CISA Warns of Critical Citrix NetScaler RCE 0-Day Vulnerabilities Under Attack

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding two critical zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway.
• These flaws, identified as CVE-2026-88771 and CVE-2026-88772, are actively being exploited in the wild by unauthenticated attackers.
• Successful exploitation could lead to remote code execution (RCE) or denial-of-service, granting attackers full control over vulnerable systems.
• Federal agencies are mandated to apply mitigations by September 30, 2026, and all organizations using affected products are strongly advised to patch immediately and conduct forensic investigations.

CISA Issues Urgent Alert for Actively Exploited Citrix NetScaler RCE Zero-Days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two severe vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway to its Known Exploited Vulnerabilities (KEV) catalog. This action follows confirmation that both flaws are under active exploitation by malicious actors, posing a significant risk to organizations globally.

These vulnerabilities allow unauthenticated attackers to remotely compromise affected systems, potentially leading to complete control over the appliances. Given that many internet-facing NetScaler devices serve as critical entry points for remote access, VPN services, and application delivery, the implications of these exploits are profound.

Details of the Exploited Vulnerabilities

The two critical vulnerabilities, designated CVE-2026-88771 and CVE-2026-88772, were officially added to CISA’s KEV catalog on September 27, 2026. Under Binding Operational Directive 26-04, federal civilian executive branch agencies are required to implement vendor-recommended mitigations for these issues by September 30, 2026.

CVE-2026-88771 is an improper input validation vulnerability. It affects Citrix NetScaler ADC and NetScaler Gateway, enabling an unauthenticated remote attacker to execute arbitrary commands on a vulnerable appliance. This flaw presents a high-risk scenario due to the exposed nature of many NetScaler deployments.

CVE-2026-88772 is categorized as an improper restriction of operations within memory buffer bounds. Exploitation of this vulnerability could result in remote code execution (RCE) or trigger a denial-of-service (DoS) condition on the affected device.

Both vulnerabilities are associated with CWE-119, a common weakness enumeration that encompasses memory safety issues. Such weaknesses frequently allow attackers to manipulate program execution, leading to arbitrary code execution or system instability.

Active Exploitation Confirmed

CISA has confirmed both flaws are exploited in real-world attacks. While the agency has not publicly identified the specific threat actors, their targets, the nature of the campaigns, or any associated ransomware activity, the active exploitation underscores the urgency for immediate action by all affected organizations.

The agency emphasizes that merely applying patches might not be sufficient if exploitation has already occurred. CISA’s guidance explicitly requires forensic triage for both vulnerabilities, indicating that organizations must thoroughly investigate their systems for any signs of compromise before restoring normal operations.

What You Should Do

• Immediately Identify and Patch: All organizations utilizing Citrix NetScaler ADC or NetScaler Gateway appliances must promptly identify any exposed devices and apply available patches or vendor-recommended mitigations.
• Conduct Forensic Investigation: Do not assume patching alone is enough. Perform a comprehensive forensic analysis of affected systems to detect any signs of prior compromise before bringing them back online.
• Review Logs: Scrutinize authentication activity, administrator account changes, configuration modifications, unusual command executions, unexpected outbound network connections, and web-access logs associated with NetScaler appliances.
• Restrict Exposure: Ensure that NetScaler devices are not unnecessarily exposed directly to the internet. Restrict management interfaces to trusted networks only.
• Discontinue Use (If Unpatchable): If mitigations or patches are unavailable, CISA advises discontinuing the use of the affected product until a secure solution can be implemented.
• Cloud Service Providers: Cloud service stakeholders must also adhere to BOD 26-04 guidance and assess whether their internet-exposed assets meet required patching timelines.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.