{"id":12130,"date":"2026-09-29T12:02:25","date_gmt":"2026-09-29T18:02:25","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/"},"modified":"2026-11-02T07:54:22","modified_gmt":"2026-11-02T13:54:22","slug":"alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/","title":{"rendered":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Affected product(s):<\/h2>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Configuration \/ condition<\/strong><\/td><td><strong>Vulnerabilities<\/strong><\/td><\/tr><tr><td><strong>Citrix NetScaler ADC<\/strong><\/td><td>Default configuration<\/td><td>CVE\u20112026\u201188771<\/td><\/tr><tr><td><strong>Citrix NetScaler Gateway<\/strong><\/td><td>Default configuration<\/td><td>CVE\u20112026\u201188771<\/td><\/tr><tr><td><strong>Citrix NetScaler ADC<\/strong><\/td><td>DTLS enabled<\/td><td>CVE\u20112026\u201188772<\/td><\/tr><tr><td><strong>Citrix NetScaler Gateway<\/strong><\/td><td>DTLS enabled, normally enabled by default on VPN virtual servers<\/td><td>CVE\u20112026\u201188772<\/td><\/tr><tr><td><strong>NetScaler ADC \/ Gateway 12.1 and 13.0<\/strong><\/td><td>Unsupported \/ End of Life<\/td><td>No patch; requires migration to a supported release<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n<p class=\"wp-block-paragraph\">Two zero-day vulnerabilities have been published in <strong>NetScaler ADC<\/strong> and <strong>Citrix NetScaler Gateway<\/strong>: <strong>CVE\u20112026\u201188771<\/strong> <strong>(CVSSv4 9.5)<\/strong> and <strong>CVE\u20112026\u201188772 (CVSSv4 9.5)<\/strong>. Both allow unauthenticated remote attackers to achieve <strong>remote code execution (RCE)<\/strong> on vulnerable appliances; the first affects deployments with the default configuration, and the second requires <strong>DTLS<\/strong> to be enabled, a feature enabled by default on VPN virtual servers. Citrix confirmed that exploitation of <strong>CVE\u20112026\u201188771<\/strong> and <strong>CVE\u20112026\u201188772<\/strong> has been observed in unmitigated NetScaler deployments.<\/p>\n\n<p class=\"wp-block-paragraph\">The vulnerabilities are detailed below:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE\u20112026\u201188771 \u2014 Incorrect input validation \/ Pre-authentication RCE<\/strong><\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\"><strong>CVE\u20112026\u201188771<\/strong> is a remote code execution vulnerability caused by insufficient input validation (<strong>CWE\u201120<\/strong>) in NetScaler ADC and NetScaler Gateway. It has a <strong>CVSS v4.0 score of 9.5<\/strong> and affects all vulnerable deployments, even with the default configuration; it does not require enabling any additional feature.<\/p>\n\n<p class=\"wp-block-paragraph\">An unauthenticated remote attacker can send specially crafted requests to the appliance and execute arbitrary commands. The flaw requires network connectivity to the vulnerable service, but does not require credentials, user interaction, or any special configuration other than the product&#8217;s standard configuration.<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE\u20112026\u201188772 \u2014 Memory overflow \/ RCE or DoS via DTLS<\/strong><\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\"><strong>CVE\u20112026\u201188772<\/strong> is a memory overflow vulnerability (<strong>CWE\u2011119<\/strong>) that can lead to remote code execution or denial of service. It also has a <strong>CVSS v4.0 score of 9.5<\/strong>, but exposure requires <strong>DTLS to be enabled<\/strong> on NetScaler ADC or Gateway.<\/p>\n\n<p class=\"wp-block-paragraph\">DTLS is enabled by default on <strong>VPN virtual servers<\/strong>, so all appliances offering VPN access should be treated as potentially affected until the configuration is verified and the patch is applied. The attack complexity reported by Citrix is high, but active exploitation increases the urgency of remediation.<\/p>\n\n<h2 class=\"wp-block-heading\"><strong>Solution<\/strong><\/h2>\n\n<p class=\"wp-block-paragraph\">The definitive solution is to install one of the fixed versions of Citrix NetScaler:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><strong>14.1\u201173.37 or later<\/strong> for NetScaler ADC and Gateway 14.1.<\/li>\n\n\n\n<li><strong>13.1\u201164.23 or later<\/strong> for NetScaler ADC and Gateway 13.1.<\/li>\n\n\n\n<li><strong>14.1\u201173.37 FIPS or later<\/strong> for NetScaler ADC 14.1\u2011FIPS.<\/li>\n\n\n\n<li><strong>13.1\u201137.279 or later<\/strong> for NetScaler ADC 13.1\u2011FIPS and 13.1\u2011NDcPP.<\/li>\n<\/ul>\n\n<p class=\"wp-block-paragraph\">Appliances on the 12.1 and 13.0 branches must migrate to a supported release, as no security update is available for those versions.<\/p>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product \/ branch<\/strong><\/td><td><strong>Minimum fixed version<\/strong><\/td><\/tr><tr><td><strong>NetScaler ADC and NetScaler Gateway 14.1<\/strong><\/td><td>14.1\u201173.37 or later<\/td><\/tr><tr><td><strong>NetScaler ADC and NetScaler Gateway 13.1<\/strong><\/td><td>13.1\u201164.23 or later<\/td><\/tr><tr><td><strong>NetScaler ADC 14.1\u2011FIPS<\/strong><\/td><td>14.1\u201173.37 FIPS or later<\/td><\/tr><tr><td><strong>NetScaler ADC 13.1\u2011FIPS<\/strong><\/td><td>13.1\u201137.279 or later<\/td><\/tr><tr><td><strong>NetScaler ADC 13.1\u2011NDcPP<\/strong><\/td><td>13.1\u201137.279 or later<\/td><\/tr><tr><td><strong>NetScaler ADC \/ Gateway 12.1 and 13.0<\/strong><\/td><td>Migrate to a supported version; they do not receive security updates<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">Before upgrading, NetScaler recommends checking free space, backing up the configuration, validating prerequisites, and downloading the applicable firmware from the official portal. For a safe upgrade, the documentation indicates that at least <strong>7 GB of free space in \/var<\/strong> and <strong>200 MB in \/flash<\/strong> are required for a standalone appliance; pre-upgrade validations must complete without errors before the installation begins.<\/p>\n\n<p class=\"wp-block-paragraph\">For <strong>standalone<\/strong> devices, the recommended workflow is:<\/p>\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Save the current configuration with save config.<\/li>\n\n\n\n<li>Back up the \/nsconfig\/ns.conf file and confirm available space.<\/li>\n\n\n\n<li>Download and upload the firmware package corresponding to the installed branch.<\/li>\n\n\n\n<li>Run the pre-upgrade validations from <strong>System &gt; System Upgrade<\/strong> in the GUI, or .\/installns &#8211;pre_check from the CLI.<\/li>\n\n\n\n<li>Install the update and restart when prompted by the process.<\/li>\n\n\n\n<li>Confirm the installed build, the health of the appliance, the <em>virtual servers<\/em>, authentication, VPN, DTLS, load balancing, and published applications.<\/li>\n<\/ol>\n\n<p class=\"wp-block-paragraph\">For <strong>High Availability (HA)<\/strong> pairs, NetScaler recommends updating the <strong>secondary node<\/strong> first, forcing <em>failover<\/em>, and then updating the node that was previously primary. This minimizes impact and allows service continuity to be maintained during the upgrade.<\/p>\n\n<p class=\"wp-block-paragraph\">Citrix has not published a <em>workaround<\/em> that completely eliminates CVE\u20112026\u201188771 or CVE\u20112026\u201188772; upgrading to a fixed build is the only definitive remediation. Disabling DTLS may temporarily reduce exposure to CVE\u20112026\u201188772 when it does not affect operations, but it does not protect against CVE\u20112026\u201188771.<\/p>\n\n<p class=\"wp-block-paragraph\">Official links to assist with the upgrade process:<\/p>\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/support.citrix.com\/external\/article\/CTX697096\/citrix-netscaler-adc-and-citrix-netscale.html\" target=\"_blank\" rel=\"noopener\">https:\/\/support.citrix.com\/external\/article\/CTX697096\/citrix-netscaler-adc-and-citrix-netscale.html<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance.html\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance.html<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/upgrade-downgrade-before-you-begin.html\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/upgrade-downgrade-before-you-begin.html<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/upgrade-standalone-appliance.html\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/upgrade-standalone-appliance.html<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/upgrade-downgrade-ha-pair.html\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/upgrade-downgrade-ha-pair.html<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/pre-upgrade-validation-checks.html\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.netscaler.com\/en-us\/citrix-adc\/current-release\/upgrade-downgrade-citrix-adc-appliance\/pre-upgrade-validation-checks.html<\/a><\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\">Additional information:<\/h2>\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/cisa-orders-feds-to-patch-exploited-citrix-flaws-by-wednesday\/\">https:\/\/www.bleepingcomputer.com\/news\/security\/cisa-orders-feds-to-patch-exploited-citrix-flaws-by-wednesday\/<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/support.citrix.com\/external\/article\/CTX697096\/citrix-netscaler-adc-and-citrix-netscale.html\" target=\"_blank\" rel=\"noopener\">https:\/\/support.citrix.com\/external\/article\/CTX697096\/citrix-netscaler-adc-and-citrix-netscale.html<\/a><\/li>\n<\/ul>\n","protected":false},"featured_media":6299,"template":"","class_list":["post-12130","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\u20112026\u201188771 (CVSSv4 9.5) and CVE\u20112026\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix - Beacon Lab\" \/>\n\t\t<meta property=\"og:description\" content=\"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\u20112026\u201188771 (CVSSv4 9.5) and CVE\u20112026\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/01\/citrix-logo-social-1200x630-1.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/01\/citrix-logo-social-1200x630-1.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-29T18:02:25+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-02T13:54:22+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix - Beacon Lab\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\u20112026\u201188771 (CVSSv4 9.5) and CVE\u20112026\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/01\/citrix-logo-social-1200x630-1.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#listItem\",\"name\":\"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#listItem\",\"position\":2,\"name\":\"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/\",\"name\":\"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix - Beacon Lab\",\"description\":\"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\\u20112026\\u201188771 (CVSSv4 9.5) and CVE\\u20112026\\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2024\\\/01\\\/citrix-logo-social-1200x630-1.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#mainImage\",\"width\":1200,\"height\":630},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\\\/#mainImage\"},\"datePublished\":\"2026-09-29T12:02:25-06:00\",\"dateModified\":\"2026-11-02T07:54:22-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix - Beacon Lab","description":"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\u20112026\u201188771 (CVSSv4 9.5) and CVE\u20112026\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#listItem","name":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#listItem","position":2,"name":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/","name":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix - Beacon Lab","description":"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\u20112026\u201188771 (CVSSv4 9.5) and CVE\u20112026\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/01\/citrix-logo-social-1200x630-1.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#mainImage","width":1200,"height":630},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/#mainImage"},"datePublished":"2026-09-29T12:02:25-06:00","dateModified":"2026-11-02T07:54:22-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix - Beacon Lab","og:description":"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\u20112026\u201188771 (CVSSv4 9.5) and CVE\u20112026\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature","og:url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/01\/citrix-logo-social-1200x630-1.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/01\/citrix-logo-social-1200x630-1.png","og:image:width":1200,"og:image:height":630,"article:published_time":"2026-09-29T18:02:25+00:00","article:modified_time":"2026-11-02T13:54:22+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix - Beacon Lab","twitter:description":"Affected product(s): Description Two zero-day vulnerabilities have been published in NetScaler ADC and Citrix NetScaler Gateway: CVE\u20112026\u201188771 (CVSSv4 9.5) and CVE\u20112026\u201188772 (CVSSv4 9.5). Both allow unauthenticated remote attackers to achieve remote code execution (RCE) on vulnerable appliances; the first affects deployments with the default configuration, and the second requires DTLS to be enabled, a feature","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/01\/citrix-logo-social-1200x630-1.png"},"aioseo_meta_data":{"post_id":"12130","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-09 03:53:00","updated":"2026-11-02 16:30:16","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2026-110 Active exploitation of 0-day vulnerabilities in Citrix","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-110-active-exploitation-of-0-day-vulnerabilities-in-citrix\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":3,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12130\/revisions"}],"predecessor-version":[{"id":12355,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12130\/revisions\/12355"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/6299"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=12130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}