Warning: Two Unpatched Citrix NetScaler RCE Zero

Two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting Citrix NetScaler ADC and NetScaler Gateway have been publicly disclosed, allowing for remote code execution or denial-of-service. These flaws affect all deployments of the affected products, including default configurations, and were exploited in the wild prior to the release of fixes on September 27. One vulnerability allows an unauthenticated attacker to run arbitrary commands through improper input validation, while the other is a memory overflow affecting appliances with DTLS enabled. The bulletin lists six other related flaws that are not reported as exploited. Patches are available for specific NetScaler versions, urging affected customers to install them immediately.

The public disclosure, occurring after exploitation had already taken place, establishes a critical gap between threat reality and remediation timelines. The fact that both vulnerabilities affect every deployment means that default configurations are implicitly high-risk, shifting the focus from patch application to immediate forensic action and isolation for all users. The reporting structure, where fixes were released concurrently with unconfirmed reports of exploitation by external entities, introduces temporal uncertainty regarding when an attacker gained or maintained access. This situation forces a deeper consideration of organizational response protocols, as the published guidance focuses on post-compromise containment (evidence preservation, isolation, credential rotation) rather than pre-emptive defense against known RCE vectors. The existence of follow-up checks from external bodies suggests that relying solely on vendor patches is insufficient; resilience requires acknowledging that system compromise can persist even after patching and necessitates independent verification mechanisms. What are the institutional safeguards required to ensure that post-disclosure response efforts—such as those detailed by Dutch authorities—are seamlessly integrated into standard operational procedures, rather than treated as ancillary advisories?