Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekTod Beardsley

Citrix patches NetScaler flaws after active exploitation

Part of the CVE-2026-88771 story · since 27 Sep

Developinglatest 1 hour ago29 articles13 outlets
27 Sep · SecurityOnline first13 Oct18 Oct23 OctNowThis article29th of 29
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV. This article, 29th of 29.

SecurityWeek reports that in mid-September 2026 unidentified threat actors began actively exploiting undisclosed flaws in Citrix NetScaler ADC and Gateway, prompting rapid incident response from Dutch government threat analysts and private sector responders.

Over the weekend of 26 September, admins were urged to restrict or disconnect edge-facing deployments, and Citrix subsequently released patches for a batch of unauthenticated remote code execution vulnerabilities tracked as CVE-2026-88771 through CVE-2026-88778. The piece frames this as part of a broader trend: high-value, internet-facing edge devices are under sustained pressure, and rapid patching is a defining feature of the new normal in enterprise security.

The article attributes faster detection and response to improved telemetry and monitoring, enabling faster identification of zero-days and shorter exploitation windows, plus quicker vendor coordination. It notes Citrix reduced its average bug-discovery-to-CVE disclosure window from about 40 days in 2024–2025 to 17 days in 2026 for NetScaler, aided by a dedicated NetScaler CNA. It also cites CISA KEV catalog activity, suggesting potential for more Saturday, Sunday or holiday additions to KEV.

The piece points to a current gap in CVE publishing between CVE-2026-88779 and CVE-2026-88787 and advises operators to keep patch-management pipelines primed for a possible follow-on round of Citrix patches. The report underscores that attackers will continue targeting consolidated edge devices, but highlights improved collective ability to detect, coordinate, patch, and track perimeter inventory.

How the story developed

All 29 articles
Developinglatest 1 hour ago29 articles13 outlets

29 articles from 13 outlets since 27 Sep. Picked up again today after 8 days quiet. This was the 29th report, 30 days after the first.

Now27 Sep3023456720First reportSecurityOnline · 27 Sep, 18:30This article29th of 29 · day 30
  • Sun 27 Sep, 18:30 UTC. SecurityOnline, first report. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 18:30 UTC. Security Affairs, its first report on the story. Citrix NetScaler Zero Days Exploited Against Unpatched Systems. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA, its first report on the story. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 20:47 UTC. CISA. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 23:02 UTC. CISA. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SecurityWeek, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:00 UTC. SOCRadar, its first report on the story. Citrix Patches NetScaler Zero Days Exploited in Global Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 08:35 UTC. Infosecurity, its first report on the story. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 09:47 UTC. Security Affairs. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 12:07 UTC. Rapid7, its first report on the story. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 13:21 UTC. NCSC, its first report on the story. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. The Hacker News, its first report on the story. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 15:30 UTC. Unit 42, its first report on the story. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed. Cites a CVE in CISA KEV.
  • Tue 29 Sep, 08:00 UTC. SecurityOnline. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 07:13 UTC. The Hacker News. NetScaler Flaw Exploited to Gain Root Access Before Authentication. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 08:25 UTC. Security Affairs. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 10:13 UTC. The Hacker News. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells. Cites a CVE in CISA KEV.
  • Wed 30 Sep, 13:16 UTC. SecurityWeek. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 02:14 UTC. SecurityOnline. Active NetScaler Zero Days Expose Devices to Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 04:38 UTC. The Hacker News. Attackers Exploit Critical NetScaler Flaw to Steal Configurations. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 10:28 UTC. SecurityOnline. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords. Cites a CVE in CISA KEV.
  • Thu 1 Oct, 12:31 UTC. DataBreaches, its first report on the story. Citrix NetScaler Zero Days Exploited Against 50,000 Devices. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 17:05 UTC. Dark Reading, its first report on the story. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks. Cites a CVE in CISA KEV.
  • Fri 2 Oct, 22:22 UTC. SecurityOnline. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending. Cites a CVE in CISA KEV.
  • Mon 5 Oct, 05:53 UTC. SecurityWeek. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes. Cites a CVE in CISA KEV.
  • Wed 7 Oct, 15:08 UTC. SecurityOnline. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 13:24 UTC. Cloudflare, its first report on the story. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching. Cites a CVE in CISA KEV.
  • Mon 19 Oct, 17:00 UTC. Rapid7. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 11:55 UTC. SecurityWeek. Citrix patches NetScaler flaws after active exploitation. Cites a CVE in CISA KEV. This article, 29th of 29.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 29 articles as a list
  1. Sun 27 SepDay 05
    1. Citrix NetScaler Zero Days Exploited to Attack VPN Appliances18:30 · SecurityOnline · First report · Known exploited CVE
    2. Citrix NetScaler Zero Days Exploited Against Unpatched Systems18:30 · Security Affairs · Known exploited CVE
    3. CISA Flags Actively Exploited Citrix NetScaler Flaws for Urgent Action20:47 · CISA · official · CISA alert · Known exploited CVE
    Show 2 more from 27 Sep
    1. CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Zero-Days20:47 · CISA · official · Known exploited CVE
    2. CISA Warns NetScaler Flaw Is Being Exploited for Command Execution23:02 · CISA · official · Known exploited CVE
  2. Mon 28 SepDay 18
    1. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SecurityWeek · Known exploited CVE
    2. Citrix Patches NetScaler Zero Days Exploited in Global Attacks08:00 · SOCRadar · Known exploited CVE
    3. Citrix NetScaler Zero Days Exploited in Attacks, Patch Now08:35 · Infosecurity · Known exploited CVE
    Show 5 more from 28 Sep
    1. CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws09:47 · Security Affairs · Known exploited CVE
    2. Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks12:07 · Rapid7 · Known exploited CVE
    3. UK Cyber Agency Urges Action on Exploited Citrix NetScaler Flaws13:21 · NCSC · official · Known exploited CVE
    4. Hackers Exploit Citrix NetScaler Flaws as Forgotten Assets Fuel Attacks14:30 · The Hacker News · Known exploited CVE
    5. Citrix NetScaler Zero Days Exploited as 50,000 Systems Exposed15:30 · Unit 42 · Known exploited CVE
  3. Tue 29 SepDay 21
    1. Critical NetScaler Flaw Lets Attackers Run Root Commands Unauthenticated08:00 · SecurityOnline · Known exploited CVE
  4. Wed 30 SepDay 34
    1. NetScaler Flaw Exploited to Gain Root Access Before Authentication07:13 · The Hacker News · Known exploited CVE
    2. Citrix NetScaler Zero Day Gives Attackers Tunnels Into Internal Networks08:25 · Security Affairs · Known exploited CVE
    3. Attackers Exploit Citrix NetScaler Flaw to Deploy Root Web Shells10:13 · The Hacker News · Known exploited CVE
    4. Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells13:16 · SecurityWeek · Known exploited CVE
  5. Thu 1 OctDay 44
    1. Active NetScaler Zero Days Expose Devices to Remote Code Execution02:14 · SecurityOnline · Known exploited CVE
    2. Attackers Exploit Critical NetScaler Flaw to Steal Configurations04:38 · The Hacker News · Known exploited CVE
    3. Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords10:28 · SecurityOnline · Known exploited CVE
    4. Citrix NetScaler Zero Days Exploited Against 50,000 Devices12:31 · DataBreaches · Known exploited CVE
  6. Fri 2 OctDay 52
    1. Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks17:05 · Dark Reading · Known exploited CVE
    2. Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending22:22 · SecurityOnline · Known exploited CVE

  7. Quiet for 2 days

    Mon 5 OctDay 81
    1. Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes05:53 · SecurityWeek · Picked up again · Known exploited CVE

  8. Quiet for 2 days

    Wed 7 OctDay 101
    1. Four attacker groups exploited Citrix NetScaler flaw to gain privileged access15:08 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 12 days

    Mon 19 OctDay 222
    1. Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching13:24 · Cloudflare · Picked up again · Known exploited CVE
    2. Attackers chained two Citrix NetScaler flaws to gain root access and steal keys17:00 · Rapid7 · Known exploited CVE

  10. Quiet for 8 days

    Tue 27 OctDay 301
    1. Citrix patches NetScaler flaws after active exploitation11:55 · SecurityWeek · Picked up again · Known exploited CVE · This article, 29th of 29

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in