If you manage any Citrix NetScaler (Citrix ADC) appliances, a quick alert: two critical remote code execution flaws are being exploited in the wild, and patches are available now. Here’s what happened and what you can do today to stay safe.
What happened
Citrix disclosed two critical remote code execution vulnerabilities in NetScaler/ADC devices (CVE-2026-88771 and CVE-2026-88772). Reports indicate attackers are actively exploiting these flaws to gain control of affected systems. Citrix has released security updates, and security researchers are tracking related activity. Details may evolve as responders assess scope and impact.
Why it matters
NetScaler/ADC appliances are often exposed to the internet to support remote access and application delivery. A successful RCE can give attackers full control, enabling data theft, malware deployment, or disruption of services. Small businesses and creators who rely on secure remote access or hosted apps are especially at risk if patches aren’t applied quickly.
Practical steps you can take
- Identify any Citrix ADC/NetScaler appliances exposed to the internet. Coordinate with your network team or hosting provider to locate devices.
- Check your Citrix product version and apply the latest security updates that address CVE-2026-88771 and CVE-2026-88772. If you’re unsure which patch to apply, contact Citrix Support.
- If patching isn’t immediately possible, apply mitigations:
- Limit exposure: restrict access to trusted networks, require VPN for administration, and disable unnecessary services.
- Enable or strengthen web application firewall (WAF) rules around the affected endpoints.
- Monitor logs for signs of compromise (unusual admin activity, new user accounts, strange outbound connections).
- Plan a short downtime window to apply updates in a controlled manner, with a rollback plan.
- Review credential hygiene: rotate admin or service accounts if there’s concern about exposure.
- Document lessons learned and share with your security team or MSP to improve future patch management.
Final thought
Keeping internet-facing appliances up to date is a core safety practice, not a checkbox. Regularly check vendor advisories and maintain a reliable patching process. If you’d like, set up security advisories or reminders to review updates on a regular cadence.