Cloudflare Outlines Layered Defenses for NetScaler Gateways

Summary

Cloudflare recommends patching NetScaler gateways and layering access policies, WAF inspection, and origin restrictions to limit exposure to CVE-2026-88771 and CVE-2026-88772. It cautions that DTLS-enabled listeners need separate review.

Key points

Citrix’s September 27, 2026 bulletin reported observed exploitation of CVE-2026-88771, which allows unauthenticated command execution, and CVE-2026-88772, which affects DTLS configurations.
Cloudflare advises patching affected systems first, then placing an independent access decision in front of publicly reachable authentication services.
Origin restrictions are needed to prevent attackers from bypassing access policies through direct IP addresses or alternate hostnames; options include Cloudflare Tunnel, firewall restrictions, mutual TLS, and origin-side Access token validation.
A WAF can inspect requests for known CVE signatures and potentially malicious activity; Cloudflare also describes using its WAF Attack Score to identify requests that do not match known rules.
Protecting the web authentication path does not automatically secure DTLS-enabled listeners or other desktop-traffic paths, which require separate exposure review and controls.
The article recommends testing unauthenticated access, direct-origin addresses, alternate hostnames, and relevant logs, and following Citrix’s suspected-compromise guidance if a system may already be compromised.

Article Details

Defense Focus: Reduce exposure of publicly reachable authentication services and desktop gateways through access controls, web request inspection, and enforced origin restrictions; patch affected NetScaler instances.
Detection Methods: Use WAF-managed CVE signatures to identify requests matching known exploit patterns.
Use WAF Attack Score to identify potentially malicious requests that do not match a known rule; block or challenge them.
Apply live threat indicators in WAF policies to add context about known malicious sources.
Test protected hostnames, direct-origin addresses, and alternate hostnames, then review policy, firewall, and origin logs to verify that access controls cannot be bypassed.
Data Sources: HTTP requests to the protected authentication service
WAF inspection results, managed CVE signatures, and attack scores
Live threat indicators from Cloudforce One
Access policy, firewall, and origin logs
Network observations from Cloudflare's global network traffic
Rule Types: WAF rules using managed CVE signatures
WAF rules that block or challenge requests based on attack score
WAF policies that block known malicious IPs, countries, ASNs, or other selected attributes
Platforms: Cloudflare global network
Defensive Actions: Apply the Citrix updates to all affected instances and test the deployed changes.
Put an independent access decision, such as single sign-on, in front of the authentication service.
Prevent direct-origin bypasses: use an outbound-only tunnel and close inbound IP access, or restrict origin connections to account-specific egress addresses; consider mutual TLS and origin-side Access token validation.
Review exposure of separate gateway interfaces, including DTLS-enabled listeners, and apply their relevant security updates.
Extend access policies to desktop traffic where appropriate, and validate routing and policy boundaries after configuration changes.
If compromise is suspected, preserve evidence, revoke credentials and certificates, investigate connected systems, and rebuild or restore from a known-good state.