Every walled city needs a gate, and the gate has to face outward. If it doesn’t, the merchants can’t get in and the city starves. Citrix NetScaler Gateway is that kind of gate. It is the login page employees pass through to reach their remote desktops, and it has to be reachable from the open Internet or nobody can start work. This autumn that requirement became the weak point. A gate that must face the street can be approached by anyone on the street.
The bulletin of 27 September
On 27 September 2026 Citrix published a bulletin reporting that two flaws were being exploited. The first, CVE-2026-88771, lets an attacker execute commands on an affected appliance without signing in, even in the default configuration. The second, CVE-2026-88772, affects setups that use Datagram Transport Layer Security, or DTLS. CISA added both to its catalogue of known exploited vulnerabilities the same day and said exploitation was happening worldwide. Further Citrix advisories followed on 3 and 8 October for weaknesses in SAML configurations. Taken together, the flaws allowed arbitrary scripts to run on target machines and also opened the way to denial-of-service attacks.
According to watchTowr, the first flaw scores 9.8 under CVSS v3.1 in the US National Vulnerability Database and 9.5 under CVSS v4.0 in Citrix’s own bulletin. The method is almost bureaucratic. The attacker plants text in the appliance’s logs, and later a routine root-level maintenance script reads that text and hands it to the shell. The flaw was a Perl script trusting its own logs.
By the time the bulletin came out, the attacks were weeks old. eSentire reported that it had seen CVE-2026-88771 exploited against Internet-facing gateways as early as 5 September, more than three weeks before disclosure. Rapid7 likewise described both flaws as exploited as zero-days. The insurer-linked firm Beazley Security wrote of emergency shutdowns. The Hacker News later described a post-exploitation payload that creates a superuser and disguises a web shell behind addresses that look like stylesheet files.
The administrator’s arithmetic
On 19 October, three weeks after the bulletin, Cloudflare published a long argument on its blog for building defences before the next flaw arrives. It opens with an order:
If you’re a NetScaler customer and you haven’t patched your instance, stop reading and go do that. This was a bad one.
Then the company describes the bind that every emergency patch puts administrators in. Patch now and risk cutting users off, or wait and stay exposed. A patch on the vendor’s website protects nobody until every instance has been found, updated and tested. Updating a production deployment can mean downtime, and the employees who still need their desktops get disrupted. Cloudflare puts it bluntly: the customers and patients who depend on those desktops do not care about anyone’s security patch.
Cloudflare shipped an emergency web application firewall rule on 1 October. A firewall rule buys time. It does not buy safety. It only recognises attacks that someone has already seen, and Cloudflare concedes that AI is speeding up how fast attackers find new variants. The company recently turned AI models against its own firewall to test exactly that.
Moving the gate
Cloudflare’s prescription is to make the access decision before any request reaches the gateway. In a typical Citrix deployment the user signs in through NetScaler Gateway. A secure ticket authority then passes the user to StoreFront, which lists the desktops and applications that user may open. The installed Citrix app then opens a separate connection over Citrix’s Independent Computing Architecture protocol, and the gateway checks the ticket before proxying the session. Cloudflare proposes putting single sign-on through its Access product in front of all of this. Citrix would still decide which desktop a user may launch and would still validate the ticket. An attacker, though, would never reach the gateway. All they would see is a Cloudflare login page.
The point is that the defence no longer depends on recognising a known exploit. It depends on deciding who should be at the gate in the first place, which is the Zero Trust idea Cloudflare says it applies to itself as “customer zero”. The company also notes a limit: this protects only the web login path. DTLS-enabled listeners and other gateway services still need their own exposure review and their own updates.
The back door
Every kingdom that has built a grand front gate has left a postern somewhere. Cloudflare warns that changing a DNS record and switching on Access is not enough. If the server still answers at its raw IP address or at another hostname, the policy is “worthless”. The company lists ways to close that gap. Cloudflare Tunnel makes only outbound connections, so the server can drop all inbound traffic and needs no public address. Where a public IP must stay, Dedicated CDN Egress IPs give an account its own source addresses, and the firewall can accept those and reject everything else. Authenticated Origin Pulls add mutual TLS between Cloudflare and the server. Best of all, Cloudflare says, the server can check the Access JSON Web Token itself: its signature, issuer, expiry and intended audience.
The firewall also stays in place and runs before the Access check. That means traffic from known malicious IP addresses, unwanted countries or particular networks can be dropped outright. It also keeps watching people who did sign in, in case they try known exploits. Alongside its signature rules, a machine-learning attack score flags suspicious requests that match no existing rule. It draws on traffic across Cloudflare’s network and on investigations by its Cloudforce One team.
A reflection on doctors and cures
The physician writing this prescription is also the pharmacist. Every remedy on the list is a Cloudflare product, and the post ends by inviting readers to speak with a Cloudflare expert. That doesn’t make the diagnosis wrong. The vendor of the gate shipped a flaw that let strangers in without a word. The administrators had to choose between their users and their safety. The patch came weeks after the intruders. All of that happened before anyone was selling the next wall.