We handle all your technical problems so you can focus on growing your business.
Blue and gray Ethernet cables plugged into a numbered network patch panel.
CybersecurityPractical insight for your business.

Citrix Remote Access Under Attack: What to Ask Your IT Provider

Attackers are exploiting three flaws covered here in Citrix NetScaler, the gateway many vendors and IT providers use to deliver remote apps. How to tell if your business is affected, and why a patch alone may not be enough.

Kevin R.

13 min read

Updated

Photo by Jordan Harrison on Unsplash

The takeaway

If your team reaches work apps through a Citrix or NetScaler Gateway, ask whoever runs it which build it is on, whether it was checked for compromise before patching, and what was rotated afterward.

Attackers are exploiting three flaws covered in this article in Citrix NetScaler ADC and NetScaler Gateway, the appliances that sit at the front door of many remote-access setups. Citrix published fixes for the first two on Sunday, September 27, 2026. That day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said it had received reports and partner threat intelligence confirming that attackers were exploiting them globally (CISA). Citrix’s Saturday, October 3 bulletin requires newer builds for the third, and its Thursday, October 8 bulletin for a fourth, critical flaw raises them again.

Most 10–50 person businesses don’t own a NetScaler. But many reach a line-of-business application, a hosted desktop or a vendor portal through a Citrix Gateway that somebody else runs. The provider that runs that gateway needs to confirm its version and check for compromise.

Update: Saturday, October 10, 2026

This revision adds the October bulletins and agency guidance that had not yet appeared in the published article. Citrix has fixed a third NetScaler flaw that attackers are exploiting, and the fix needs newer builds than the ones this article first named. A fourth critical flaw, fixed on October 8, raised the builds again. The build numbers to ask for have changed, and so has the advice on checking for compromise.

  • A third exploited flaw. On Saturday, October 3, 2026, Citrix published security bulletin CTX697174 for CVE-2026-88779, a memory overflow flaw that can knock the appliance offline (a “denial of service”). Citrix says it applies only when the appliance is configured as a SAML service provider or SAML identity provider, a setup used for single sign-on. Citrix scores it 8.7 out of 10, and the bulletin’s severity details indicate an attacker doesn’t need to sign in to trigger it. CISA added it to its Known Exploited Vulnerabilities catalog on Sunday, October 4, 2026, “based on evidence of active exploitation” (CISA). CISA’s updated alert adds that, on unpatched appliances, attackers may use this flaw to force a reboot that speeds up execution of code planted earlier through CVE-2026-88771.
  • Newer fixed builds. The fix is in 14.1-73.41 and 13.1-64.28 or later, with separate FIPS and NDcPP builds listed in the new bulletin. A gateway that was updated to 14.1-73.37 or 13.1-64.23 for the September flaws is still exposed to this one if it uses SAML. Because of the October 8 bulletin described next, the simplest thing to ask for is now 14.1-73.46 or 13.1-64.29 or later, which also includes the September and October 3 fixes. As before, Citrix says the bulletin covers only customer-managed appliances, including Secure Private Access hybrid setups, and that it updates its own Citrix-managed cloud services itself.
  • A fourth critical flaw, and newer builds again. On Thursday, October 8, 2026, Citrix published bulletin CTX697191 for CVE-2026-107406, another memory overflow in SAML sign-on that Citrix says can lead to remote code execution or denial of service. Citrix rates it 9.5 out of 10. It affects appliances set up as a SAML identity provider on the builds this article recommended earlier (14.1-73.37 through 14.1-73.41, and 13.1-64.23 through 13.1-64.28), plus SAML setups on older builds. The fix is in 14.1-73.46 and 13.1-64.29 or later, with separate FIPS and NDcPP builds (14.1-73.46 FIPS and 13.1-37.283) listed in the bulletin. Citrix said that when it published the bulletin it was “not aware of any unmitigated exploits of this vulnerability,” according to BleepingComputer, and the flaw isn’t in CISA’s Known Exploited Vulnerabilities catalog as of Saturday, October 10, 2026.
  • A compromise check still matters after patching. Canada’s Cyber Centre says earlier Citrix guidance on the SAML issue warned of repeated reboots and potentially further exploitation. It also warns that an attacker who compromised an appliance through the September flaws may retain access after it is patched.
  • Observed attacks escalated after the September fixes. In its October 7 analysis, watchTowr reports that its sensors saw signs of mass exploitation on September 28, followed by backdoor deployment and attempts to steal credentials and other secrets. These are observations from its sensors, not a count of compromised customer systems. The operational lesson is to check the appliance and assess exposed secrets, even when an upgrade was installed promptly.

What changed in the advice: question 2 in the checklist below now names the builds from Citrix’s October 8 bulletin, question 3 now asks for a compromise check even if the gateway was patched quickly, and question 4 now includes the secrets stored on the appliance itself.

Agency guidance included in this revision

The following guidance was published or updated between September 27 and October 3, 2026. It was researched earlier but had not yet been added to the public article:

  • UK: The National Cyber Security Centre (NCSC) is “urging UK organisations to promptly mitigate” the flaws. Its first steps come before the update: if possible, isolate an affected appliance, for example by blocking access at an upstream firewall or limiting it to the organization’s own IP addresses, then investigate for compromise, then install the updates (NCSC).
  • Netherlands: The Dutch NCSC’s public alert tells organizations to preserve a full memory dump, a disk image and relevant logs before updating or restarting, and keep at least one month of logs outside the appliance (NCSC-NL, in Dutch). It doesn’t mention the private pre-notification described below.
  • Canada: The Canadian Centre for Cyber Security says exploitation has “been observed across multiple Citrix customer environments worldwide, although the full extent of this activity remains unknown at this time” (Cyber Centre).
  • Older versions get no fix. According to BleepingComputer, Citrix says NetScaler versions 12.1 and 13.0 have reached end of life and no longer receive security updates, so appliances on those versions need to move to a supported release. BleepingComputer reported on September 28 that Shadowserver, a nonprofit that scans the internet, was tracking more than 23,000 IP addresses with NetScaler fingerprints exposed online, though it’s unknown how many are already patched.
  • Technical details are now public. watchTowr has published a detailed technical analysis of CVE-2026-88771. Public details make it easier for more attackers to use the flaw, so an unpatched appliance is at greater risk now than when Citrix first announced it.

What happened

Citrix’s security bulletin, CTX697096, covers eight vulnerabilities. Two of them are the urgent ones:

  • CVE-2026-88771 is an improper input validation flaw. CISA says it “could allow an unauthenticated attacker to execute arbitrary commands” (CISA KEV catalog). Citrix says it affects all NetScaler ADC and Gateway deployments in their default configuration.
  • CVE-2026-88772 is a memory buffer flaw that can lead to remote code execution or denial of service. It requires DTLS, which Citrix notes is enabled by default on VPN virtual servers.

Citrix rated both 9.5 out of 10 and said, “Exploits of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments have been observed.” CISA added both to its Known Exploited Vulnerabilities catalog on September 27, listing a remediation due date of September 30 and marking both as requiring forensic triage. CERT-EU, the cybersecurity service for EU institutions, issued advisory 2026-014 the same day.

Citrix’s September 27 bulletin fixed these flaws in builds 14.1-73.37 and 13.1-64.23 or later, with separate fixed builds for FIPS and NDcPP editions listed in the bulletin. Those builds are no longer enough for a gateway that uses SAML single sign-on: a third exploited flaw, CVE-2026-88779, and a fourth critical flaw, CVE-2026-107406, mean the builds to ask for are now 14.1-73.46 or 13.1-64.29 or later (see the update above). For the two September flaws, security firm watchTowr notes that Citrix has published no workaround, “so upgrading is the only fix” (watchTowr). The UK NCSC’s temporary containment steps, such as blocking access at a firewall, reduce exposure until the upgrade is done, but they don’t fix the flaw. watchTowr also points out that appliances patched for CVE-2026-19490, an earlier NetScaler flaw that CISA added to its catalog on September 9, are still vulnerable unless they run one of the September 27 builds or later.

The warning came before the patch

Some organizations heard about this before Citrix said anything. According to watchTowr, “NetScaler administrators reported being told by suppliers and security teams to shut their appliances down, following a private pre-notification from the Dutch National Cyber Security Centre (NCSC-NL).” watchTowr publicly warned on September 26 that unpatched NetScaler flaws were being exploited.

BleepingComputer reported that NCSC-NL “reportedly sent a pre-notification to organizations in the Netherlands,” and that the agency declined to confirm it to the outlet because BleepingComputer is outside its constituency. So the exact timing and wording of those private warnings haven’t been confirmed publicly. What is confirmed is that the flaws were exploited before a fix existed.

Two days earlier, a different vendor, Kiteworks, asked its customers to turn its product off as a precaution. Two shutdown warnings in three days is a good reason to know who would get that call for your business.

How to tell if this affects you

You’re probably in scope if any of these is true:

  • Your staff sign in through a Citrix or NetScaler Gateway to reach remote apps or desktops, often using the Citrix Workspace app or a Citrix-branded web sign-in page.
  • A software vendor hosts your application (practice management, accounting, ERP, a records system) and delivers it to you through Citrix.
  • Your IT provider runs a NetScaler for you, either as a physical appliance or a virtual one in the cloud.
  • You use Citrix Secure Private Access in a hybrid setup. Citrix says those deployments are affected too.

There’s one important distinction. Citrix says the bulletin “only applies to customer-managed” NetScaler appliances. It updates its own Citrix-managed cloud services and Citrix-managed Adaptive Authentication itself. But if a vendor or IT provider runs its own NetScaler to serve you, that provider is the “customer” in Citrix’s terms, and the work is theirs to do. If you can’t tell which setup you have, that’s the first question to ask.

Why patching alone isn’t enough

When a flaw is exploited before a patch exists, updating the appliance closes the door but doesn’t tell you whether someone already walked through it. CISA’s advice is to “check for indication of compromise prior to patching,” and says organizations that suspect compromise “should preserve forensic evidence before applying updates, as updates may reduce forensic visibility.”

Citrix has made indicators of compromise available through NetScaler Console, according to CISA. watchTowr adds that Citrix warns the indicators don’t cover every technique, “so a clean result is not proof that an appliance was not compromised.”

watchTowr’s October 7 analysis makes the same point more strongly. Because the flaws were exploited before fixes existed, it says that even on a fully patched appliance “you should also assume compromise and review appliances for any anomalous behaviour that suggests prior exploitation.” It also advises capturing logs and other evidence before an appliance is restarted, patched or rebuilt, because evidence that exists only while the appliance is running is lost when it restarts.

If compromise is suspected, Citrix’s own compromise guide (CTX694799) goes well beyond patching. It tells admins to preserve evidence, take the appliance off the network, reset passwords for accounts that authenticated through it, revoke certificates and keys, examine connected servers such as authentication servers, rebuild from known-good backups, and watch for suspicious activity for 90 days.

What to ask your IT provider or vendor

You don’t need to understand NetScaler to ask good questions. Send these to whoever runs your remote access:

  1. Do we reach anything through a Citrix or NetScaler Gateway, and who manages it? Is it Citrix’s own cloud service, or an appliance that you or our vendor runs?
  2. Which build is it on now? The answer should now be 14.1-73.46 or later, 13.1-64.29 or later, or the fixed FIPS or NDcPP build listed in Citrix’s October 8 bulletin (CTX697191). Those builds fix all four flaws covered here. A gateway on an earlier build may still be exposed to the newer SAML flaws if it uses SAML single sign-on. If it’s on version 12.1 or 13.0, there is no fixed build, so ask when it will move to a supported release.
  3. Was it checked for compromise, even if it was patched quickly? Ask whether the indicator scan was run, whether evidence was preserved before patching, and on what date it was patched. The flaws were exploited before fixes existed, so a prompt patch doesn’t rule out an earlier break-in.
  4. If anything was found, or couldn’t be ruled out, what was rotated? Citrix’s compromise guide covers passwords, service account secrets and certificates, plus a review of connected systems. In watchTowr’s analysis, attackers also collected keys and credentials stored on the appliance itself, so ask about those too. CISA also advises organizations that suspect compromise to restore a known-good backup from before the compromise and rotate the secrets it contains, including local account passwords, key-encryption keys and SSL certificates.
  5. How will you tell us if you find something later? Get a name and a timeframe.

Keep the answers in writing. If your business has contractual, insurance or regulatory notice obligations, check with your counsel or insurer about what, if anything, these answers trigger.

If you aren’t sure who runs your remote-access gateway, NightSquawk Tech can help you find out as part of our free assessment.

Sources

Editorial note: This article was drafted and revised with AI assistance from the linked advisories and reporting. NightSquawk Tech did not test these vulnerabilities or observe the attacks. This revision adds previously unpublished agency guidance, the October SAML vulnerabilities and newer fixed builds, and stronger compromise-check questions. Information was last checked on October 10, 2026.