Two critical zero-day vulnerabilities in Citrix NetScaler ADC and Citrix NetScaler Gateway can be independently exploited to run code on affected appliances, and attackers are already using them in the wild. The Cybersecurity and Infrastructure Security Agency (CISA) added both flaws, tracked as CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities (KEV) Catalog after receiving reports and partner threat intelligence confirming global exploitation. Six additional flaws disclosed in the same Citrix bulletin round out an eight-vulnerability cluster admins need to address.<\/p>\n
Because Citrix NetScaler deployments often sit in front of critical applications and may need planned downtime to patch, CISA is urging organizations to assess exposure quickly, check for evidence of compromise before applying updates, and fold the new flaws into ongoing vulnerability management work.<\/p>\n
Citrix published a Security Bulletin covering CVE-2026-88771 through CVE-2026-88778, eight new flaws affecting Citrix NetScaler ADC and Citrix NetScaler Gateway. CISA singled out the first two as zero-days that are both critical and under active exploitation:<\/p>\n
CISA added both CVE-2026-88771 and CVE-2026-88772 to the KEV Catalog. The other six identifiers in the bulletin, CVE-2026-88773 through CVE-2026-88778, were disclosed in the same advisory and are part of the same cluster admins need to review.<\/p>\n
NetScaler ADC and NetScaler Gateway are commonly deployed as the public entry point for enterprise networks, including VPN and remote access paths, application delivery, and authentication. A remote code execution flaw on one of those appliances gives an attacker the ability to run commands on the perimeter device itself, which is often a high-value foothold for follow-on activity.<\/p>\n
The KEV Catalog exists to flag vulnerabilities that have evidence of active exploitation and that pose a clear risk to federal agencies and critical infrastructure. Listing a flaw in KEV also triggers remediation timelines for federal civilian agencies and signals private sector organizations to act.<\/p>\n
Independent exploitation is a key detail here. CISA’s wording indicates that each of the two KEV flaws can be used on its own, so defenders cannot treat one as the only urgent issue.<\/p>\n
CISA’s alert lays out a specific order of operations that protects forensic evidence while still moving quickly:<\/p>\n
Planning for a maintenance window is reasonable, but organizations should not delay the compromise-assessment step while waiting for that window. Knowing whether an attacker was already inside changes the urgency of the entire response.<\/p>\n
Two questions cut through the noise on these alerts: is the appliance in scope, and is there any sign it has already been touched. The first is a configuration question. Match the organization and version ranges in the Citrix bulletin against the inventory of NetScaler ADC and instances. The second is a detection question, and Citrix’s indicators of compromise and Console guidance are the place to start before pulling in third-party tooling.<\/p>\n
For teams that need a faster cross-check on which appliances may be internet-facing and unpatched, a technical audit of the perimeter can show what is actually exposed. SEOScanPro runs a comprehensive audit that surfaces externally visible configuration issues, which can be a useful sanity check alongside the Citrix-specific guidance.<\/p>\n
Patching is not the end of the work. With two KEV flaws already being exploited, post-patch monitoring for signs of persistence on any appliance that was exposed in the unpatched window is the next step. That includes reviewing authentication logs, looking for unexpected admin accounts or configuration changes, and watching outbound traffic from NetScaler appliances for connections to known malicious infrastructure.<\/p>\n
CISA added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities Catalog. Both are critical zero-day flaws in Citrix NetScaler ADC and Citrix NetScaler Gateway that can independently enable remote code execution, and CISA confirmed active exploitation globally.<\/p>\n
Yes. The Citrix Security Bulletin covers eight vulnerabilities in total: CVE-2026-88771 through CVE-2026-88778. CISA highlighted the first two for KEV listing, and the other six should be reviewed and remediated as part of the same cluster.<\/p>\n
CISA recommends reviewing the Citrix bulletin, checking the NetScaler Console for indicators of compromise, and preserving forensic evidence (logs, memory, and configuration snapshots) before applying updates, since updates can remove forensic visibility. After that, apply the Citrix-recommended updates and validate that any compromised appliances are rebuilt from a known-clean state.<\/p>\n