CISA 2026-09-27

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

Machine-generated analysis · WAYSCloud LLM

CVE-2026-88771 and CVE-2026-88772 are critical zero-day flaws in Citrix NetScaler ADC and Gateway that enable remote code execution.

Context

The advisory concerns Citrix NetScaler ADC and Citrix NetScaler Gateway appliances. CISA reports that the two CVEs are actively exploited worldwide and can independently allow remote code execution. Updating the appliances may require downtime, so CISA advises checking for indicators of compromise before applying patches.

Operator considerations

Check: Verify which systems run Citrix NetScaler ADC or Gateway and determine their firmware versions.
Isolate: Limit network traffic to the NetScaler appliances until patches are applied.
Patch: Apply the Citrix security updates referenced in the vendor bulletin as soon as feasible.
Log: Monitor for the indicators of compromise published by Citrix in the NetScaler Console.

From Cybersecurity and Infrastructure Security Agency ↗

CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778.

CISA has added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) Catalog. Both are critical, zero-day vulnerabilities that can independently enable remote code execution. CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally.

Because updating Citrix NetScaler appliances can be complex and may require downtime, CISA is issuing this Alert to help organizations assess exposure, prioritize mitigation, and account for these vulnerabilities into their risk-management activities.

Given the potential conseq...

Read the full advisory on CISA →