Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
Citrix patched two actively exploited NetScaler zero-days (CVE-2026-88771/88772, CVSS 9.5); CISA added both to KEV amid global attacks.
Citrix rushed out weekend patches for eight NetScaler ADC and NetScaler Gateway vulnerabilities, including two zero-days confirmed exploited in the wild: CVE-2026-88771, an unauthenticated remote code execution flaw affecting all ADC/Gateway deployments including default configuration, and CVE-2026-88772, a memory overflow enabling RCE or DoS on DTLS-enabled appliances (default on VPN virtual servers), both CVSS 9.5. CISA added both CVEs to its KEV catalog and issued an alert warning that threat actors are actively exploiting them globally. A private TLP:AMBER NCSC-NL notification, sourced from a European partner CERT, reported exploitation at multiple Citrix customers worldwide, prompting some administrators to take appliances offline. Citrix has published indicators of compromise.
- Two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, actively exploited.
- CVE-2026-88771 is unauthenticated RCE affecting default NetScaler ADC/Gateway configurations.
- CISA added both to KEV and warned of global active exploitation.
- NCSC-NL TLP:AMBER tip reported victims at multiple Citrix customers; some admins shut appliances down.
- Citrix published IoCs and patched eight total NetScaler vulnerabilities.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
| CVE-2026-65660 | Authenticated Code Injection RCE in Microsoft SharePoint Server | 8.8 | 10% | KEVPoC ×2 | KEV |
| CVE-2026-8452 | Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild | 8.8 | 1% | KEVPoC | KEV |
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
2 min read at securityweek.com
Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772. The post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.