Cloudflare urges NetScaler admins to patch CVE-2026-88771 and add defense in depth

Cloudflare is telling Citrix NetScaler customers to patch first and then layer on access controls, WAF inspection and origin restrictions, after Citrix’s September 27, 2026 bulletin reported active exploitation of two flaws in the gateway. The post, published October 19 by Grant Bourzikas and Kenny Johnson, says one of them allows attackers to run commands on affected appliances without signing in.

If you run a NetScaler instance, the company’s advice is blunt: “If you’re a NetScaler customer and you haven’t patched your instance, stop reading and go do that. This was a bad one.”

What Citrix disclosed

According to Cloudflare’s account of the bulletin, CVE-2026-88771 permits unauthenticated command execution on affected appliances, including in their default configuration. CVE-2026-88772 affects setups that use Datagram Transport Layer Security (DTLS). Further advisories on October 3 and October 8 covered additional vulnerabilities in SAML configurations. Cloudflare says the exploits let attackers run arbitrary scripts on target machines and launch denial-of-service attacks.

Citrix released software updates for the flaws, and Cloudflare followed with an emergency web application firewall rule for CVE-2026-88771 on October 1. Cloudflare points readers to CISA’s alert and Mandiant’s technical investigation for exploitation details and response guidance.

Why a patch alone isn’t enough

Cloudflare argues that a patch being available does not make you safe, because every instance still has to be found, updated and tested. Rolling updates across a production deployment can cause downtime or disrupt employees who need their desktops during the process.

A WAF can buy time before a full rollout, but Cloudflare calls that approach reactive: it does not account for the next exploit. The company says AI is speeding up how quickly attackers find new variants, which is why it recommends defense in depth so that no single software failure becomes a critical security incident.

Its suggested stack combines three layers. Access policies limit who can reach the application server, WAF inspection checks web requests for attacks, and origin restrictions stop direct connections that would bypass those defenses. Cloudflare says these reduce exposure without waiting for a new exploit signature or replacing the existing desktop platform.

The company notes the same reasoning applies beyond NetScaler, to any internal application exposed to the internet, including remote desktop portals and administrative consoles. The question to ask, it says, is whether the intended audience really needs unrestricted internet reachability, and whether an attacker can bypass the authentication check to reach the server behind it.

Cloudflare’s emergency WAF rule for CVE-2026-88771 is detailed in its release note, and the full post is available on the Cloudflare blog.

Related reading

Sources

• Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities — Cloudflare Blog