Citrix has published a bulletin covering eight CVEs in its NetScaler application delivery controller and gateway products, with three rated critical. The most severe, CVE-2026-88771 and CVE-2026-88772, both score 9.5 on the CVSS scale. The first enables unauthenticated remote code execution, while the second is a memory overflow that can lead to code execution or denial of service. A third critical flaw, CVE-2026-88773, rated 9.3, allows HTTP request smuggling, a technique that can bypass security controls on front-end servers.
Citrix has observed both 9.5-rated vulnerabilities being actively exploited, and the US Cybersecurity and Infrastructure Security Agency issued a Sunday alert confirming reports of global exploitation. CISA noted that patching NetScaler can be complex and require downtime, so it published guidance to help organizations assess exposure and prioritize mitigation. The remaining five CVEs include three 8.8-rated memory overflow bugs, an 8.8-rated TCP Initial Sequence Number prediction issue, and a 7.0-rated policy bypass.
A Reddit thread alleges that at least one Citrix channel partner knew of the flaws on Saturday and urged users to take NetScalers offline a day before Citrix's disclosure. The Register notes that NetScaler has a long history of critical vulnerabilities under attack, including incidents in 2023, 2025, and March 2026, and that some users still delay patching despite the product being a frequent target. Citrix has provided detection guidance and OS refreshes containing fixes.