The Cybersecurity and Infrastructure Security Agency (CISA) issued a directive to U.S. government agencies over the weekend requiring them to remediate two critical vulnerabilities in Citrix NetScaler appliances that are currently being exploited by attackers. Citrix released patches for the flaws, designated CVE-2026-88771 and CVE-2026-88772, following private warnings that national cybersecurity agencies and IT vendors had already begun circulating to their customer bases.
The Dutch National Cyber Security Center (NCSC-NL) had previously alerted organizations within the Netherlands about two critical NetScaler zero-day vulnerabilities lacking CVE identifiers. These flaws enabled threat actors to inject shellcode directly into system memory. On Sunday, Citrix acknowledged that both vulnerabilities were undergoing active exploitation in zero-day attacks and called on all customers to deploy patches without delay.
Vulnerability details and impact
Both vulnerabilities enable unauthenticated attackers to achieve remote code execution on unprotected NetScaler appliances. The first flaw affects all NetScaler ADC and NetScaler Gateway installations running default configurations. The second requires DTLS to be enabled, a setting Citrix noted is activated by default on VPN virtual servers.
Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed. Citrix strongly urges affected customers to install the relevant updated versions as soon as possible.
Citrix, in a Sunday blog post
Citrix noted that the vulnerabilities manifest differently depending on deployment configuration and which features are active. Potential impacts span remote code execution, denial of service, HTTP request smuggling, policy bypass, and TCP initial sequence number prediction under particular circumstances.
Indicators of compromise and detection challenges
Citrix has distributed what it characterizes as generic indicators of compromise through NetScaler Console to assist security teams in identifying potentially compromised deployments. The company cautioned, however, that these indicators "might be of limited forensic value and might fail to identify actual compromises" and recommended that customers engage professional forensic investigators.
According to threat intelligence firm Shadowserver, more than 23,000 IP addresses displaying NetScaler fingerprints are currently accessible from the internet. This includes approximately 22,000 NetScaler ADC appliances and just over 1,500 Gateway instances. The data does not clarify how many of these systems are honeypots, have already received patches, or operate with vulnerable configurations.
Federal mandate and timeline
CISA added both CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities Catalog on Sunday and issued a binding directive under Binding Operational Directive 26-04 requiring Federal Civilian Executive Branch agencies to patch all affected Citrix appliances by September 30.
Given the potential consequences of successful exploitation and the fact that malicious actors are exploiting at least some of these vulnerabilities, CISA urges users and administrators to review Citrix's advisories.
CISA
CISA advised organizations to check for signs of compromise before applying patches where feasible. The agency emphasized that Citrix has made indicators of compromise available through NetScaler Console and published additional guidance. Organizations suspecting they have been compromised should preserve forensic evidence prior to patching, as updates may eliminate forensic visibility.
Pattern of recent Citrix exploitation
These two vulnerabilities represent the latest in a series of Citrix flaws that have been actively exploited since the beginning of the year. In March, Citrix released patches for CVE-2026-3055 and CVE-2026-4368 days before attackers began weaponizing them. More recently, in early September, threat actors began exploiting CVE-2026-19490, a NetScaler authentication bypass that Citrix had patched in mid-August.
Since November 2021, CISA has documented 26 Citrix vulnerabilities that have been actively exploited in the field, with six of them being leveraged by ransomware operations.