Citrix published updates for eight NetScaler vulnerabilities on 27 September 2026, including two critical remote‑code‑execution flaws that have been observed in the wild. Customers must apply vendor updates immediately; US federal agencies have a mandated patch deadline.
In a bulletin on September 27 the vendor confirmed eight new flaws in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway).
Enforcing AI Authority Before the Action Webinar 15:00 — 16:00, 8 October 2026 1 Experts Alarmed Over Gyazo's Breach of 490 Million Metadata Records News 21 September 2026 2 US:
The two most urgent are: CVE-2026-88771: a remote code execution (RCE) flaw due to improper input validation, enabling an unauthenticated attacker to execute arbitrary commands.
# What happened Citrix published a security bulletin on 27 September 2026 that fixes eight vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway. Two of the flaws are critical zero‑day remote code execution (RCE) bugs that Citrix says have been exploited on unpatched deployments.
# The two most urgent flaws
Citrix stated that exploitation of these two CVEs on unpatched NetScaler deployments has been observed.
# Other critical issue to note
# The remaining five CVEs in the bulletin
# Scope and who must act This bulletin applies to customer‑managed Citrix NetScaler ADC and Citrix NetScaler Gateway appliances. Citrix said Cloud Software Group will upgrade Citrix‑managed cloud services and Citrix‑managed Adaptive Authentication with the necessary fixes.
# External advisories and response
Before the official bulletin, third‑party researchers and some administrators reported active exploitation and took appliances offline while awaiting patches.
# Immediate actions for operators
# Context and follow‑up The report does not attribute the observed exploitation to a specific actor. Past incidents in 2025 involved a China‑linked intrusion (Salt Typhoon) targeting a Citrix zero day, but the current bulletin does not tie these new incidents to that actor. Monitor vendor advisories and agency notices for indicator updates and follow up on forensic guidance if you detect suspicious activity.
# Bottom line Two high‑severity NetScaler zero days enabling RCE have been actively exploited. Apply Citrix's published updates now, follow emergency network controls if you cannot patch immediately, and check guidance issued by national cyber agencies for required deadlines and additional mitigations.
Two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway that allow remote code execution have been exploited in the wild, Citrix confirmed on September 27. It released fixes for both, along with six other flaws. One of the two affects every deployment on an affected version, including those in the de
Citrix NetScaler administrators are confronting reports of two undisclosed remote code execution vulnerabilities allegedly exploited in real-world attacks. watchTowr said the flaws are unpatched zero-days, were identified during forensic investigations, and that Citrix communications and fixes are expected early next w
Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches expected next week. [...]
Lawrence Abrams / BleepingComputer : Citrix confirms two critical NetScaler zero-day RCE vulnerabilities are being exploited in attacks, says it has released security updates to fix the flaws — Update: Article rewritten with official confirmation from Citrix. — Citrix has confirmed that two critical NetScaler remote co
The US Cybersecurity and Infrastructure Security Agency has warned that critical zero-day vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway are facing exploitation and need to be immediately addressed. Citrix said the exploitation is linked to a remote code execution (RCE) vulnerability due to improp
Sunday NetScaler patch dump fixes trio of critical vulns and five more serious messes
Open the app view to save this story, compare related coverage, and continue from the same source.