Citrix confirmed that two flaws in its NetScaler ADC and NetScaler Gateway software, tracked as CVE-2026-88771 and CVE-2026-88772, were being used by attackers before a patch existed, BleepingComputer reported on 27 September 2026 [1]. "Exploitation of CVE-2026-88771 and CVE-2026-88772 on unmitigated NetScaler deployments has been observed," Citrix said [1]. The next day, CISA ordered US federal agencies to patch or take affected appliances offline by Wednesday, 30 September, and added both flaws to its Known Exploited Vulnerabilities catalog [2] [6].
Background
NetScaler ADC and Gateway are appliances that sit at the edge of a company's network. Gateway is often the part employees see directly: the login page or VPN client a Mac connects to from home to reach work email, internal tools or file shares. A flaw in that appliance sits between a remote worker's own device and everything on the company network behind it.
Findings
According to SecurityWeek, CVE-2026-88771, rated 9.5 out of 10, lets an attacker with no credentials run commands on a default configuration, while CVE-2026-88772, also rated 9.5, is a memory-handling flaw that can crash the appliance or lead to remote code execution on systems with DTLS turned on, which Network World notes is the default for VPN connections [3] [6]. Rapid7 told customers to patch "on an emergency basis, outside of normal patching cycles," calling reliable exploitation of the first flaw likely against every vulnerable appliance [5]. Unit 42 said its own scanning found more than 50,000 NetScaler instances reachable from the internet that could be affected, and recommended organisations preserve logs and check for suspicious admin sessions before patching, in case an appliance was already compromised [4].
Implications for organisations and remote workers
This is a server-side problem: it lives in the NetScaler appliance an employer, school or other organisation runs, not in anything on a personal Mac. Nothing about a Mac's settings or software caused it, and nothing on a Mac can fix it. But for anyone whose routine includes a Citrix Gateway login page or a VPN client connecting to one from home, the security of that appliance is directly relevant: an attacker who ran commands on it before it was patched could, in principle, already be positioned inside the network being logged into [1] [4].
Recommendations
- Ask an IT or security team whether the NetScaler ADC or Gateway in use has been updated to a fixed build (14.1-73.37, 13.1-64.23 or later, per Citrix’s bulletin as reported by SecurityWeek and Network World).
- Ask whether a compromise check was run on the appliance before or after patching, as Unit 42 and Rapid7 both recommended given the flaws were exploited before a fix existed.
- If told the gateway was exposed at any point, change the password used to log into it once cleared to do so, especially if it is reused elsewhere.
- Treat any unexpected re-login or multi-factor prompt for that work VPN in the coming days as suspicious rather than routine.
- Keep macOS and the browser up to date; it will not touch this specific server-side flaw, but it closes off other doors.
Relevance to FireAI
FireAI does not touch this issue at all. NetScaler ADC and NetScaler Gateway are server-side infrastructure that a company’s IT team runs and patches; a personal Mac firewall has no visibility into that appliance and no way to fix, scan or protect it. If an employer’s gateway was not patched in time, no app on a Mac changes that.
What FireAI controls is the Mac on the other end of that connection. Per-app rules show and let a person approve exactly which apps on a Mac reach the internet and where, the world map shows where a VPN client and other apps are actually sending data, and Investigate a connection allows checking an unrecognised connection instead of guessing. None of that reaches inside a company's gateway, but it means the Mac half of a remote-work setup is not a blind spot while an IT team handles the server half.
Limitations
The sources do not say how many organisations had already been compromised before patching, only that exploitation "has been observed" on unmitigated deployments [1]. Unit 42's figure of more than 50,000 internet-reachable instances is a count of exposed appliances, not a count of confirmed compromises [4]. None of the sources gives a timeline for when the vulnerabilities were first used in attacks relative to when Citrix or researchers discovered them.
Want to see which apps on a Mac talk to the internet, and where? Download FireAI and try it free for 17 days. FireAI is made by HisnLabs.