What happened
Multiple critical zero-day vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway have been actively exploited in the wild. These vulnerabilities, identified as CVE-2026-88771 through CVE-2026-88778, can enable remote code execution independently and were disclosed publicly without available patches at the time. CISA has confirmed active exploitation by threat actors worldwide, prompting its inclusion of CVE-2026-88771 and CVE-2026-88772 in the KEV (Known Exploited Vulnerabilities) Catalog. Citrix has provided advisories and indicators of compromise to support organisations in assessing potential threats and confirming compromise status.
Who is affected
Organisations running Citrix NetScaler ADC or Citrix NetScaler Gateway are affected by these vulnerabilities. The vulnerabilities impact key components involved in remote access and application delivery, which may be integral parts of enterprise network infrastructure. Given the active exploitation, affected deployments should be considered exposed to remote code execution threats, particularly where such systems are accessible over unprotected networks.
Recommended actions
- Monitor Citrix advisories and security bulletins related to CVE-2026-88771 through CVE-2026-88778 for updates and additional guidance.
- Review the indicators of compromise provided by Citrix and confirm whether any signs of breach are present prior to implementing mitigation measures, especially before attempting patching processes.
- Assess exposure based on network architecture, prioritising systems with direct internet exposure or weak access controls.
- Implement mitigations targeted at the specific attack vectors outlined in vendor advisories, focusing on preventing remote code execution exploits through network access controls and monitoring.
- Plan for coordinated updates or mitigations considering the complexity and potential downtime associated with patch deployment, prioritising high-exposure systems.
Indicators of compromise
Indicators of compromise have been published by Citrix and can be reviewed through their official channels. These may include specific activity patterns, anomalous network traffic, or system behaviours indicative of compromise associated with the exploited vulnerabilities.
