Citrix NetScaler Zero-Days Trigger Weekend Patching

Threat actors exploited undisclosed flaws in Citrix NetScaler ADC and Gateway in mid-September 2026, prompting Citrix to release patches for eight vulnerabilities that allowed unauthenticated remote code execution.

Organizations use NetScaler appliances as reverse proxies, load balancers, web application firewalls, firewalls and secure remote-access gateways. The devices manage traffic between corporate networks and the internet. A compromise can give attackers control over network communications and access to connected systems.

Dutch government threat analysts and private-sector incident responders detected suspicious activity in the middle of September. During the weekend of Sept. 26, resellers and security advisers urged administrators to restrict or disconnect exposed NetScaler deployments while the investigation continued.

Citrix released patches on Sunday, Sept. 27, for vulnerabilities tracked as CVE-2026-88771 through CVE-2026-88778. The flaws allowed attackers to run commands on affected systems without valid credentials.

The response followed the detection of active exploitation rather than the publication of a routine vulnerability report. Tod Beardsley, vice president of security research at runZero, reported that Citrix’s average period between initial bug discovery and CVE disclosure was nearly 40 days in 2024 and 2025. For NetScaler, the period fell to 17 days in 2026 after Citrix established a dedicated CVE Numbering Authority.

The U.S. Cybersecurity and Infrastructure Security Agency added the exploited NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog on an emergency schedule. Before the incident, only one CVE had been added to the catalog on a Sunday. That entry involved Microsoft SharePoint in 2025.

Additional advisories may follow. CVE identifiers are often reserved sequentially, and a publication gap remains between CVE-2026-88779 and CVE-2026-88787. NetScaler administrators have been advised to prepare for further Citrix updates.

NetScaler combines several perimeter-security functions on one platform. F5, Cisco, Palo Alto Networks and Juniper offer products with similar combinations of traffic-management and security controls. Consolidating these functions reduces the number of separate devices organizations operate, while placing more network traffic on a single internet-facing system.

Beardsley, a former section chief in CISA’s vulnerability-response division, recommended that organizations maintain accurate inventories of internet-facing assets and prepare emergency patching procedures. The response to the September attacks involved detecting exploitation, coordinating disclosure, issuing patches and updating public records of affected systems.