Executive Summary
Citrix has disclosed multiple critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway, with two zero-days, CVE-2026-88771 and CVE-2026-88772, confirmed to be under active exploitation. CVE-2026-88771 is a particularly severe unauthenticated remote code execution (RCE) flaw that affects all deployments, including default configurations. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating remediation by September 30, 2026.
The attack chain involves initial access via improper input validation or memory overflows, followed by post-exploitation activities such as the deployment of webshells, credential theft, and lateral movement. While no specific threat actors have been officially named, the vulnerabilities are being targeted globally by unidentified groups.
Organizations must prioritize patching customer-managed appliances immediately, as updating does not remove persistence if an attacker gained access prior to the fix. Administrators are urged to perform forensic audits using available scripts from regional NCSC bodies to identify potential historical compromises.