Our takewatchTowr claims two unpatched RCE zero-days in Citrix NetScaler ADC/Gateway are under active exploitation; Citrix has neither confirmed nor patched. Treat as unverified for now. If you run these appliances yourself, isolate or take them offline until a fix arrives.Security Resilience desk
Sources (6)
- hackernews · hackernews
- acsc_alerts · acsc_alerts
- nvd_recent · nvd_recent
- nvd_recent · nvd_recent
- cert_eu · cert_eu
- cccs · cccs
What this means for you — Security leader:Citrix has confirmed active exploitation of two unauthenticated RCE zero-days (CVE-2026-88776 and CVE-2026-88777) in NetScaler ADC and Gateway. Patch to 14.1-73.37 or 13.1-64.23 (or the matching FIPS builds) immediately; if you cannot patch, take the appliances offline or place them behind a WAF that can block the known exploit patterns.
What this means for you — Lean IT orgs:If you run Citrix NetScaler ADC or Gateway yourself, update it to version 14.1-73.37 or 13.1-64.23 right away. These two critical remote-code-execution flaws are already being used in real attacks and there is no workaround.
What this means for you — MSP:Check every client running self-managed NetScaler ADC or Gateway and push the patches to 14.1-73.37 / 13.1-64.23 (or equivalent FIPS) immediately. Where patching is not possible, take the appliance offline or block the known exploit traffic at the edge.
What this means for you — Researcher:Citrix confirmed two unauthenticated RCE zero-days under active exploitation; patches are available but many appliances remain exposed. Worth monitoring for post-patch bypasses or additional exploit variants.