Vulnerabilities
Citrix NetScaler flaws let attackers take control of company networks
Two critical vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited. Attackers can run code on unpatched devices, putting company networks at risk.
Ross GrantUpdated 3 min read
The short version
Two serious security flaws in Citrix NetScaler ADC and Gateway let attackers take control of affected devices without logging in. These devices are used by many companies to manage network traffic and remote access. Attackers are already using these flaws to break into company networks. Companies should update their devices right away to stay safe.
What happened?
Citrix confirmed two critical vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in NetScaler ADC and Gateway are being actively exploited. Attackers can run code on unpatched devices. Security researchers have seen attacks since early September 2026, targeting organisations in North America and Europe.
What are the Citrix NetScaler vulnerabilities?
On 27 September 2026, Citrix published a security bulletin about eight vulnerabilities in its NetScaler ADC and Gateway products. Two of these, CVE-2026-88771 and CVE-2026-88772, are especially serious. Both allow attackers to run code on the device without needing to log in first. Citrix and security researchers confirmed that attackers are already exploiting these flaws in real-world attacks (CERT-EU (opens in a new tab), Google Threat Intelligence Group (opens in a new tab), Unit 42 (opens in a new tab)).
The vulnerabilities affect customer-managed NetScaler ADC and Gateway appliances running versions before 13.1-64.23 and 14.1-73.37. Secure Private Access Hybrid deployments using NetScaler are also at risk. Citrix recommends updating to the latest fixed versions immediately.
How attackers are exploiting these flaws
Unit 42 and Google Threat Intelligence Group have observed attackers using two main techniques. For CVE-2026-88772, attackers send specially crafted Datagram Transport Layer Security (DTLS) packets to the device. This can cause a memory overflow, letting them run their own code or crash the device. Attackers have used this to install web shells, malicious scripts that give them remote control, on the appliance. These web shells allow attackers to run commands, steal files, and upload new malware.
For CVE-2026-88771, attackers use a three-stage process involving command injection. They trick the device into running code by poisoning log files with malicious commands, which are later executed by a vulnerable script. This also results in a web shell being installed, giving the attacker persistent access.
Who is affected and what has been seen so far?
According to Google, organisations in North America and Europe have been targeted, including those in government, finance, technology, education, and legal sectors. Attackers have been exploiting these flaws since at least early September 2026. The attacks are ongoing and have used a variety of servers and VPN addresses to avoid detection. Researchers have recovered malicious files used in the attacks and confirmed that they provide attackers with full control over the device.
What should defenders do now?
Citrix, CERT-EU, and Google all recommend updating affected devices to the latest fixed versions as soon as possible. If patching cannot happen immediately, organisations should consider disabling DTLS on internet-facing appliances, blocking inbound UDP/443 traffic, and restricting access to the appliances using firewall rules. For devices that may already be compromised, defenders should isolate them from the network, rotate credentials and secrets, and check for signs of compromise such as unusual files or log entries.
Google and Mandiant also advise reviewing connected systems for lateral movement, as attackers may use compromised NetScaler devices to move deeper into the network. Full forensic snapshots should be taken before rebooting virtual appliances, and active sessions should be revoked.
What happens next?
Because these vulnerabilities are being actively exploited, unpatched devices are likely to be targeted. Even after patching, organisations should check for signs that attackers may have already gained access. Ongoing monitoring and compromise assessments are strongly advised. Citrix and security agencies may release further updates as the situation develops.
Claimed vs confirmed
- Confirmed
Attackers are actively exploiting CVE-2026-88771 and CVE-2026-88772 in the wild.
Citrix, CERT-EU, Google Threat Intelligence Group, and Unit 42 have all confirmed active exploitation.
- Confirmed
Organisations in North America and Europe across several sectors have been impacted.
Google Threat Intelligence Group observed likely impact in government, finance, technology, education, and legal sectors.
The impact
- Money
- No specific losses reported, but under UK GDPR, fines can reach £17.5m or 4% of global turnover if personal data is compromised.
- Reputation
- Organisations using Citrix NetScaler may face trust issues if attackers gain access to sensitive systems. The visibility of the attack depends on whether customer data or services are affected.
- Customers
- If attackers use these flaws to access internal systems, customer data and services could be at risk. Customers should watch for updates from affected organisations and consider changing passwords if notified.
Why it matters
These vulnerabilities let attackers take control of devices that often sit at the edge of company networks, potentially giving them access to sensitive data and internal systems. Many large organisations use Citrix NetScaler for remote access and load balancing, so the impact could be wide-reaching. Unpatched devices are at high risk of compromise.
How does it work?
Attackers exploit CVE-2026-88772 by sending crafted DTLS packets, causing a memory overflow that lets them run code or crash the device. For CVE-2026-88771, attackers use command injection by poisoning log files, which are later processed by a vulnerable script, leading to remote code execution. Both methods allow installation of web shells for persistent access.
Key points
- Two critical Citrix NetScaler flaws are being actively exploited.
- Attackers can run code and install web shells without logging in.
- Organisations in multiple sectors and regions have been targeted.
- Immediate patching is required to prevent compromise.
- Defenders should check for signs of past attacks even after patching.
Sources
CERT-EU
Government
Google Threat Intelligence Group
Research
Unit 42
Research
The Hacker News
Reference
