Cybersecurity Threat Advisory: Citrix NetScaler vulnerabilities

Home / QSOL IT News / Citrix / Cybersecurity Threat Advisory: Citrix NetScaler vulnerabilities
Cybersecurity Threat Advisory

Cybersecurity Threat AdvisoryAttackers are actively exploiting two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. Citrix confirmed the vulnerabilities, CVE-2026-88771 and CVE-2026-88772, on September 27. Both flaws enable remote code execution, and attackers have used them to deploy web shells and tunneling tools.

What is the threat?

CVE-2026-88771 (CVSS 9.5) is an improper input validation vulnerability that allows unauthenticated attackers to execute arbitrary commands.

CVE-2026-88772 (CVSS 9.5) is a memory overflow vulnerability that can result in remote code execution or denial-of-service (DoS).

Researchers observed attackers using tunneling activity to route traffic from compromised NetScaler appliances into internal networks. Citrix confirmed exploitation on unpatched deployments.

Why is it noteworthy?

As of September 27, Palo Alto Networks identified more than 50,277 internet-exposed instances that may be vulnerable to these flaws. According to information shared in a Reddit thread, the Dutch National Cyber Security Centre (NCSC-NL) learned of the vulnerabilities from a European partner CERT. The agency also reported exploitation at multiple Citrix customers worldwide.

What is the exposure or risk?

CVE-2026-88771 affects all NetScaler ADC and NetScaler Gateway deployments and does not require any additional features to be enabled.

CVE-2026-88772 affects appliances with DTLS enabled. Because DTLS is enabled by default for VPN virtual servers, NetScaler Gateway deployments are at risk unless administrators have explicitly disabled DTLS.

Affected releases include:

  • NetScaler 14.1
  • NetScaler 13.1
  • NetScaler 14.1 FIPS
  • NetScaler 13.1 FIPS/NDcPP

What are the recommendations?

Barracuda recommends the following actions to reduce the risk from CVE-2026-88771 and CVE-2026-88772:

  • Install the latest fixes as soon as possible:
    • NetScaler ADC and NetScaler Gateway 14.1-73.37 or later
    • NetScaler ADC and NetScaler Gateway 13.1-64.23 or later
    • NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS or later
    • NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.279 or later
  • Review Citrix advisories and, where possible, check for signs of compromise before applying patches.
  • Investigate post-compromise activity documented by researchers and assess whether credentials or active sessions may have been exposed.

References

For more information, review the following resources:

If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.

This post originally appeared on Smarter MSP.

Related Post

Cybersecurity Threat Advisory: TrustSink attack targets Microsoft Entra

TrustSink is an attack technique that abuses Microsoft Entra ID’s federated trust model. It uses a rogue MFA provider to

account takeover, Advisory, Credential theft, cybersecurity, Cybersecurity Threat Advisory, Featured, Federated Identity, identity security, MFA, Microsoft Entra ID, multi-factor authentication, phishing, Security, Syndicated, threat, TrustSink

Tech Time Warp: How Mirai turned insecure IoT

Ten years ago, the tech world was abuzz with possibilities for the “Internet of Things” (IoT) — including bad actors.

bad actors, Botnet, Collaboration, cybersecurity, DDoS, Featured, hackers, Internet of Things, IoT, Mirai, Science, Syndicated, Tech, Tech Insight, Tech Time Warp

Will AI recommend your MSP to buyers?

Key takeaways Your prospects ask AI for a list of MSPs before they ever search Google or visit a provider’s

AEO, AI, AI search, AI visibility, Business, environment, Featured, Key takeaways, MSP, Podcasts, Prospecting, prospects, Sales & Marketing, Security, security concerns, SEO, Syndicated, Technology

The MSP guide to managing supply chain risk

In 2026, supply chain attacks have become one of the most feared threats in cybersecurity, and for good reason. When

app, Business, cyber resilience, cybersecurity, cybersecurity best practices, Featured, Managed Service Providers, Managed services, MSP security, MSPs, ransomware, Reviews, Security, supply chain attacks, supply chain risk, Syndicated, third-party risk, vendor risk management, vendors