CISA Warns of Citrix NetScaler 0-Day RCE Vulnerabilities Exploited in Attacks
CISA added two actively exploited Citrix NetScaler zero-days enabling unauthenticated remote code execution to KEV.
CISA added CVE-2026-88771 and CVE-2026-88772 to its Known Exploited Vulnerabilities catalog on September 27, 2026, after confirming active exploitation against Citrix NetScaler ADC and NetScaler Gateway. CVE-2026-88771 is an improper-input-validation flaw that lets an unauthenticated remote attacker execute arbitrary commands. CVE-2026-88772 is a CWE-119 memory-buffer flaw that can lead to remote code execution or denial of service. Under BOD 26-04, federal civilian agencies must apply mitigations by September 30, 2026. CISA did not name attackers, targets, or ransomware use, and it requires forensic triage rather than patching alone.
- CVE-2026-88771 allows unauthenticated remote command execution
- CVE-2026-88772 can enable remote code execution or denial of service
- Both were added to CISA KEV on September 27, 2026
- Federal agencies must mitigate by September 30, 2026
- CISA requires forensic triage because exploitation may already have occurred
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-88771+1 related CVE | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence showed they were being actively exploited in attacks.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.