Update, 28 September: Citrix has now released patches. The two actively exploited flaws are tracked as CVE-2026-88771 (unauthenticated remote command execution, affecting every NetScaler ADC and Gateway deployment by default) and CVE-2026-88772 (a memory overflow reachable when DTLS is enabled, which NetScaler turns on by default for VPN virtual servers). Both carry a CVSS score of 9.5 and are now on CISA's Known Exploited Vulnerabilities catalog. Fixed versions are NetScaler ADC and Gateway 14.1-73.37 and 13.1-64.23, plus 14.1-73.37 FIPS and 13.1-37.279 for the FIPS/NDcPP editions. CISA has ordered US federal agencies to patch by Wednesday, 30 September, and Shadowserver now counts more than 23,000 internet-exposed NetScaler instances still reachable — a useful sense of scale even if your business isn't bound by that federal deadline. The original report below is kept for the record; the guidance section has been updated.
Two remote-code-execution zero-days in Citrix NetScaler ADC and NetScaler Gateway appliances were actively exploited before Citrix had assigned them CVE numbers or shipped a fix. Security firm watchTowr said it found the attacks while investigating already-compromised customer environments — meaning the flaws surfaced because criminals were already using them, not because a researcher caught them in a lab first. The Dutch national cyber security centre (NCSC-NL) had quietly pre-warned organisations days earlier.
NetScaler ADC and Gateway sit at the edge of a network, handling VPN logins, load balancing, and remote access — exactly the kind of internet-facing box that attackers target first and defenders notice last. Adding to the risk: the NetScaler 13.1 branch reached end-of-maintenance on 15 September, so businesses on unsupported 13.1 builds should confirm with their IT provider whether a fix is even available to them. Because exploitation began before any fix existed, installing the patch alone will not tell you whether an attacker already got in.
What this means for your business
If your business runs a Citrix NetScaler ADC or Gateway appliance — often set up by an IT provider for VPN or remote-office access — have whoever manages it apply the patched version above this week; do not wait for a routine maintenance window. Because the attacks predate the fix, also treat the appliance as possibly already compromised: check recent access logs for unfamiliar logins and rotate any passwords or certificates tied to the device before and after patching. If the appliance cannot be patched immediately, restrict its management interface to a short list of trusted IP addresses in the meantime. If you are not sure whether your business even has a NetScaler appliance — many are installed once and forgotten — this is the week to find out.