Citrix NetScaler ADC and NetScaler Gateway are back in emergency-change-window territory. Citrix published fixes for multiple NetScaler vulnerabilities, and both Citrix and CISA now confirm active exploitation of two critical flaws: CVE-2026-88771 and CVE-2026-88772.

This is the kind of edge-device event small businesses and government contractors should treat differently from routine patching. NetScaler appliances often sit directly on the perimeter as VPN gateways, remote-access brokers, load balancers, and authentication choke points. If one is compromised, the attacker may gain an excellent position for credential theft, internal reconnaissance, web-shell style persistence, or downstream intrusion.

What happened

Citrix’s bulletin describes CVE-2026-88771 as an unauthenticated remote code execution issue caused by improper input validation. The important operational detail is scope: Citrix says the issue applies to NetScaler ADC and NetScaler Gateway deployments without requiring a special feature to be enabled.

CVE-2026-88772 is a memory overflow issue that can lead to remote code execution or denial of service when DTLS is enabled. That matters because DTLS is commonly tied to Gateway/VPN use, and Citrix notes that it is enabled by default on VPN virtual servers unless explicitly disabled.

CISA added both CVEs to the Known Exploited Vulnerabilities catalog on September 27, 2026, citing evidence of active exploitation. Citrix also states that exploitation has been observed against unmitigated deployments. The combination of edge exposure, unauthenticated attack paths, and confirmed exploitation makes this a priority-one remediation issue.

Why it matters

Perimeter appliances are attractive targets because they bridge the internet and the internal network. They may terminate VPN sessions, proxy traffic, enforce authentication policies, and handle certificates or session material. A compromised appliance can become a quiet foothold rather than a noisy endpoint alert.

For SMBs and contractors, the risk is not only “patch the box.” The risk is that exploitation may have occurred before the patch window. That means defenders should plan for both remediation and compromise assessment.

Immediate defensive priorities

  • Patch to a fixed NetScaler release immediately. Citrix lists updated versions for affected 14.1, 13.1, FIPS, and NDcPP tracks. Do not rely on WAF rules or perimeter blocking as the primary fix for an exposed appliance.
  • Identify every exposed NetScaler service. Check public DNS, load balancers, VPN portals, forgotten test appliances, disaster-recovery systems, and managed-service edge deployments.
  • Review DTLS exposure. For CVE-2026-88772, confirm whether DTLS is enabled on VPN virtual servers or other DTLS-enabled services. Disable unnecessary DTLS where it is not required.
  • Preserve and review logs before rebooting or replacing. Pull available appliance logs, authentication logs, configuration history, crash indicators, unusual process activity, outbound connections, and administrative changes.
  • Rotate credentials and secrets that passed through the gateway. If exploitation is suspected, prioritize VPN users, administrator accounts, service accounts, API keys, certificates, and session-related secrets tied to the appliance.
  • Hunt from the appliance inward. Look for unusual VPN logins, impossible travel, new internal scanning from gateway-adjacent networks, new accounts, changed policies, suspicious scheduled tasks, and unexpected connections to domain controllers, file servers, or management planes.

What government contractors should document

If your organization supports federal customers or handles controlled information, treat this as a change-control and incident-readiness exercise, not just a ticket closure. Document which appliances were in scope, their pre-patch versions, exposure status, patch time, compensating controls, evidence reviewed, credential resets performed, and whether any suspicious activity was found.

That record matters later. If a customer asks whether your remote-access edge was exposed during the active-exploitation window, a clear timeline beats a vague “we patched it.”

Bulwark Black assessment

NetScaler events keep reinforcing the same defensive lesson: internet-facing identity and remote-access infrastructure should have its own emergency playbook. These devices need faster patch lanes, stronger external asset inventory, dedicated logging, out-of-band administrative access controls, and preplanned credential-rotation procedures.

The organizations that handle this well will not be the ones that simply install the update first. They will be the ones that can answer the harder question afterward: was the appliance touched before we fixed it?

Original sources: Citrix NetScaler ADC and Gateway security bulletin CTX697096 and CISA KEV alert for CVE-2026-88771 and CVE-2026-88772.