Overview
- Citrix released fixes on September 27 for eight NetScaler ADC and Gateway vulnerabilities and confirmed that two tracked as CVE-2026-88771 and CVE-2026-88772 were exploited before patches were available.
- CVE-2026-88771 is an improper input validation remote code execution flaw that affects default NetScaler deployments and has a CVSS score of 9.5, while CVE-2026-88772 is a DTLS‑dependent memory overflow that can cause remote code execution or denial of service and also scores 9.5.
- The U.S. Cybersecurity and Infrastructure Security Agency added both CVEs to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by September 30, and national CERTs including those in the Netherlands and Australia have urged immediate patching and isolation.
- Investigators warn that Citrix's IoCs are limited, that webshells and anti‑forensics may hide intrusions, and that teams should preserve memory and logs, engage forensic specialists, rotate credentials and certificates, and consider rebuilding devices when compromise is suspected.
- NetScaler appliances sit at the network edge for VPN, authentication and load balancing, thousands are internet‑fingerprinted worldwide, and administrators were privately warned over the weekend leading some to power off devices because successful compromise can let attackers move into corporate networks.