning them with vague but urgent advice to take their NetScalers down, and that law enforcement and national response teams were doing the same. The security firm watchTowr said publicly that it was reacting to credible reports of several unpatched NetScaler flaws circulating in the wild, while adding that hard detail was scarce. In the Netherlands, the national cyber security center had already alerted organizations to two critical NetScaler flaws under active attack, days before the vendor confirmed anything.
What administrators should do
Citrix has released updated builds and published the details in security bulletin CTX697096. Because build numbers are easy to get wrong, the safest step is to take the exact target version for each release line straight from that bulletin rather than from secondhand summaries. A few points are worth knowing going in:
- The fix covers the 14.1 and 13.1 release lines and their FIPS variants, and the same update closes six further NetScaler flaws, eight in total.
- Deployments of Secure Private Access that rely on NetScaler instances need updating as well.
- The bulletin applies to appliances that customers run themselves. Citrix says it is handling the upgrade for the cloud services and the adaptive authentication service that it operates on customers' behalf.
- Given that both flaws were already being exploited before patches existed, anyone who ran an exposed appliance over the past week should assume it may have been reached and look for signs of compromise, not simply patch and move on.
