Citrix NetScaler flaws — how the attack unfolds.
Join free to unlock: how it works, a step-by-step setup with its costs, what you gain, and where it falls short, for every Friday idea.
The big picture
Picture the security checkpoint at a company's gate. Every visitor and member of staff passes through it, and the guard keeps a cabinet of keys to the buildings. NetScaler is that checkpoint for a company's network, and these flaws let a stranger take over the checkpoint.
NetScaler works in two roles. As a Gateway it is the company's VPN, which staff use to connect from outside. As an ADC it is a load balancer, spreading website and app traffic across the company's servers.
Where the attack goes through the company's network
The attacker comes in at the top and moves down. Red is the attack; each layer ends with the control that stops it.
Internet. Know whether the company runs its own NetScaler: only customer-managed ones are affected.
Checkpoint. NetScaler ADC or Gateway: the company's VPN and load balancer, facing the internet so staff can work from home. Takeover: NetScaler runs the hidden instructions (CVE-2026-88771 and -88772; each a zero-day, already exploited). Check for a break-in first, then update to 14.1-73.37 or 13.1-64.23 or later. The update can wipe the traces.
Keys. Keys copied: the service accounts, shared secrets, tokens, API keys and certificates stored on the box. Staff sign-ins copied: usernames and passwords of staff signing in from home. If compromised: change every key NetScaler held and the account of everyone who signed in through it.
Inside systems. Login system, website systems, IT admin computers: they trust NetScaler's keys, so the attacker signs in without breaking anything. Investigate these three for unusual sign-ins, and rebuild NetScaler rather than trust it.
The flaws: technical view
The attack, step by step
The same five steps as the hospital example in section 1, each explained in plain words. Steps 1 and 2 use the exploited flaws; steps 3 to 5 follow what Citrix tells companies to assume after a break-in.
1. Get in: the checkpoint obeys a disguised request
- What it is: NetScaler is a box, or a virtual machine, that sits at the edge of a company's network, between the internet and everything inside. Think of it as the security checkpoint at the company gate.
- What a "request" really means: when a member of staff opens the remote-access app at home, or a customer opens the company's website, their computer automatically sends NetScaler a small packet of data: who is connecting, what they want, their login details. Nobody types it; the app or browser sends it. That is all a request is: computer-to-computer traffic.
- What NetScaler does with it: it inspects each request, then either passes it to the right place inside the company or turns it away.
- Where the flaw is: Citrix says NetScaler does not inspect certain requests properly. An attacker builds a request by hand with computer instructions hidden inside it. Instead of only passing it on or turning it away, NetScaler carries out those hidden instructions itself. That is how the attacker gets control of the checkpoint.
- Why it matters: all of this happens before any login. The attacker needs no staff account, no stolen password and no inside help, only the ability to reach NetScaler, which faces the internet so staff can work from home.
- Also: a second flaw does the same through the fast connection remote staff use (DTLS), which is on unless someone switches it off.
- Not published: the exact request. Citrix and CISA withhold it so copycats cannot use it; we know what the flaw allows, not the precise trick.
- Everyday picture: a checkpoint guard who inspects every parcel at the gate. A specially packed parcel contains a hidden note, and instead of rejecting it, the guard follows the note and hands over the booth.
2. Take the keys: the checkpoint holds keys to other systems
- What it holds: to decide whether to let a member of staff in, NetScaler has to check their password with the company's login systems. To talk to those systems, it keeps its own set of passwords and keys on the box. Citrix lists them: directory service accounts, shared secrets, access tokens, API keys and certificates.
- What a "secret" really means here: not a member of staff's personal password, but NetScaler's own credentials. These are what it uses to prove to the company's other systems that it can be trusted.
- Where the flaw is: after step 1, NetScaler is carrying out the attacker's instructions. So the attacker can tell it to show them anything stored on the box, including those keys. Citrix's guide assumes exactly this: it tells any company whose NetScaler may be compromised to change every one of them.
- Why it matters: other systems inside the company trust those keys. Whoever holds them can talk to those systems as if they were NetScaler.
- Everyday picture: the checkpoint booth has a key cabinet for the buildings. Once the attacker controls the booth, they can open the cabinet and copy every key.
3. Watch the gate: staff sign-ins pass through the checkpoint
- What passes through it: every member of staff working from home signs in through NetScaler. Their username and password travel through it to be checked.
- Where the flaw is: an attacker who controls NetScaler (step 1) sits exactly where those sign-ins pass. Citrix's guide tells companies to change the account of every user who signed in through a compromised NetScaler.
- Why it matters: with a real staff account, the attacker signs in as that employee. To the IT team, the sign-in looks normal.
- Everyday picture: whoever controls the checkpoint sees every badge shown at the gate, and can copy them.
4. Move inside: the keys open the systems behind the gate
- What sits behind it: NetScaler is the gate, and inside the gate are the company's own computer systems. Outsiders cannot reach them from the internet; only traffic NetScaler lets through gets in. Three of them matter here.
- The login system: the company's master list of staff and their passwords. It decides who is allowed in.
- The systems behind the website: where the website's real work happens, such as customer accounts, orders and records.
- The IT team's admin computers: the machines IT staff use to control every other system in the company.
- Where the flaw is: the keys from step 2 and the staff accounts from step 3 work on those systems. So the attacker signs in to them as NetScaler itself, or as an employee. Citrix's guide tells companies to check exactly these systems after a compromise.
- Why it matters: a break-in at the gate becomes a break-in at the heart of the company. The attacker breaks nothing on the way in, because every door opens with a real key, so fewer alarms go off.
- Everyday picture: the keys copied at the checkpoint open the office buildings too, not just the gate.
5. Stay in: the update fixes the lock, not the copied keys
- What normally happens: when a software maker announces a flaw, the IT team installs the update, often called a patch, and considers the job done.
- What the update does: it repairs the flaw, so the hidden-instruction trick from step 1 stops working. That closes the way in for any new attacker.
- What it does not do: it does not change the keys copied in step 2 or the staff passwords taken in step 3. Those still work, because only the gate's lock was fixed, not the keys.
- What it can erase: CISA warns that updating may wipe the traces that show how the attacker got in. Without them, the company may never learn whether it was broken into.
- Why it matters: the company believes it is safe, while the attacker still holds working keys. That is why CISA says to check for a break-in before updating, and Citrix says to change every key and password if the device was compromised.
- Everyday picture: mending the broken window after a burglar has already copied your house keys. The window is fixed, but the copies still open the front door.
Why this is different from an ordinary software bug
| What the sources say | Why it matters |
|---|
| No login needed | CVE-2026-88771 works without a password, in the default setup | Every unpatched device is exposed, not just unusual setups |
| Already in use | Each was exploited as a zero-day; CISA has added both to its Known Exploited Vulnerabilities catalog | Updating now does not undo a break-in that already happened |
| It holds the keys | The device stores service passwords, tokens and certificates | One compromised device can mean changing secrets across many systems |
If you suspect a break-in, check and keep the evidence before you update. Step 5 above explains why.
The eight flaws at a glance
| Flaw | What it can allow | Affects devices that | Severity, of 10 |
|---|
| CVE-2026-88771 | Run commands without a password (exploited) | Any setup, including the default | 9.5 |
| CVE-2026-88772 | Run commands, or crash the device (exploited) | Have DTLS on, the default for remote access | 9.5 |
| CVE-2026-88773 | Slip requests past security checks, by HTTP request smuggling | Serve web traffic (HTTP or SSL) | 9.3 |
| CVE-2026-88774 | Bypass a security policy | Use policy rules based on web addresses | 7.0 |
| CVE-2026-88775 | Crash or misbehave | Act as a remote-access gateway or login server | 8.8 |
| CVE-2026-88776 | Crash or misbehave | Balance traffic to Oracle databases | 8.8 |
| CVE-2026-88777 | Crash or misbehave | Handle FTP, RTSP, DNS64 or NAT64 traffic | 8.8 |
| CVE-2026-88778 | Tamper with or disrupt connections | Handle TCP traffic with Enhanced ISN Generation off | 8.8 |
What is and is not affected
- Affected: customer-managed NetScaler ADC and Gateway 14.1 before 14.1-73.37 and 13.1 before 13.1-64.23, and the FIPS and NDcPP editions before their fixed builds.
- Also affected: Secure Private Access hybrid deployments that use NetScaler instances.
- Not affected: Citrix-managed cloud services and Citrix-managed Adaptive Authentication, which Citrix updates itself.
- The sources do not name victims or say what attackers did after getting in.