Citrix NetScaler Flaw Under Active Attack, Researchers Say Vendor Was Slow to Communicate

Security research firm watchTowr Labs has published analysis of a pre-authentication command injection vulnerability in Citrix NetScaler, tracked as CVE-2026-88771. The firm describes it as an actively exploited remote code execution flaw that affects a default configuration, meaning organisations may be exposed without having changed any settings.

According to watchTowr, news of the issue spread widely through multiple channels before Citrix had acknowledged it. On Saturday, the firm says it worked with national and international authorities it has previously collaborated with to build confidence in the rumours, then shared that with its clients and the public. Given the active exploitation and the critical nature of many organisations that run NetScalers, its guidance was blunt: affected appliances should be taken offline, and the situation was "going to be bad."

watchTowr also criticises the lack of direct communication from Citrix, noting that customers paying for a security product would expect to hear about an exploited flaw from the vendor itself. The article provided here is only the opening of the research, so further technical detail and any fixes or mitigations are not covered in this summary. Businesses that run NetScaler should check Citrix's official channels and watchTowr's full write-up for the latest guidance.