Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

Two critical Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, are exploited for remote code execution.

CISA amplified Citrix’s disclosure of eight vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 through CVE-2026-88778. CVE-2026-88771 and CVE-2026-88772 were added to the Known Exploited Vulnerabilities Catalog; both are critical zero-days that can independently enable remote code execution. CISA and partner intelligence confirm threat actors are actively exploiting these vulnerabilities globally. CISA urges administrators to review Citrix’s bulletin, check for compromise before patching, and preserve forensic evidence because updates may remove visibility. Citrix published indicators of compromise through NetScaler Console.