Two vulnerabilities in Citrix NetScaler application delivery controllers and Gateway devices are being actively exploited, and the Cybersecurity and Infrastructure Security Agency has ordered U.S. federal agencies to patch by Wednesday. CVE-2026-88771 and CVE-2026-88772 both carry a severity score of 9.5 out of 10, and Citrix has shipped fixes for every flaw disclosed in its latest batch. The warnings from CISA, the Netherlands and the United Kingdom give administrators a clear, time-bound checklist to close the door on a class of bugs that sits on the edge of nearly every large enterprise network.<\/p>\n
Citrix confirmed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway. Two of the eight, CVE-2026-88771 and CVE-2026-88772, are being exploited in the wild, according to Citrix. The remaining six were disclosed alongside the exploited pair. Both exploited flaws scored 9.5 on the standard 10-point severity scale. Patches are available for all eight bugs.<\/p>\n
Incident responders began flagging potential problems in NetScaler Gateway on Saturday, before government agencies in the Netherlands, the United States and the United Kingdom released formal advisories on Sunday confirming the vulnerabilities.<\/p>\n
The Cybersecurity and Infrastructure Security Agency told federal agencies to apply fixes by Wednesday and said forensic triage is required at any agency running the affected products. The agency wrote that it had received reports and partner threat intelligence confirming that threat actors are actively exploiting the vulnerabilities globally, and urged users and administrators to review Citrix’s advisories given the potential consequences of a breach.<\/p>\n
The urgency reflects where these devices sit in a network. NetScaler appliances are used by large organizations to manage traffic and authentication, which puts them in front of the applications and remote access paths employees and customers use every day.<\/p>\n
Security researchers reported that CVE-2026-88771 was being exploited before a fix was available. Some exploitation traces have been dated back to the previous Thursday, more than a day before the first public warnings. Researchers also released a tool that lets organizations check how exposed they are to the bug, giving defenders a way to measure risk while patches roll out.<\/p>\n
The weekend also raised alarm because several private security companies told customers to take their NetScaler appliances offline on Saturday before any concrete evidence of exploitation was public. That early advisory pattern, combined with later confirmed in-the-wild abuse, is what pushed the government responses.<\/p>\n
NetScaler ADC and Gateway appliances are widely deployed in large enterprise environments and act as the front door for users connecting to internal applications. Researchers have described the product family as an application delivery controller and VPN gateway appliance category found in virtually every large enterprise network on the planet. That centrality is exactly what makes a confirmed exploit attractive to attackers, since a single device often fronts thousands of users and services.<\/p>\n
Citrix NetScaler has been hit by several high-profile campaigns in recent years. Two earlier sets of bugs, known in the security community as Citrix Bleed One and Citrix Bleed Two, led to hundreds of breaches. Another Citrix NetScaler ADC vulnerability surfaced in March, which is the most recent prior incident before this month’s disclosure.<\/p>\n
Citrix published detailed guidance on what customers should do if they suspect compromise through any of the eight bugs. For the two exploited flaws, the immediate steps are: apply the Citrix patches for CVE-2026-88771 and CVE-2026-88772 without delay, run forensic triage on any appliance that was reachable from the internet during the exploitation window, and review authentication and session logs for signs of unauthorized access. Federal civilian agencies operate under the Wednesday deadline set by CISA, but the same timeline is the practical target for any organization running internet-facing NetScaler gear.<\/p>\n
Administrators who cannot apply patches immediately should consider taking affected appliances offline until fixes are installed, which matches the early advice several security firms issued over the weekend.<\/p>\n
CVE-2026-88771 and CVE-2026-88772 are the two vulnerabilities under active exploitation. Both carry a severity score of 9.5 out of 10, and Citrix has released patches for both.<\/p>\n
Citrix confirmed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway. Two of those eight are confirmed as exploited.<\/p>\n
The Cybersecurity and Infrastructure Security Agency gave federal agencies until Wednesday to patch CVE-2026-88771 and CVE-2026-88772, and said forensic triage will need to be conducted at any agency using the affected products.<\/p>\n