Citrix criticized for delaying confirmation of actively exploited NetScaler zero-days
Summary
Citrix faced criticism for taking nearly two days to confirm active exploitation of two critical NetScaler zero-days. It released patches; CISA added both flaws to its exploited-vulnerability catalog.
Key points
- Citrix confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772 nearly two days after unofficial warnings began circulating, drawing criticism from security professionals.
- Both flaws are rated 9.5 CVSS and can enable remote code execution; Citrix also released patches for six additional defects.
- CVE-2026-88771 is a command-injection flaw affecting NetScaler appliances in their default configuration, and a public proof of concept is available.
- Palo Alto Networks reported more than 50,000 publicly exposed NetScaler instances potentially vulnerable to both flaws as of Sunday.
- GreyNoise observed an unsuccessful exploitation attempt on Sept. 24; researchers said exploitation may have begun earlier. The number of compromised customers remains unknown.
- CISA added both vulnerabilities to its known exploited vulnerabilities catalog after Citrix confirmed the attacks. Citrix said it is providing generic indicators of compromise to customers and referred potentially affected customers to its existing guidance.
Article Details
- Vulnerability Types
- Command injection (CVE-2026-88771)
- Remote code execution
- Severity
- Critical; both vulnerabilities are rated 9.5 CVSS.
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
CVE
CVE-2026-88771Citrix NetScaler · ADC; Citrix NetScaler · Gatewayfor waiting nearly two days to confirm active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, even as CERTs, vendors, and researchers warned customers through unofficialCVE-2026-88772Citrix NetScaler · ADC; Citrix NetScaler · Gatewaytwo days to confirm active exploitation of two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, even as CERTs, vendors, and researchers warned customers through unofficial channels.
People
Ben HarrisFounder and CEO at watchTowr; criticized Citrix's delay in confirming active exploitation.Charles CarmakalChief technology officer at Mandiant Consulting; issued a direct warning about the threat.Joe ToomeyVice president of underwriting at Coalition; said the company notified potentially vulnerable customers.Wendi WhitmoreChief security intelligence officer at Palo Alto Networks; issued a direct warning about the threat.
Vendors
Products
NetScaler ADC“We recently identified critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway that led us to immediately develop and release a new version of the software that addresses the issues,” the companyNetScaler Gateway“We recently identified critical vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway that led us to immediately develop and release a new version of the software that addresses the issues,” the company