Global – October 17, 2026 -- Citrix confirmed on September 27 that two critical NetScaler zero-day vulnerabilities, each scoring 9.5 in severity, were exploited in the wild. According to cyber insurer Coalition, the vendor's public communications lagged the first reports by at least 36 hours.
Two flaws allow remote code execution on unpatched NetScaler appliances
CVE-2026-88771 is a critical remote code execution (RCE) flaw that lets an unauthenticated attacker run arbitrary commands. CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or a denial-of-service condition. The Citrix patch also fixes six other flaws, bringing the total to eight.
NetScaler provides remote access to internal applications and desktops and is often exposed directly to the internet, which makes it a frequent target. Enterprises across all industries use it.
Coalition warned policyholders on September 26, a day before Citrix acknowledged the flaws
Coalition alerted at-risk policyholders on September 26 after unconfirmed reports of active exploitation from reliable sources. Its honeypots recorded increased scanning for NetScaler assets, which may indicate attackers were preparing or running attacks. Coalition advised disconnecting devices from the internet where possible, restricting access where not, and patching once available.
Before Citrix said anything publicly, IT suppliers, security researchers and the Dutch National Cyber Security Center had begun contacting potentially affected organizations. Security teams gathered on Reddit awaiting confirmation from the vendor.
Coalition says Citrix's disclosure delay conflicts with its 2025 Secure by Design pledge
Citrix signed CISA's Secure by Design pledge in 2025, committing to seven measurable product-security goals. Coalition argues the pledge calls for quick disclosure, sharing of exploitation details and actionable guidance, even before a patch is ready. In its view, customers had no acknowledgment of the vulnerabilities and no confirmed scope of impact during the 36-hour window.
Coalition adds that AI is compressing the time between discovery and mass exploitation, which makes slow vendor response materially riskier.
Four NetScaler version lines need updates to close the exploited flaws
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23
- NetScaler ADC FIPS before 14.1-73.37 FIPS
- NetScaler ADC FIPS and NDcPP before 13.1-37.279
Organizations that cannot patch immediately should limit internet exposure until they can. Citrix's security bulletin covers all eight vulnerabilities and the steps to check whether an appliance meets the CVE preconditions. Generic Indicators of Compromise are available through NetScaler Console.
UK, US and Dutch agencies issued advisories on the 9.5-rated flaws
Cybersecurity agencies in the UK, the US and the Netherlands released advisories confirming the vulnerabilities. The earlier NetScaler zero-days, Citrix Bleed One and Citrix Bleed Two, led to high-profile breaches affecting critical infrastructure, healthcare entities and major companies.
Coalition has followed up with affected policyholders by email and, in some cases, through ongoing direct phone calls to confirm they know a patch is available.