This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

What it is

A SecurityWeek commentary on the September 2026 Citrix NetScaler ADC and Gateway zero-days (CVE-2026-88771 through CVE-2026-88778, unauthenticated remote code execution). The author argues the response shows stronger edge defence. The page adds several operational details beyond the headline facts.

How it works

The page gives no technical mechanism for the flaws. It explains why NetScaler is targeted: one appliance acts as reverse proxy, load balancer, WAF, firewall and SSL VPN. Root on such a device gives an attacker control over how the local network talks to the outside world.

Preconditions / Affected

The page names NetScaler ADC and Gateway but gives no affected or fixed version numbers, and no indicators of compromise.

What to do

The one forward-looking action concerns the CVE sequence. The author notes that CVE IDs tend to be reserved sequentially and that CVE-2026-88779 through CVE-2026-88787 were unpublished at the time of writing. The advice is to keep patch pipelines ready for a possible second round of Citrix patches. Operators should also keep perimeter asset inventory accurate and rehearse emergency weekend patching.

Timeline and evidence cited

Exploitation began in the middle of September 2026 by unidentified actors. Dutch government threat analysts and private incident responders spotted the traffic. Over the weekend of 26 September, resellers and advisories urged admins to restrict or disconnect edge-facing deployments. Citrix released patches on Sunday 27 September. The author says CISA added two of these NetScaler CVEs to the KEV catalog on a Sunday, and that only one earlier Sunday addition existed (Microsoft SharePoint, 2025).

Caveats

The "stronger defence" conclusion is the author's opinion. The author's figures are that Citrix averaged nearly 40 days from discovery to CVE disclosure across 2024 and 2025, against 17 days for NetScaler in 2026 after it created a NetScaler CNA. The page offers no source for these figures. The expectation of more advisories rests only on the gap in reserved IDs, which is an inference, not a Citrix statement.