Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

CVE-2026-88771CVE-2026-88772CVE-2026-88773CVE-2026-88774CVE-2026-88775CVE-2026-88776CVE-2026-88777CVE-2026-88778

September 27, 2026 · CISA (US-CERT) · Severity: CRITICAL

This article reports that CISA has amplified Citrix's disclosure of eight new vulnerabilities in NetScaler ADC and Gateway, including two critical zero-days that are being actively exploited globally. CISA has added these two vulnerabilities to its Known Exploited Vulnerabilities catalog and urges organizations to assess exposure, prioritize mitigation, and preserve forensic evidence before patching. 📌 **Analyst Note:** The inclusion of SIGMA detection rules and the explicit warning to preserve forensic evidence before patching indicate that threat actors are likely using these vulnerabilities for persistent access or data theft, making incident response preparation critical.

Key Takeaways

CISA added two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, to its Known Exploited Vulnerabilities catalog after confirming active global exploitation by threat actors.
The eight disclosed vulnerabilities affect Citrix NetScaler ADC and Gateway products, with the two critical flaws independently enabling remote code execution without user interaction.
Organizations are urged to check for indicators of compromise before patching and to preserve forensic evidence if compromise is suspected, as updates may destroy critical forensic data.