How Many Zero-Days Before Citrix Loses You?

TITLE: How Many Zero-Days Before Citrix Loses You?

Someone's phone rang last weekend. One administrator wrote that their IT supplier's security team called with orders to "shut our Netscalers down immediately." Other administrators said law enforcement, CERTs, and national cybersecurity agencies were contacting organizations too. No CVE. No patch. Just a phone tree telling admins to unplug the box between the internet and everything they run.

By September 27, Citrix confirmed two critical NetScaler remote code execution vulnerabilities—CVE-2026-88771 and CVE-2026-88772—being actively exploited. CVE-2026-88771 allows unauthenticated attackers to execute arbitrary commands with a 9.5 severity score. Every NetScaler ADC and Gateway deployment is affected, including default configurations. CVE-2026-88772 leads to remote code execution or denial of service when DTLS is enabled, and Citrix ships DTLS enabled by default.

Translation: your out-of-the-box install is the attack surface.

watchTowr flagged the exposure before a CVE existed, alerting clients on September 26, a day before Citrix's bulletin.

Three strikes since June

This isn't the year's first fire drill. In June, Citrix shipped what it called a denial-of-service bug; by August, watchTowr showed successful exploitation allows remote code execution as root on unpatched instances. That's CVE-2026-8452. Weeks later came an authentication bypass. On September 9, CVE-2026-19490 hit CISA's Known Exploited Vulnerabilities catalog with active attacks already underway on a device sitting in front of enterprise remote access—fifteen days between patch and attacks. Now: two more 9.5 critical bugs, both weaponized before patches existed.

Three critical, actively exploited NetScaler chains in four months isn't bad luck. It's a release process that ships the vulnerability and lets outside researchers find the exploit.

Shadowserver tracks over 22,000 NetScaler ADC appliances and nearly 1,800 Gateway instances exposed online.

The isolation tax

Here's what "shut it down" actually costs. NetScaler ADC and Gateway handle VPN, load balancing, and authentication for remote workers and internal apps. Taking it offline closes the door your workforce walks through daily.

And patching doesn't clear the board. Because flaws were exploited as zero-days before patches existed, shutting down or patching won't remove attackers already inside. After a prior NetScaler zero-day hit Dutch organizations, the Netherlands' National Cyber Security Centre said that updating alone didn't remove the risk—attackers kept access gained before the patch.

Your remote-access perimeter doesn't need three shutdown orders in four months to be rented out to whoever finds the bug first. Any CISO still calling NetScaler "managed and monitored" is signing off on a control they don't control.

What to watch

Whether Citrix's next earnings call names the trust problem or buries it in security-investment language. Whether large NetScaler shops start replacement RFPs—a direct gift to F5, Cloudflare, and cloud-native vendors. Whether cyber insurance renewals start asking pointed questions about NetScaler exposure. At three cycles in four months, the next KEV addition for this product line won't read as surprise. It will read as routine.