Citrix NetScaler: third actively exploited zero-day in under a week

Citrix has disclosed a third actively exploited zero-day vulnerability in its NetScaler products within less than a week, tracked as CVE-2026-88779, according to CyberScoop reporting on 5 October 2026. The flaw is an improper restriction of operations within the bounds of a memory buffer, which could allow attackers to compromise affected systems. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 4 October 2026, confirming evidence of active exploitation in the wild. Citrix has issued patches and advised customers to apply updates immediately. Security researchers noted that while Citrix responded more quickly and consistently to this latest defect compared to previous incidents, the rapid succession of three exploited zero-days in NetScaler products within such a short timeframe raises concerns about the security posture of the platform.

Why this matters for UK organisations

NetScaler appliances are widely deployed across UK organisations as application delivery controllers, load balancers and VPN gateways, often sitting at the network edge and exposed to the internet. The fact that three separate zero-day vulnerabilities have been actively exploited in quick succession suggests that NetScaler infrastructure is being targeted systematically, likely by multiple threat actors. For UK businesses, this pattern creates immediate operational risk: any organisation running NetScaler products that has not applied the latest patches is potentially exposed to compromise. The speed at which these vulnerabilities are being exploited also means that the window for defensive action is extremely narrow, and organisations that rely on monthly patching cycles may find themselves vulnerable before they realise a new flaw has been disclosed. This is particularly concerning for organisations in sectors such as finance, healthcare, legal services and critical infrastructure, where NetScaler appliances often handle authentication, remote access or sensitive application traffic.

What to review

UK businesses should review patching processes for internet-facing infrastructure, particularly where those systems handle authentication, remote access or application delivery. Consider whether your organisation can respond to emergency patches within hours rather than days, and whether you have visibility into which NetScaler versions are deployed across your estate. This is also a prompt to assess whether compensating controls such as network segmentation, monitoring or access restrictions are in place to limit the impact if an appliance is compromised before patching is complete. Organisations should also consider whether they have a clear process for identifying and prioritising emergency patches when vulnerabilities are added to the CISA KEV catalogue or when vendors issue out-of-band security updates. Where NetScaler appliances are managed by third parties or hosted service providers, ensure that patching responsibilities and timelines are clearly defined and that you have visibility into patch status.

Source: CyberScoop