Citrix NetScaler appliances have been targeted twice in quick succession. Help Net Security reported on August 27, 2026 that CVE-2026-8452, a memory overflow Citrix patched on June 30, was being exploited after watchTowr Labs published a working proof of concept on August 14 showing it could be chained into unauthenticated remote code execution. Attackers dropped web shells named x.php and z.php. CISA added it to its Known Exploited Vulnerabilities catalog on August 26. Then on September 27, Citrix published advisory CTX697096 covering eight NetScaler ADC and Gateway flaws, two of them, CVE-2026-88771 and CVE-2026-88772, rated CVSS 9.5 and already exploited, according to Sophos. CISA added both to the catalog that day.
NetScaler Gateway commonly handles SSL VPN, Citrix virtual app access and authentication for remote staff. An appliance in that role is internet-facing by design and holds session and credential data, so a compromise there can open the internal network.
If you use NetScaler, confirm that your appliances run at least the fixed builds for CVE-2026-8452 (14.1-72.61, 13.1-63.18 or 13.1-37.272) and the updates from CTX697096. Prioritize internet-facing Gateway and AAA virtual servers. Sophos notes that patching does not remove an attacker who got in earlier, so ask your provider to check for unexpected PHP files and unusual commands, and to follow Citrix's compromise assessment guidance (CTX694799) if anything looks wrong.
The August case shows how a 'denial of service' rating can understate risk once researchers publish a chain. Patch remote-access appliances on a days-not-weeks schedule regardless of the initial score.
