Corporate governance · 5 October 2026
The box that faces the street
On 27 September Citrix confirmed two NetScaler flaws that asked for neither a user nor a password. Several administrators switched the box off before Monday.
By Rafael Núñez Aponte. Published on 5 October 2026.
Original text in Spanish. Read the original Spanish version
Some machines are not on anyone’s desk. They are at the door.
On 27 September Citrix published bulletin CTX697096. Eight flaws in NetScaler ADC and NetScaler Gateway. Two were already in use: CVE-2026-88771 and CVE-2026-88772. Both at 9.5.
No user and no password
The first runs commands without authentication. Citrix says it does not need a special configuration: the default install is enough. The second is a memory overflow. It needs DTLS, and DTLS ships on by default on VPN virtual servers.
CISA added both to the exploited-vulnerability catalog that weekend. watchTowr reported that exploitation predated the patch. SecurityWeek noted that several administrators switched the box off: Monday was already late. Network World quoted the same hurry.
Monday will be too late is not a brochure line. It is what remains when the box that faces the street has no owner on a Saturday.
What to ask on Monday
- Is there an internet-facing NetScaler, and is it below 14.1-73.37 or 13.1-64.23?
- Who can switch it off on a Sunday without asking permission on Monday?
- Was it checked for prior use, or was the patch laid on top?
- Does that box appear on the map the board sees, or only on the vendor’s?
References
- Critical vulnerabilities in Citrix NetScaler ADC and Gateway, advisory 2026-014. CERT-EU. Accessed: 2026-10-05. El 27 de septiembre de 2026 Citrix publicó el boletín CTX697096. CVE-2026-88771 es ejecución remota sin autenticación, sin precondición. CVE-2026-88772 es desborde de memoria. Citrix confirmó explotación.
- Citrix confirms two NetScaler zero-days after admins pulled the plug. SecurityWeek. Accessed: 2026-10-05. Las dos fallas tienen CVSS 9,5. CISA las incorporó al catálogo de vulnerabilidades explotadas. Varios administradores sacaron de línea el equipo.
- NetScaler admins told to patch critical zero-days in ADC and Gateway now. Network World. Accessed: 2026-10-05. Los arreglos están en 14.1-73.37 y 13.1-64.23. CVE-2026-88772 pide DTLS, activo de fábrica en servidores virtuales de VPN. watchTowr reportó explotación anterior al parche.