// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalCVECVSS 9.5 / 9.3

Citrix discloses critical NetScaler zero-days after exploitation reports

SecurityWeek said unidentified actors began exploiting undisclosed NetScaler ADC and Gateway flaws in mid-September 2026; Dark Reading reported Citrix disclosed two critical NetScaler zero-days on Sep 27.

· 2 min read
AI-generated image of analysts monitoring network security screens in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • SecurityWeek said unidentified actors actively exploited undisclosed NetScaler ADC and Gateway flaws in the middle of September 2026.
  • Dark Reading reported that Citrix disclosed two critical NetScaler zero-day vulnerabilities on Sep 27 after reports of exploitation.
  • SecurityWeek said Citrix released patches for CVE-2026-88771 through CVE-2026-88778 by Sunday.

Unidentified threat actors began actively exploiting undisclosed flaws in Citrix NetScaler ADC and Gateway in the middle of September 2026, SecurityWeek said. Citrix disclosed two critical vulnerabilities on Sep 27 after reports of exploitation, Dark Reading reported.

The affected products can sit at the edge of enterprise networks as reverse proxies, load balancers, web application firewalls, traditional firewalls and SSL VPNs. HKCERT said some Citrix vulnerabilities could let a remote attacker trigger denial of service and sensitive information disclosure on a targeted system.

NetScaler is a networking product line owned by Cloud Software Group. SecurityWeek said vulnerabilities in NetScaler are frequent targets for threat actors.

On this page

What happened

SecurityWeek said resellers and security advisories urged administrators to restrict or disconnect edge-facing deployments over the weekend of Sep 26. Dutch government threat analysts and private-sector incident responders detected suspicious attack traffic.

NetScaler disclosure and response moved faster in 2026

SecurityWeek said Citrix averaged nearly 40 days from initial bug discovery to CVE disclosure across 2024 and 2025. That response window fell to 17 days for the NetScaler product line in 2026 after Citrix established a dedicated NetScaler CNA.

SecurityWeek said improved global telemetry and monitoring helped analysts identify undocumented zero-days faster than in the past. It also said active exploitation increasingly gets flagged within days when attacks use the public internet.

Citrix released patches by Sunday for a batch of unauthenticated remote code execution vulnerabilities tracked from CVE-2026-88771 through CVE-2026-88778, SecurityWeek said. Citrix said it was not aware of exploits for any of the announced vulnerabilities.

SecurityWeek said a gap remained in CVE publishing from CVE-2026-88779 through CVE-2026-88787 and recommended that NetScaler operators keep patch-management pipelines ready for possible additional Citrix patches.

What to do now

  1. Apply fixes issued by the vendor.

FAQ

What happened to Citrix NetScaler ADC and Gateway?

SecurityWeek said unidentified threat actors began actively exploiting undisclosed NetScaler ADC and Gateway flaws in the middle of September 2026. Dark Reading reported that Citrix disclosed two critical vulnerabilities on Sep 27 after reports of exploitation.

What can a remote attacker do with these Citrix vulnerabilities?

HKCERT said some Citrix vulnerabilities could let a remote attacker trigger denial of service and sensitive information disclosure on the targeted system.

How do I fix the Citrix NetScaler flaws?

SecurityWeek said Citrix released patches for vulnerabilities tracked from CVE-2026-88771 through CVE-2026-88778. HKCERT advised users to apply fixes issued by the vendor.

What is Citrix NetScaler used for?

SecurityWeek said NetScaler ADC and Gateway act as reverse proxies, load balancers, web application firewalls, traditional firewalls and SSL VPNs.

Sources

  1. Citrix Products Multiple Vulnerabilities, HKCERTPrimary
  2. This is Fine: What NetScaler Zero-Days Tell Us About the New Normal, SecurityWeek
  3. Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass, The Hacker News
  4. Citrix Patches 10 Critical NetScaler Vulnerabilities, SecurityWeek
  5. Citrix confirms two NetScaler RCE zero-days exploited in attacks, BleepingComputer
  6. Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers, Dark Reading
  7. NetScaler, Wikipedia
How we checked this story
ClaimSourceStatus
SecurityWeek said netScaler ADC and Gateway act as reverse proxies, load balancers, web application firewalls, firewalls, and SSL VPNs.SecurityWeekAttributed
SecurityWeek said unidentified threat actors began actively exploiting undisclosed NetScaler ADC and Gateway flaws in the middle of September 2026.SecurityWeekAttributed
SecurityWeek said dutch government threat analysts and private-sector incident responders detected suspicious attack traffic.SecurityWeekAttributed
SecurityWeek said citrix released patches for unauthenticated remote code execution vulnerabilities by Sunday, tracked from CVE-2026-88771 through CVE-2026-88778.SecurityWeekAttributed
SecurityWeek said improved global telemetry and monitoring helped analysts detect undocumented zero-days faster than in the past.SecurityWeekAttributed
SecurityWeek said active exploitation increasingly gets flagged within days when attacks use the public internet.SecurityWeekAttributed
SecurityWeek said citrix averaged nearly 40 days from initial bug discovery to CVE disclosure across 2024 and 2025.SecurityWeekAttributed
SecurityWeek said citrix’s NetScaler response window dropped to 17 days in 2026 after it established a dedicated NetScaler CNA.SecurityWeekAttributed
SecurityWeek said the two NetScaler issues may make Sunday, Saturday, and holiday additions to CISA’s KEV catalog more common.SecurityWeekAttributed
SecurityWeek said before this issue, exactly one CVE had been added to CISA’s KEV catalog on a Sunday, involving Microsoft SharePoint in 2025.SecurityWeekAttributed
SecurityWeek reported a gap in CVE publishing from CVE-2026-88779 through CVE-2026-88787.SecurityWeekAttributed
SecurityWeek recommended that NetScaler operators keep patch-management pipelines ready for possible additional Citrix patches.SecurityWeekAttributed
The Hacker News reported that Citrix said it was unaware of exploits for the announced vulnerabilities.Citrix, via The Hacker NewsAttributed
HKCERT said some Citrix vulnerabilities could let a remote attacker trigger denial of service or sensitive information disclosure.HKCERTConfirmed
SecurityWeek reported that Citrix patched 28 NetScaler ADC and Gateway vulnerabilities, including nine critical-severity bugs.Citrix, via SecurityWeekAttributed
SecurityWeek reported that CVE-2026-111338 exposes sensitive authentication material in a log file.SecurityWeekAttributed
SecurityWeek said NetScaler vulnerabilities are frequent targets for threat actors.SecurityWeekAttributed
Dark Reading reported that Citrix disclosed two critical NetScaler zero-day vulnerabilities on September 27 after exploitation reports caused customer alarm.Dark ReadingAttributed
NetScaler is a networking product line owned by Cloud Software Group.WikipediaConfirmed
Citrix said cVE-2026-120868 has a CVSS score of 9.3 and is a Packet Processing memory overflow vulnerability that can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed
Citrix said cVE-2026-107407 has a CVSS score of 9.3 and is an SMPP traffic memory overflow vulnerability that can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed
Citrix said cVE-2026-107408 has a CVSS score of 9.3 and is a DNS or DNS-over-HTTPS memory corruption vulnerability that can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed
Citrix said cVE-2026-107409 has a CVSS score of 9.3 and is a DNS-over-HTTPS memory corruption vulnerability that can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed
Citrix said cVE-2026-107410 has a CVSS score of 9.3 and is a NetScaler Push memory overflow vulnerability that can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed
Citrix said cVE-2026-107412 has a CVSS score of 9.5, and its multiple memory overflow vulnerabilities can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed
Citrix said cVE-2026-107415 has a CVSS score of 9.3 and is an Email OTP authentication memory overflow vulnerability that can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed
Citrix said cVE-2026-111344 has a CVSS score of 9.3 and is an Endpoint Analysis memory overflow vulnerability that can cause unpredictable behavior or denial of service.Citrix, via The Hacker NewsAttributed

Could not verify

  • How many NetScaler appliances were affected is not established
  • Whether the vulnerabilities were added to CISA’s KEV catalog is not established
  • How the attackers exploited the vulnerabilities is not established
  • Whether the eight CVEs all involved remote code execution is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok