CriticalZero-DayCVE-2026-88771
CISA Warns of Hackers Exploiting Two Citrix NetScaler 0-Days to Execute Code Remotely
Cyber Security News·Source published ·1 min read
What happened?
Threat actors are actively exploiting two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances, allowing them to execute code remotely on exposed systems. The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, received a CVSS v4 severity score of 9.5 out of 10 and have been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. CISA confirmed that it received reports and partner intelligence showing global exploitation activity.
Key details
- Two critical Citrix NetScaler zero-days allow remote code execution on exposed appliances.
- CVE-2026-88772 is a memory overflow flaw requiring DTLS to be enabled for exploitation.
- Both flaws were disclosed on September 27, 2026, and were already being exploited before patches were released.
- CISA recommends preserving logs and evidence before patching, as compromise may already exist.
Affected
- NetScaler ADC and Gateway 14.1 releases before 14.1-73.37.
- NetScaler ADC and Gateway 13.1 releases before 13.1-64.23.
- NetScaler ADC 14.1-FIPS builds before 14.1-73.37 FIPS.
- 13.1-FIPS or NDcPP builds before 13.1-37.279.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.