Critical Citrix Exploit Disrupt Dutch Hospitals and Government

Citrix confirmed on 27th September 2026 that attackers exploited two NetScaler zero-days before any fix existed, and one of them needs no login. Dutch hospitals and the national government had already cut remote access as a precaution.

The Brief

• Citrix confirmed active exploitation of CVE-2026-88771 and CVE-2026-88772 in NetScaler ADC and NetScaler Gateway and shipped fixed builds.
• CVE-2026-88771 lets an attacker run commands on the appliance without logging in, and default setups are exposed.
• Two Dutch hospitals, Amphia and Elisabeth-TweeSteden, shut off patient access to online records while care continued.
• The Dutch government disconnected all its Citrix environments from the internet, so staff working from home could not log in.
• CISA added both flaws to its exploited-vulnerabilities catalog and gave US federal agencies until 30th September, 2026 to act.

What Happened?

Hospitals, banks and other large organizations use NetScaler to spread traffic…