CISA says threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. The agency added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog and says both can independently enable remote code execution.[1] [2]
The alert covers eight vulnerabilities in total, CVE-2026-88771 through CVE-2026-88778. CISA says the exploitation is occurring globally and urges organizations to review Citrix’s advisories, assess exposure, and account for the vulnerabilities in risk-management activities.[1]
Why the response is more than patching
Citrix appliances often sit at the edge of an organization’s network and may provide access to remote users or applications. A successful compromise can therefore create an entry point with consequences beyond the appliance itself.
CISA notes that updating NetScaler can be complex and may require downtime. It encourages administrators, where possible, to check for indicators of compromise before patching. If compromise is suspected, organizations should preserve forensic evidence before applying updates because the update process may reduce visibility into what happened.[1]
CISA also points organizations to Citrix indicators of compromise and a SIGMA detection rule resource. The alert does not provide a universal checklist that replaces vendor guidance; the appropriate commands, logs, and mitigations depend on the appliance version and deployment.[1]
Recommended enterprise sequence
First, identify every NetScaler ADC and Gateway instance, its exposure, version, management path, and business owner. Include appliances managed by subsidiaries, service providers, and disaster-recovery environments.
Second, obtain the current Citrix security bulletin and determine the required mitigation or update. Third, review relevant logs and indicators before making changes when the environment permits. Fourth, patch or apply the vendor-approved mitigation and validate that external access, authentication, and application delivery still work.
Finally, treat the appliance as a possible identity and access boundary. Review administrator accounts, certificates, secrets, remote-access policies, and downstream systems that may have been reachable from the device. If evidence indicates compromise, involve incident-response specialists rather than treating the event as routine maintenance.
This is a high-priority security notice because CISA reports confirmed active exploitation. Organizations that do not use Citrix NetScaler can still use the alert as a reminder to maintain an accurate inventory of internet-facing gateways and to preserve evidence when a critical edge device may have been compromised.
Sources
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
Editorial note: This article reports public announcements, company statements, and published research. Availability, forecasts, and product claims may change.
