Citrix NetScaler Zero-Days: The Shutdown Calls Arrived Before the Patches Did

Before the CVE numbers existed, the phone calls started. That tells you more about the Citrix NetScaler situation than either severity score does.

Citrix confirmed on September 27 that two NetScaler flaws, CVE-2026-88771 and CVE-2026-88772, are being exploited in the wild as zero-days. Both score 9.5. Both allow remote code execution on unauthenticated, internet-facing appliances. The security bulletin, CTX697096, ships fixes. Ordinary news so far.

But most administrators first heard about this from the wrong direction. Over the weekend, before Citrix said anything, IT suppliers, CERTs, and in some cases law enforcement began contacting organizations directly and telling them to shut their NetScalers down. One admin on Reddit quoted the call almost verbatim: the supplier’s security team gave no details, only an instruction to power off immediately. That is not how a normal disclosure cycle works. Someone upstream knew something bad and couldn’t wait for the vendor.

What the two flaws actually do

CVE-2026-88771 is an improper input validation bug. An unauthenticated attacker can execute arbitrary commands, and Citrix says it affects every NetScaler ADC and Gateway deployment, including default configurations. Nothing needs to be switched on for this one to be reachable. That is what makes it the scary half of the pair.

CVE-2026-88772 is a memory overflow that gets you code execution or a denial of service. It requires DTLS, which most people assume is an optional feature until they read the fine print: DTLS is enabled by default on VPN virtual servers. If you run NetScaler Gateway for remote access, which is precisely what most deployments of this product are for, you are exposed unless you deliberately turned it off.

NetScaler sits at the perimeter doing application delivery and remote access. Compromise it and you have a foothold at the edge of the network without ever touching an endpoint inside. For an attacker that means one box and one request. No phishing, no stolen credentials.

The warning that arrived before the patch existed

The Dutch National Cyber Security Center, NCSC-NL, reportedly sent a pre-notification to Dutch organizations describing two critical NetScaler zero-days while no CVEs had been assigned and Citrix had not published anything. Copies leaked online. The notice said one flaw let attackers place shellcode directly into memory, that Citrix found the vulnerabilities while investigating live incidents in customer environments, and that a notification had been filed under the EU Cyber Resilience Act. The agency told BleepingComputer it could not confirm the advisory to anyone outside its constituency, which is frustrating and, honestly, exactly how a national CSIRT should behave.

watchTowr then went public, saying it was “rapidly reacting to rumors” of unpatched NetScaler RCEs after checking with authoritative sources. CISA has ordered federal agencies to patch, and Citrix has now confirmed observed exploitation against unmitigated deployments. The quiet phase is over.

The part nobody enjoys: patching means downtime

The bulletin fixes eight vulnerabilities in total, six beyond the two headlines. Secure Private Access Hybrid deployments that use customer-managed NetScaler instances are affected and must move to recommended builds. Citrix-managed cloud services are being upgraded by Citrix itself, which is worth knowing before you call your host.

NCSC-NL’s stated reason for the early warning was exactly the operational problem every NetScaler owner already knows: upgrades can take the appliance down, and a surprise maintenance window on a traffic-carrying edge device is how organizations end up choosing between being patched and being available. The warning bought preparation time. That time is running out, because the technical details are now public and the agency itself predicted exploitation attempts would climb after disclosure.

If you cannot upgrade this week, pull the appliance away from the internet where operations allow, even temporarily. Restrict management access. Then schedule the real fix rather than letting the temporary measure become permanent.

What this means for African enterprises

NetScaler and its cousins sit in plenty of South African and African fintech stacks, often installed years ago by a systems integrator and forgotten by the time the contract lapses. The uncomfortable lesson from this weekend is not the CVE scores. It is that when the emergency calls start coming from suppliers and CERTs instead of from your vendor’s advisory page, someone is already inside the conversation about your perimeter, and you found out last.

At eHawu, we build network-layer protection for organizations that cannot afford to learn about a breach from a phone call. Continuous external attack-surface monitoring, configuration verification that survives integrator turnover, and a control plane that tells you what is exposed before a national CERT has to tell you too. The perimeter should be the first place you look, not the last place someone calls about.

• Inventory now: if any NetScaler ADC or Gateway appliance is internet-facing, check whether it is customer-managed or Citrix-managed.
• Read CTX697096 and map the recommended builds to your maintenance windows this week, not next month.
• Check DTLS: if you disabled it years ago on VPN virtual servers, verify the setting survived every upgrade since.
• Reduce exposure where patching must wait: management interfaces off the public internet, access restricted to known operators.