Citrix NetScaler Flaws Under Active Attack: Patching Alone May Not Be Enough

On 27 September 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two are rated critical (CVSS 9.5) and could let an unauthenticated remote attacker run code on the device. Citrix has seen attacks against unmitigated NetScaler systems, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws (CVE-2026-88771 and CVE-2026-88772) to its Known Exploited Vulnerabilities Catalog on the same day.

The other six issues (CVE-2026-88773 through CVE-2026-88778) carry CVSS scores from 7.0 to 9.3. Exploiting them can lead to HTTP request smuggling, policy bypass, denial of service and TCP sequence number prediction.

The Sophos Counter Threat Unit recommends that organisations find all affected NetScaler ADC and Gateway instances, put internet-facing systems first, and apply Citrix security updates or mitigations as appropriate. Importantly, installing updates may not remove an attacker from an appliance that was compromised before the fix. Anyone who suspects a compromise should follow Citrix's guidance on assessment, recovery and validation. Sophos says it continues to monitor activity and will deliver detections and protections as they become available.