What happened

Citrix has confirmed that attackers are exploiting two zero-day vulnerabilities in NetScaler ADC and NetScaler Gateway appliances. Organizations often expose these systems to the internet to provide remote access or deliver internal applications. A compromise at this network edge can therefore create a path toward other corporate systems. Citrix has released fixed versions, so this is not merely a theoretical risk or a newly discovered flaw without an available remedy. Source: Unit 42 analysis of exposed devices.

Why the story matters now

The flaws are tracked as CVE-2026-88771 and CVE-2026-88772. The first may let an unauthenticated remote attacker run commands and, according to Citrix, affects all ADC and Gateway deployments, including default configurations. The second may lead to remote code execution or denial of service when DTLS is enabled; Citrix says it is enabled by default on VPN virtual servers. Both flaws have a CVSS severity score of 9.5. Details: BleepingComputer’s security coverage.

Unit 42 says its telemetry identified 50,277 internet-exposed instances on September 27 that could potentially be vulnerable. That number needs careful interpretation: it counts visible instances that may meet the vulnerability conditions. It does not mean 50,277 confirmed vulnerable systems, companies, or successful intrusions. Unit 42 also reports that Citrix confirmed exploitation of both flaws; the extent of compromise is not yet known. Source: Unit 42 telemetry and technical summary.

What this means for companies

The first practical challenge is finding out whether the organization owns or operates an affected appliance at all. A NetScaler may be managed by an internal team, an external supplier, or a hosting provider, so checking only the main asset inventory may miss it. Updating the appliance may also require a maintenance window and affect remote connections or application availability. CyberScoop describes a gap between unofficial warnings to some administrators and the vendor’s public confirmation; those reports alone do not prove that every device was attacked. Context: CyberScoop on disclosure and administrator response.

Finding a device is only the start. Teams need to confirm its exact product, version, configuration, and internet exposure. If it may be affected, remediation and checks for earlier access should be coordinated by the appliance owner, security team, and operations lead. Unit 42 explicitly warns that an update alone may not remove an attacker who has already established another foothold in the network. Guidance: Unit 42 response recommendations.

Three practical steps

  1. Confirm ownership and versions. Ask internal teams and suppliers whether they operate NetScaler ADC or Gateway, where each appliance is located, which version it runs, and whether it is internet-facing.
  2. Plan the fix from the official bulletin. Confirm the conditions for both CVEs, install the fixed build supported for your release branch, and record any outage and remote-access recovery test.
  3. Preserve evidence if compromise is suspected. Do more than apply an update: retain available system and remote logs, review unexpected administrative sessions and outbound connections, and involve your incident-response team. Unit 42’s general checks are not confirmed indicators for this specific campaign.

Closing

This calls for an urgent check by organizations using network-edge appliances; it is not a reason to assume that every company with NetScaler has been breached. The immediate priorities are to find out whether the product is in use and to pair any update with a review for signs of possible exploitation.

Sources