CISA Warns of Actively Exploited Critical Citrix NetScaler Zero-Days

Summary

CISA reports active global exploitation of critical NetScaler zero-days, including flaws enabling remote code execution. It urges organizations to check for compromise, apply Citrix updates promptly, preserve evidence, and follow recovery guidance.

Key points

• CISA says threat actors are actively exploiting CVE-2026-88771 and CVE-2026-88772, both critical zero-days capable of independently enabling remote code execution.
• The alert covers ten vulnerabilities affecting Citrix NetScaler ADC and Gateway; CVE-2026-88779 can cause denial of service in SAML deployments and may help trigger execution of code injected through CVE-2026-88771.
• CISA added CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779 to its Known Exploited Vulnerabilities Catalog.
• Organizations should review Citrix advisories and install relevant updates as soon as possible.
• CISA recommends checking for compromise before patching, centralizing NetScaler logs, and preserving forensic evidence if compromise is suspected.
• For suspected or confirmed compromise, restore a known-good pre-compromise backup and rotate restored secrets, including passwords, key-encryption keys, and SSL certificates.
• CISA provided a SIGMA detection rule to help identify potentially suspicious activity.

CVE

Vendors

Products

Related Articles

• Citrix NetScaler Zero-Days Exploited in the Wild; Updates AvailableCVE-2026-88771 · CVE-2026-88772 · CVE-2026-88773
• Two Critical Citrix NetScaler Vulnerabilities Exploited in the WildCVE-2026-88771 · CVE-2026-88772 · CVE-2026-88773
• Citrix and Kiteworks Incidents Highlight Challenges of Zero-Day ResponseCVE-2026-88771 · CVE-2026-88772 · CVE-2026-88773
• Citrix Urges Immediate Patching of Critical NetScaler RCE and DoS FlawCVE-2026-107406 · CVE-2026-88771 · CVE-2026-88772
• Citrix Urges Admins to Patch Critical NetScaler RCE and DoS FlawCVE-2026-107406 · CVE-2026-88771 · CVE-2026-88772