OverviewOn September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution (RCE) vulnerabilities: CVE-2026-88771 and CVE-2026-88772. Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9.5, and both have been confirmed as being actively exploited in the wild as zero-days prior to the vendor disclosure.
Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772
About this summary. This is a short, independently written summary of an article first published by Rapid7. Cyber Security News did not report or verify the underlying story. Read the original: https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772
Source attribution: headline and facts are from Rapid7 (rapid7.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway
CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE-2026-88772…
Citrix security advisory (AV26-965)
Serial number: AV26-965 Date: September 28, 2026 As of September 27, 2026, Citrix is affected by vulnerabilities in the following products: NetScaler ADC and NetScaler…
NCSC-2026-0394 [1.00] [H/H] Kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway
Citrix heeft 8 kwetsbaarheden verholpen in NetScaler ADC en NetScaler Gateway.
U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S.
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772 Citrix has released emergency security updates for eight vulnerabilities affecting customer-managed NetScaler ADC…
Certainties in life: Death, taxes, and critical Citrix vulns under attack
Death and taxes are said to be the only certainties in life. Perhaps it’s time to add attackers targeting newly discovered critical flaws in Citrix’s NetScaler…