The Cybersecurity and Infrastructure Security Agency on Sunday warned that critical zero-day vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway are facing exploitation and need to be immediately addressed.
Citrix said the exploitation is linked to a remote code execution (RCE) vulnerability due to improper input validation, tracked as CVE-2026-88771, and a memory overflow vulnerability, tracked as CVE-2026-88772.
On Saturday, security teams reported receiving urgent phone calls from IT security firms and other officials warning them to immediately disconnect their servers as the zero-day flaws were being exploited prior to any public guidance from Citrix or government authorities.
Benjamin Harris, founder and CEO of exposure management specialist watchTowr, confirmed at least one unpatched remote code execution vulnerability was under exploitation as of Saturday. Researchers said the team at the National Cyber Security Centre in the Netherlands issued warnings right before global alerts to shut down were sent out on Saturday.
“The urgency stemmed from the discovery that two previously unknown vulnerabilities were being actively exploited in the wild,” Yordan Ganchev, principal threat intelligence specialist at watchTowr, told Cybersecurity Dive. “At the time, it was unclear whether they were being chained together, but the technical details now indicate they are independent of each other.”
Expansive access
NetScaler is widely used for enterprises to authenticate and balance loads when remote users access computer networks. The platform is considered a lucrative target for hackers, and critical flaws were exploited as recently as March.
“These NetScaler vulnerabilities are exactly the kind of vulnerabilities that keep government security leaders up at night because they target the systems agencies depend on to connect users, provide services and secure access,” Adam Marre, CISO at Arctic Wolf, told Cybersecurity Dive.
CISA said Sunday that it was aware of the reports and was coordinating a response “with relevant partners.” The agency later added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog.
Shadowserver Foundation is reporting that more than 20,000 instances are exposed and potentially at risk. Researchers said there have been compromises, but those confirmed cases are not widespread.
Citrix on Sunday released a security bulletin about eight vulnerabilities, including the two zero-day flaws. The company warned the vulnerabilities varied depending on the deployment configuration and features that were enabled in the user environment. Successful exploitation could lead to a variety of impacts, including RCE, denial of service, HTTP request smuggling and others, according to the company.
Citrix said the bulletin applies only to customer-managed NetScaler ADC and NetScaler Gateway. Citrix-managed cloud services, which include Gateway Service and Adaptive Authentication, are upgraded directly by the company.
The company urged security teams to review the guidance to determine whether certain preconditions were met on NetScaler deployments before applying upgrades. For example, preconditions for CVE-2026-88772 are met only when datagram transport layer security (DTLS) is enabled on NetScaler ADC or NetScaler Gateway.
DTLS is a security protocol to make sure data is secure while being transported across networks using datagrams, according to a blog post from Huntress Labs. This means that data remains confidential in real time.
Citrix previously released guidance on what to do if Citrix NetScaler is potentially compromised. A snapshot should be taken of a compromised device if it is a virtual instance, credentials should be revoked, and the device should be isolated
