Emerging ThreatsMalware & Ransomware

Citrix Warns of Critical Vulnerabilities Under Active Attack

Analyst 207||Source: TheRegister
Technicians in a server room examine equipment and discuss on a whiteboard.
"has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally." — Cybersecurity and Infrastructure Security Agency (CISA)

CISA confirms active exploitation and warns of patching complexity

On Sunday CISA issued an alert after receiving reports and partner intelligence indicating active, global exploitation of newly disclosed flaws in Citrix NetScaler appliances. The alert explicitly notes that updating Citrix NetScaler appliances "can be complex and may require downtime," and says the advisory is intended to help organizations "assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk‑management activities."

The vulnerabilities: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773 and five more

Citrix published a bulletin describing eight CVEs affecting NetScaler application delivery controller and gateway products. The two most severe, CVE-2026-88771 and CVE-2026-88772, carry 9.5 CVSS scores. According to Citrix, CVE-2026-88771 allows remote code execution and can permit an unauthenticated attacker to execute arbitrary commands. CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service.

A third critical bug, CVE-2026-88773, is rated 9.3 and allows HTTP request smuggling — a technique that can bypass security controls installed on front‑end servers. Three other bugs are rated 8.8 and are memory overflow issues that can make NetScaler appliances unstable. Another 8.8-rated bug involves TCP Initial Sequence Number prediction, and there is a 7.0-rated feature policy bypass tied to improper HTTP URL‑based expression usage.

Evidence of exploitation, pre-disclosure chatter, and vendor notes

Citrix says it has observed that both of the 9.5-rated vulnerabilities are already under attack. A Reddit thread contains an allegation that at least one Citrix channel partner knew of the flaws on Saturday and urged customers to take NetScalers offline a day before Citrix publicly disclosed the bulletin on Sunday. Citrix's published guidance explains how to detect whether a NetScaler needs a fix and specifies which patches to apply.

Citrix mitigations: patches and OS refreshes are available

Citrix has created operating system refreshes that contain the fixes. The company’s bulletin lists detection steps and patching guidance for administrators. CISA’s advisory frames those vendor actions inside operational realities, warning organizations that installing updates may require planned downtime and therefore must be weighed and prioritized as part of risk management.

What this means for technologists, policymakers, and affected enterprises

  • Technologists and security teams: They will need to assess exposure using Citrix’s detection guidance, prioritize either immediate patching or compensating controls, and plan for outages where OS refreshes require downtime. The bulletin and CISA’s alert together frame patching as a triage decision tied to operational windows.
  • Policymakers and regulators: CISA’s public alert underscores a role in translating vendor bulletins into actionable, risk‑prioritized guidance — particularly when updates are complex and may disrupt services.
  • Affected enterprises and procurement leaders: Organizations that operate NetScaler appliances must weigh the practical difficulty of scheduling a change window against the bulletin’s evidence that high‑severity flaws (including unauthenticated remote code execution) are being actively exploited. The record shows some users have previously chosen not to patch because of scheduling constraints, even as vendors offer compensating controls.

NetScaler’s recent record is central to this moment. Citrix’s bulletin and CISA’s alert arrive against a pattern cited by the vendor and reporting: NetScaler has repeatedly been the target of rapid exploitation after public disclosure — in March 2026, twice in 2025, and in 2023 — and flaws in NetScaler featured on the annual most‑exploited list published by the Five Eyes cybersecurity agencies from 2020 to 2023. That operational history, combined with the current active exploitation and the practical difficulty of applying OS refreshes, crystallizes the immediate choice facing organizations that run NetScaler: accept downtime to install vendor fixes now, or apply compensating controls while exposure remains live.

The concrete next steps set out by the published materials are straightforward: consult Citrix’s detection and patch guidance, prioritize installation of the OS refreshes that contain fixes, and fold the decision into formal risk‑management activity as CISA advises. Whether organizations will find the necessary change windows fast enough to blunt active exploitation remains the practical question left to operational teams.

Original story

CisaCitrixEmerging ThreatsNetscalerPatch ManagementVulnerability ManagementZero-DayCVE-2026-88771Exploitation Underway
Related Intelligence

Continue Reading

Concerned system administrators sit at consoles near computer servers and networking equipment, with a prominent…

Citrix NetScaler Zero-Days Exploited in Wild Ahead of Patches

Citrix administrators were abruptly warned to shut down their NetScaler appliances amid reports of zero-day exploits being used in the wild, with private alerts circulating before patches were available. The sudden shutdowns followed discreet notifications from IT suppliers, security teams, and law enforcement, leaving many scrambling for answers.

Analyst 207
Network equipment room with Citrix NetScaler appliance on a rack, surrounded by cables.

Citrix NetScaler Zero-Days Under Active Exploitation

Security firm watchTowr has sounded the alarm about two zero-day vulnerabilities in Citrix NetScaler appliances that are already being exploited in the wild, allowing for remote code execution. These unpatched flaws were discovered during forensic investigations and are expected to have a fix soon.

Analyst 207
People work on laptops in a modern urban internet cafe with a cityscape visible through a large window.

Lunex Stealer Exploits AMD Driver to Evade Security, Steal Browser Credentials

Meet Lunex Stealer, a sneaky malware that's rapidly spreading across 13 countries, targeting Ukrainian-speaking users with a powerful information-stealing campaign that can swipe browser credentials and more. Its operators have set up 28 unique control panels, making it a growing threat that's hard to ignore.

Analyst 207
Dimly lit server room with a single bright laptop in foreground displaying encoded URL on screen.

ShinyHunters Exploits Oracle PeopleSoft Flaw with WAF Bypass Trick

ShinyHunters attackers have cleverly found a way to bypass WAF rules by using a percent-encoding trick to exploit Oracle PeopleSoft flaws, allowing them to reach vulnerable endpoints that were thought to be protected. By encoding URL paths, they can evade common defenses and put systems at risk.

Analyst 207