Citrix Patches Exploited NetScaler Zero-Days

NetScaler zero-days forced Citrix into an uncomfortable weekend, one in which attackers moved faster than the company's public communications. Citrix spent most of that weekend silent while evidence of active exploitation spread through informal channels, and only on Sunday did the vendor publish a security advisory disclosing two exploited flaws, CVE-2026-88771 and CVE-2026-88772, along with patches that also address six additional defects.

Two Days of Silence, Then an Advisory

Nearly two full days had passed. That's how long it took. By the time Citrix confirmed what many defenders already suspected, the first unconfirmed rumors had been circulating for almost 48 hours, and behind the scenes multiple CERTs, advisory firms, insurance providers, researchers and individual security professionals had been warning their peers and communities about a live and serious threat. And what those warnings lacked was official confirmation from the vendor itself. They don't have it. We've seen this before.

The mechanics of the disclosure matter as much as the flaws themselves. Both critical defects carry a CVSS rating of 9.5 and allow attackers to achieve remote code execution. Researchers are especially worried about CVE-2026-88771, a command-injection vulnerability that affects all NetScaler appliances in a default configuration. That default exposure hands attackers a broad pool of targets and a better chance at successful exploitation. A proof-of-concept exploit is also publicly available.

Who Is Actually Exposed

Palo Alto Networks said it identified more than 50,000 publicly exposed instances of Citrix NetScaler devices potentially vulnerable to both NetScaler zero-days as of Sunday. GreyNoise reported the earliest known exploitation attempt on Sept. 24, an unsuccessful strike against a Citrix NetScaler Gateway the firm operates for malicious activity scanning purposes. Researchers caution that exploitation likely began before that date.

Citrix has not said how many customers have been compromised, and researchers are still assessing the fallout. The company said it is making generic indicators of compromise available to customers in their user consoles and pointed to previously issued guidance for customers who suspect compromise. Attribution remains under investigation.

The threat picture is not abstract. NetScaler products are a recurring target for financially motivated cybercriminals and state-sponsored espionage groups, which means the pool of adversaries interested in these flaws is wide and experienced.

The Information Vacuum

Ben Harris, founder and CEO at watchTowr, put the core problem plainly. "The information vacuum was most striking. Customers were receiving warnings through unofficial channels while Citrix remained publicly silent," he told CyberScoop.

Customers got nothing. No communication. No guidance. Not even a simple acknowledgement that the vulnerability they'd heard rumored was actually real, which left them completely in the dark about what was happening and what they were supposed to do next. Citrix could have warned customers that active exploitation was occurring. And they could have provided immediate defensive guidance. All of it without disclosing technical details that would help attackers, because it's possible to say a threat is real without handing over the roadmap. But they didn't.

Harris added that when active exploitation is underway, hours matter. Citrix did not directly answer questions about the lengthy communication delay. In a prepared statement, the company said it recently identified critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway that led it to immediately develop and release a new version of the software addressing the issues.

The technical response may have been swift internally, yet the public silence left customers guessing during the exact window when defensive action mattered most.

Defenders Filling the Gap

Joe Toomey is vice president of underwriting at Coalition. The insurance carrier said it notified potentially vulnerable customers using limited official data and without confirmation from CISA or Citrix, which is a detail that matters because it shows just how little the company actually knew when it decided to act. He didn't hold back. In a LinkedIn post Sunday, he called Citrix "unconscionably irresponsible" for remaining silent for more than 36 hours after word began circulating about in-the-wild exploitation. And they're still quiet.

"I fully understand a vendor embargoing specific details about a vulnerability when a patch has not yet been published, but once the vuln is exploited in the wild, some of those rules no longer apply," Toomey wrote.

Charles Carmakal, chief technology officer at Mandiant Consulting, and Wendi Whitmore, chief security intelligence officer at Palo Alto Networks, also issued direct warnings on LinkedIn Sunday about the urgent threat.

CISA added both NetScaler zero-days to its known exploited vulnerabilities catalog. That happened after Citrix publicly confirmed the attacks. The vendor has appeared on that catalog five times this year and 26 times since late 2021, a track record that speaks to how consistently its products attract determined attackers, and it's a pattern we've seen repeat. So they're a target. And you don't get on that list that often by accident.

A Familiar Pattern

Citrix and its customers have been here before. The vendor's products have been widely targeted in previous attack sprees, often involving zero-day exploits, including the campaigns infamously referred to as CitrixBleed and CitrixBleed 2.

• Both newly disclosed flaws are rated 9.5 on the CVSS scale and permit remote code execution.
• CVE-2026-88771 affects all NetScaler appliances in a default configuration and has a public proof-of-concept exploit.
• More than 50,000 publicly exposed NetScaler instances were flagged as potentially vulnerable as of Sunday.
• Citrix released patches covering the two exploited flaws plus six additional defects.

Harris argued the pattern is the real story. "Citrix has a history of delaying the publication of vulnerabilities, even when they're being exploited in the wild and affecting customers. Citrix eventually released patches and an advisory, but an adequate response also requires timely, clear communication," he said.

He added that customers shouldn't have to rely on unofficial warnings, security researchers and third parties to learn that critical infrastructure may already be compromised. And that's a problem. This latest incident raises serious questions about whether Citrix has learned from previous crises and meaningfully improved how it protects and informs customers. We've seen this before.

What Comes Next

Patches are out. The clock is ticking. Every organization running exposed NetScaler appliances is now racing against a remediation deadline that it can't ignore. CISA's catalog addition signals federal urgency, and the public proof-of-concept gives less sophisticated attackers a ready-made tool. Citrix hasn't detailed how many customers were affected. And the full scope of the damage, which may take weeks to surface as investigations continue and more victims come forward, remains unknown.

For defenders, the lesson is blunt. When NetScaler zero-days land, the gap between rumor and official word can be measured in lost time, and this weekend that gap stretched past 36 hours.