CISA has added CVE-2026-88771 and CVE-2026-88772 to the Known Exploited Vulnerabilities catalog, citing confirmed active exploitation. Both are critical, zero-day vulnerabilities enabling remote code execution. Citrix disclosed eight total vulnerabilities (CVE-2026-88771 through CVE-2026-88778) affecting NetScaler ADC and NetScaler Gateway. Organizations are advised to check for indicators of compromise before patching and to preserve forensic evidence, as updates may reduce visibility.

Which products are affected?

Citrix NetScaler ADC, Citrix NetScaler Gateway

What should defenders do?

Organizations using Citrix NetScaler ADC or Gateway should review Citrix security bulletins for CVE-2026-88771 through CVE-2026-88778. Check for indicators of compromise via NetScaler Console prior to patching. Preserve forensic evidence before applying updates. Apply available patches or mitigations as released by Citrix. Monitor CISA and Citrix advisories for updates on the remaining six vulnerabilities.

Which vulnerabilities are involved?

CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, CVE-2026-88778

criticalCVE

CISA Adds Two Citrix NetScaler Zero-Days to KEV Catalog; Eight Vulnerabilities Disclosed

Critical flaws in NetScaler ADC and Gateway products exploited globally, prompting urgent advisory from US-CERT

CyberIntel DeskPublished 2 days agoUpdated less than a minute ago1 min read

Key Takeaways

CISA has added CVE-2026-88771 and CVE-2026-88772 to the KEV catalog due to confirmed active exploitation.
Both KEV-listed vulnerabilities are critical zero-days enabling remote code execution on Citrix NetScaler ADC and Gateway.
Citrix disclosed eight total vulnerabilities (CVE-2026-88771 through CVE-2026-88778) affecting NetScaler ADC and Gateway.
Organizations should check for indicators of compromise before applying patches, as updates may reduce forensic visibility.

Related Security News

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read