Three Citrix NetScaler Flaws Under Active Attack, Federal Patch Deadline Is Days Away
Two of the three vulnerabilities are already on CISA's must-fix list, one carrying a near-perfect severity score. Here is what is exposed, who is at risk, and what to do before the clock runs out.
Key points
- CVE-2026-88771, a critical flaw in Citrix NetScaler, lets an attacker with no login credentials run any command on affected devices; US federal agencies had to patch by 30 September 2026.
- A second flaw, CVE-2026-88779, was added to the same government mandatory-fix list on 4 October 2026, with a deadline of 7 October 2026.
- A third vulnerability, CVE-2026-88778, carries a high severity rating and affects the same product versions, though it doesn't appear on the federal required-patch list.
- All three flaws were patched in the emergency Citrix advisories shipped over the weekend of 26 September 2026; any install below the fixed builds remains exposed.
- The gap in CVE numbering between CVE-2026-88779 and CVE-2026-88787 suggests further Citrix advisories may be coming.
Citrix NetScaler is the kind of device that sits at the very edge of a corporate or government network, handling web traffic routing, load balancing and VPN access (a private tunnel for remote employees). Because it controls how a network communicates with the outside world, it's exactly what criminals and state-sponsored hackers aim for first.
Sometime in mid-September 2026, attackers began exploiting undisclosed flaws in NetScaler ADC and Gateway. Dutch government analysts and private incident responders spotted unusual traffic, and Citrix shipped emergency patches over the weekend of 26 September.
What exactly is broken?
Three CVEs (Common Vulnerabilities and Exposures, the standard numbered labels used to track specific flaws) affect the same product family.
| CVE | CVSS Score | Severity | What it allows | Federal patch deadline |
|---|---|---|---|---|
| CVE-2026-88771 | Critical | High | Unauthenticated remote command execution | 2026-09-30 |
| CVE-2026-88778 | High | High | Predictable session values (session hijacking risk) | None listed |
| CVE-2026-88779 | High | High | Memory buffer flaw enabling denial of service | 2026-10-07 |
CVE-2026-88771 is the one that should make every NetScaler operator stop what they're doing. An improper input validation flaw, meaning the software fails to check whether incoming data is safe before acting on it, lets anyone on the internet send malicious instructions and have the device execute them, no password required.
CVE-2026-88779 followed on 4 October 2026, covering a memory buffer vulnerability, where a program is tricked into reading or writing data outside its allocated space, causing the device to crash or become unreachable. We covered it when it first hit live networks in "A Fresh Citrix Zero-Day Is Already Being Exploited, and Federal Agencies Have Three Days to Fix It".
Should non-federal organisations worry?
Yes. CISA's mandatory deadlines apply only to US federal agencies, but both CVEs are confirmed as actively exploited, meaning criminal and state-linked attackers are already using them against real targets. Any organisation running NetScaler ADC or Gateway below the fixed builds is exposed. CVE-2026-88779 requires a separate, later patch build to be fully addressed.
Internet-facing edge devices like NetScaler tend to get patched more slowly than endpoint computers, because taking them offline disrupts live traffic. That delay is what attackers count on.
One detail worth watching, flagged in SecurityWeek's original coverage: the CVE numbering jumps from CVE-2026-88779 to at least CVE-2026-88787 with nothing published in between. Sequential gaps like that typically mean additional advisories are being coordinated. Patch managers should treat this batch as potentially incomplete.
What should affected organisations do?
Check your NetScaler version immediately. If you're running ADC or Gateway below the fixed builds, you're exposed to at least one actively exploited flaw. Apply the Citrix patches, prioritising CVE-2026-88771 first given its critical rating and confirmed exploitation. If patching within days isn't possible, restrict internet-facing access to the management interface as a temporary measure. Audit VPN and remote-access logs for unusual commands or sessions from unexpected IP addresses going back to at least mid-September 2026.
The broader pattern here is the one that matters: Citrix has now pushed multiple emergency patch rounds in quick succession, and as our 12 October report on four flaws in a fortnight showed, the advisories keep coming. Anyone treating this as a one-time event is reading it wrong.
