Citrix NetScaler's Critical RCE Flaw Is Already Under Attack

Citrix's fix landed on September 27 — days, maybe weeks, after attackers had already found the hole and started walking through it. Two flaws in NetScaler ADC and NetScaler Gateway, the appliances that sit at the edge of a network handling VPN logins and app traffic, let an outsider with no credentials at all run their own commands on the box.

What's Actually Broken

The headline bug is CVE-2026-88771, rated 9.5 out of 10 on the CVSS scale — the industry's standard for ranking how bad a vulnerability is, where anything above 9 is close to worst-case. It's caused by improper input validation, a fancy way of saying the software trusts data it shouldn't, letting a remote, unauthenticated attacker execute arbitrary commands. A companion flaw, CVE-2026-88772, was found alongside it. Citrix's advisory (bulletin CTX697096) actually covers eight CVEs in the same batch, running from CVE-2026-88771 through CVE-2026-88778, but these two are the ones under active attack.

What makes it worse is that it doesn't need any special configuration to be exploitable. Earlier NetScaler bugs this year required a specific feature to be switched on before an attacker could use them; this one works against a default install, straight out of the box. Since NetScaler appliances are almost always deployed facing the open internet — that's their whole job, brokering remote access and load-balancing applications — every unpatched instance is a reachable target by design.

Attackers Had a Head Start

Security researchers tracking the incident say exploitation was happening in the wild for weeks before Citrix's patch went public, which flips the usual order of things. Normally a vendor finds a bug, quietly builds a fix, and only then tells the world — giving defenders a chance to patch before anyone else knows the flaw exists. Here, attackers apparently found it first.

"Based on public reporting, it has not been determined whether exploitation has reached widespread scale," said Satnam Narang, senior staff research engineer at Tenable.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88771 to its Known Exploited Vulnerabilities catalog — a running list of bugs confirmed to be actively used in real attacks — within hours of the patch shipping, and gave U.S. federal agencies until September 30 to fix it. CISA's advisory also told organizations to check for signs they'd already been compromised and preserve forensic evidence before applying the update, on the assumption that some boxes were breached before the patch existed.

Why Indian Organizations Should Care

NetScaler — Citrix rebranded its ADC line under this name a few years back — is a fixture in Indian enterprise IT. Banks, insurers, IT services firms and large enterprises running hybrid work setups lean on it for exactly the two jobs this flaw touches: VPN gateways for remote staff and traffic management for customer-facing applications. A similar story played out with F5's BIG-IP gateway just last week — another edge appliance, another unauthenticated RCE, another scramble to patch before attackers finished what they started. The pattern is becoming familiar enough that Indian IT and security teams should treat any advisory involving a VPN gateway or load balancer as urgent by default, rather than waiting to see if it gets loud enough to notice.

India doesn't have a CISA-style binding deadline — CERT-In, the country's nodal cybersecurity agency, issues advisories but leaves the patching timeline to each organization. That gap matters here: without a hard deadline forcing the issue, a NetScaler box sitting unpatched at the edge of a bank's network or an e-commerce platform's infrastructure can stay exposed for weeks past when a fix was available, which is exactly the window attackers are counting on.

What To Do About It

• Identify every NetScaler ADC and Gateway instance in your environment — including ones spun up for testing or by teams outside central IT.
• Apply Citrix's September 27 patches immediately; this isn't a bug worth waiting for the next maintenance window.
• Check logs for signs of compromise predating the patch, since researchers say exploitation was underway before the fix shipped.
• If immediate patching isn't possible, restrict access to management interfaces and monitor for unusual outbound connections from the appliance.

The bigger issue isn't Citrix specifically — it's that the boxes organizations buy to keep attackers out keep turning into the easiest way in. A VPN gateway or load balancer sits at the one spot in a network where a single working exploit can undo every other security control behind it, which is exactly why they keep showing up first on attackers' target lists, not last.