The Commission de Surveillance du Secteur Financier (CSSF), Luxembourg’s financial regulator, has issued an urgent alert regarding eight critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway products. Two of the flaws, CVE-2026-88771 and CVE-2026-88772, enable unauthenticated remote code execution and are currently being exploited by attackers in active campaigns.
- Affected Products: Citrix NetScaler ADC and NetScaler Gateway
- Critical CVEs: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778
- Vulnerability Types: Remote code execution, memory corruption, HTTP request smuggling, security-policy bypass, denial of service, and TCP Initial Sequence Number prediction issues
The full suite of eight vulnerabilities spans multiple attack vectors, including unauthenticated remote code execution, memory corruption, HTTP request smuggling, security-policy bypass, denial of service, and TCP Initial Sequence Number (ISN) prediction issues. CIRCL, the Computer Incident Response Center Luxembourg, has published a detailed technical report with remediation guidance available on its website.
The CSSF has mandated that all supervised financial entities take immediate action to address these exposures. The regulator stressed that unauthenticated remote code execution constitutes an unauthorised malicious access incident and must be reported as a major information and communication technology (ICT) breach under either Circular CSSF 25/893 (the Digital Operational Resilience Act framework) or Circular CSSF 24/847, depending on the entity type.
Citrix NetScaler appliances are widely deployed in financial services as load balancers, application delivery controllers, and secure gateway platforms. Given active exploitation of the two most critical vulnerabilities, patching these systems should be treated as a priority for any financial institution relying on Citrix infrastructure.
