If your staff log in to work from home through a Citrix page, this one is worth five minutes of your time today.
What happened
Citrix has released fixes for two critical security flaws in NetScaler ADC and NetScaler Gateway. These are the products many businesses use to give staff secure remote access to their work systems. Citrix confirmed on 27 September that both flaws had already been exploited by attackers. The Hacker News and 4sysops both report that attacks began before any fix was available.
In plain terms:
- CVE-2026-88771 lets an attacker run commands on an affected NetScaler without logging in. The Hacker News reports it affects every deployment on an affected version, including ones left on the default settings.
- CVE-2026-88772 can let an attacker take control of the device, or knock it offline, when a feature called DTLS is turned on.
Citrix fixed six other flaws in the same release.
Why it matters for a small business
A remote access gateway sits on the internet so your team can reach it, and that makes it a front door. If an attacker gets control of it, they may be able to reach the systems behind it. Because these flaws were used before a fix existed, some devices may have been attacked before anyone could have patched them.
What to do now
- Find out if you use it. Ask your IT provider whether your business runs NetScaler ADC or NetScaler Gateway, formerly called Citrix ADC and Citrix Gateway. If staff open a Citrix login page to reach work, the answer is probably yes.
- Update straight away. Apply the fixed version Citrix has released. Do not wait for your next scheduled maintenance.
- Check, not just patch. An update closes the door, but it will not remove an attacker who is already inside. Ask your IT provider to check the device for signs of misuse.
- If you use a cloud-hosted service, ask the provider to confirm in writing that it has been updated.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.