Cyber Security Centre warns of Citrix vulnerabilities exploited in Finland

The Finnish Transport and Communications Agency (Traficom) Cyber Security Centre has issued a serious warning regarding critical vulnerabilities in Citrix NetScaler ADC and Gateway products. These vulnerabilities have been exploited in data breaches both in Finland and internationally before official patches were released.

Security experts warn that simply installing software updates may not be sufficient to secure an organization. Because attackers utilized zero-day vulnerabilities to strike before patches were available, they may have established persistent access to systems. Organizations are advised to conduct thorough audits of system logs, administrative changes, and look for signs of unauthorized user accounts, scheduled tasks, or new services created by attackers.

The warning covers eight specific vulnerabilities (CVE-2026-88771 through CVE-2026-88778) with CVSS severity scores ranging from 7.0 to 9.5. The most severe flaw allows for remote command execution without authentication.