NetScaler admins told to patch critical zero-days in ADC and Gateway now
Citrix and CISA warn NetScaler ADC and Gateway zero-days CVE-2026-88771 and CVE-2026-88772 are under active attack.
Citrix confirmed two critical unauthenticated RCE zero-days in NetScaler ADC and Gateway, CVE-2026-88771 and CVE-2026-88772, both CVSS 9.5, were exploited before fixes shipped. CVE-2026-88771 affects every deployment, including default configurations; CVE-2026-88772 requires DTLS, which is enabled by default on VPN virtual servers. CISA added both to the KEV catalog, and fixes are in 14.1-73.37, 13.1-64.23, and matching FIPS and NDcPP builds. Six further flaws, CVE-2026-88773 through CVE-2026-88778, were patched the same day but are configuration-dependent and not reported as exploited.
- Unauthenticated RCE zero-days CVE-2026-88771 and CVE-2026-88772 score CVSS 9.5.
- CVE-2026-88771 affects all deployments, including stock default configurations.
- CVE-2026-88772 needs DTLS, which is default on VPN virtual servers.
- CISA added both to KEV after exploitation was observed before patches.
- Same update fixes six more flaws, including request-smuggling CVE-2026-88773.
- CVEs
- CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 group max | 3% | PoC ×2 |
From the original article
2 min read at csoonline.com
Citrix NetScaler ADC and NetScaler Gateway users should take their systems offline and patch them immediately, they were told over the weekend, as news emerged of two critical unauthenticated remote code execution zero-day vulnerabilities in the products under active attack. “Monday will be too late,” watchtower CEO Benjamin Harris wrote in a LinkedIn post on Sunday.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.