Citrix Confirms Two Unpatched Zero-Day Vulnerabilities in NetScaler Under Active Exploitation

When the "Citrix Bleed" vulnerability compromised thousands of corporate networks in late 2023, administrators at least had a patch to apply the day the flaw was announced. The two zero-day vulnerabilities Citrix confirmed on Sunday differ in one critical respect: they are already being exploited globally, and no fix currently exists. The vendor issued a security bulletin acknowledging active remote code execution (RCE) attacks against its NetScaler ADC and NetScaler Gateway appliances, stating, "We are aware of targeted attacks in the wild exploiting these vulnerabilities."[1][3]

The flaws, which currently lack formal Common Vulnerabilities and Exposures (CVE) designations but are tracked internally as CVE-2026-88771 through CVE-2026-88778, allow unauthenticated attackers to execute arbitrary code on the affected devices. While vendor communications often frame such disclosures around limited, targeted attacks, the reality of internet-facing appliance vulnerabilities is that automated scanning typically follows disclosure within hours. The capability here is total system compromise: an attacker who successfully exploits the flaw gains the ability to pivot into the internal network, bypassing the very perimeter defense the NetScaler appliance is designed to provide.[1][5]

The Cybersecurity and Infrastructure Security Agency (CISA) escalated the situation by publishing an immediate alert on September 27, 2026. "CISA urges users and administrators to review the Citrix security bulletin and apply the recommended mitigations immediately," the agency stated. This directive underscores the severity of the threat, particularly for federal agencies and critical infrastructure operators who rely heavily on NetScaler for application delivery and remote access. CISA's rapid response highlights a growing intolerance for delayed patching cycles when perimeter devices are compromised, signaling to federal civilian executive branch agencies that they must prioritize these mitigations ahead of standard maintenance windows.[2]

Because no firmware update has shipped, Citrix has provided a series of configuration changes intended to block the specific HTTP requests used in the observed exploits. Security researchers note that these mitigations, which involve applying responder policies via the command line, are temporary band-aids rather than structural fixes. Administrators must manually implement these rules across their fleets, a process that carries its own risks of misconfiguration or service disruption. In complex enterprise environments, applying global drop rules can inadvertently sever legitimate traffic, forcing network engineers to balance the immediate security threat against the risk of taking critical internal applications offline.[3][4]

The cybersecurity community has expressed frustration over the disclosure timeline and the lack of immediate CVE assignments. Independent analysts point out that releasing a critical zero-day warning on a weekend without a deployable patch forces security operations centers into emergency weekend shifts. The absence of standard CVE identifiers also complicates automated vulnerability scanning, as enterprise security tools rely on those standardized tags to flag vulnerable assets. Without a CVE to track, security teams must rely on custom scripts and manual log analysis to determine if their specific NetScaler builds are vulnerable or if they have already been compromised by the active exploit.[4][5]

The vulnerability affects multiple supported versions of the NetScaler operating system, including the 14.1, 13.1, and 13.0 branches. However, Citrix clarified that appliances configured strictly as load balancers without the gateway or authentication virtual servers enabled are not susceptible to this specific attack path. This distinction is crucial for organizations triaging their exposure, as it narrows the immediate attack surface to devices actively handling remote user access. Enterprises that only use NetScaler to distribute internal web traffic can defer the emergency mitigations, while those using it as a VPN replacement or zero-trust network access gateway must act immediately.[1][3]

NetScaler appliances hold a massive footprint in enterprise environments, with internet scanning engines routinely identifying over 80,000 exposed instances globally. Historically, vulnerabilities in these devices have been highly prized by ransomware syndicates and state-sponsored actors alike. During the 2023 Citrix Bleed campaign, threat actors compromised over 300 organizations within weeks, extracting terabytes of data before patches could be universally applied. The current zero-days present a similar, if not more severe, risk profile, given that attackers have a head start while defenders are left waiting for a compiled firmware update to secure their perimeters.[3]

The temporary mitigation requires administrators to drop specific crafted HTTP GET requests that attempt to traverse the appliance's directory structure. While Citrix's provided responder policy effectively neutralizes the current exploit chain, security researchers warn that threat actors frequently modify their payloads to bypass such pattern-matching defenses. This dynamic means the mitigation is only reliable until attackers reverse-engineer the filter and adjust their syntax. Security teams are advised to continuously monitor Citrix's support channels, as the vendor may need to update the responder policy syntax if attackers discover a way to encode or obfuscate their malicious requests to slip past the initial blocklist.[4][5]

The timeline for a permanent resolution remains undefined. Citrix has committed to notifying customers as soon as the firmware updates clear quality assurance testing and are ready for deployment. For now, the burden rests entirely on enterprise defenders to implement the manual workarounds and monitor their perimeters, hoping the temporary policies hold against an increasingly automated threat landscape. The next critical juncture will arrive when the patches are finally released, triggering a global race between administrators attempting to update their appliances and threat actors scanning for networks that failed to apply the fix in time.[1][2]