Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Active Exploitation of Vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway

28 September 2026

Attackers are exploiting multiple vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway. Patch immediately.

Background

Citrix NetScaler has released security updates to address multiple vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. The vulnerabilities and their respective Common Vulnerability Scoring System (CVSS) scores are:

  • CVE-2026-88771 and CVE-2026-88772: 9.5 out of 10

  • CVE-2026-88773: 9.3 out of 10

  • CVE-2026-88774: 7.0 out of 10

  • CVE-2026-88775 to CVE-2026-88778: 8.8 out of 10

Impact

Successful exploitation could allow an unauthenticated attacker to execute arbitrary commands on affected Citrix NetScaler ADC and Citrix NetScaler Gateway appliances.

These vulnerabilities, which include improper input validation, memory overflows and inconsistent interpretation of HTTP requests, could also lead to remote code execution, denial of service, unpredictable or erroneous behaviour, HTTP request/response smuggling and a feature policy bypass.

Known Exploitation

CVE-2026-88771 and CVE-2026-88772 are reportedly being actively exploited. Google Threat Intelligence Group (GTIG) and Mandiant observed exploitation of CVE-2026-88772 in the wild since at least early September 2026.

Affected Products

These vulnerabilities affect the following products:

  • Citrix NetScaler ADC versions before 14.1-73.37

  • Citrix NetScaler ADC versions before 13.1-64.23

  • Citrix NetScaler ADC versions before 13.1.37.279 FIPS and NDcPP

  • Citrix NetScaler ADC versions before 13.1-37.279 and NDcPP

  • Citrix NetScaler Gateway versions before 14.1-73.37

  • Citrix NetScaler Gateway versions before 13.1-64.23

Users and administrators should refer to the vendor advisory for the full list of affected versions.

Indicators of Compromise

Known indicators of compromise associated with the exploitation campaign are available at: https://cloud.google.com/blog/topics/threat-intelligence/defending-against-active-exploitation-of-citrix-netscaler-adc-and-gateway-appliances (opens in new tab)

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

Organisations should also review affected or previously exposed NetScaler appliances for indicators of compromise. Where compromise is suspected or confirmed, administrators should isolate affected appliances and investigate for potential lateral movement into connected systems.

GTIG and Mandiant have also released YARA rules to assist organisations in detecting WHIPSHOT, SLAPSHOT and other malicious artefacts associated with the campaign. Users and administrators are advised to refer to the GTIG/Mandiant advisory for the YARA rules and additional hunting, containment and remediation guidance.

References