If your business uses Citrix NetScaler ADC or NetScaler Gateway as a VPN or remote-access gateway, there’s a patch you need to apply now rather than on your normal schedule — Citrix has confirmed active exploitation of critical flaws in these products, and both the ACSC and CISA have issued urgent advisories.
What’s been confirmed
Citrix has disclosed two critical remote-code-execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, along with six related CVEs affecting NetScaler ADC and NetScaler Gateway. Citrix’s own advisory confirms active exploitation in the wild — this isn’t a theoretical risk sitting in a research paper, it’s being actively used against real, internet-facing NetScaler devices right now. Australia’s Cyber Security Centre and the US CISA have both issued advisories urging immediate patching, which is the kind of joint, fast-turnaround alert reserved for vulnerabilities being actively exploited at scale.
Why NetScaler being a remote-access gateway makes this worse
NetScaler devices are typically deployed at the edge of a network specifically to let staff connect in remotely — which means they’re internet-facing almost by design, and a flaw that allows remote code execution on one of these devices can potentially hand an attacker a foothold directly inside the network it was meant to protect. This is a materially different risk profile to a vulnerability buried in an internal application server that an attacker would first need another way in to reach.
Businesses that adopted remote access gateways to support flexible or remote work — which by now is most small and medium businesses with any staff working outside the office — are exactly the ones running this kind of appliance, often without dedicated security staff watching vendor advisories in real time.
What to do this week, not next month
1. Confirm whether your business runs NetScaler ADC or NetScaler Gateway, and if so, check the version against Citrix’s published fixed versions in its security advisory. 2. If it’s unpatched, treat this as urgent rather than routine — joint ACSC/CISA advisories for active exploitation don’t come out for low-risk issues, and the gap between “patch available” and “patch applied” is exactly where attackers are currently operating. 3. If you’re not certain whether your setup is affected, or you don’t have someone specifically responsible for tracking vendor security advisories, that uncertainty is itself worth resolving quickly rather than assuming someone else has it covered.
This is the kind of fast-moving, actively-exploited vulnerability where having someone already watching vendor advisories pays for itself. If you’d like confirmation that your specific setup is patched and configured safely rather than guessing, our cybersecurity team can check it directly.
Citrix’s security advisory with the full list of affected versions and fixes is published on its support site, and the joint urgency is echoed in independent security reporting on the advisory.
A remote-access gateway is supposed to be the locked front door to your network. Right now, for unpatched NetScaler devices, that door has a known, actively-used way to force it open.