Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.

Databreaches •Dissent • October 1, 2026

Two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were used against organizations worldwide before a patch existed. CISA’s deadline is today. Patching alone will not tell you whether you were already breached.

Threat level: Critical What: Two unauthenticated remote-code-execution flaws in Citrix NetScaler ADC and NetScaler Gateway, both CVSS 9.5. Status: Exploited as zero-days. Listed in CISA’s Known Exploited Vulnerabilities catalog. Deadline: Federal civilian agencies must remediate and perform forensic triage by today, September 30, 2026. Fix: Upgrade to 14.1-73.37 or 13.1-64.23 (FIPS/NDcPP: 13.1-37.279). Then hunt for compromise.

Threat level: Critical

What: Two unauthenticated remote-code-execution flaws in Citrix NetScaler ADC and NetScaler Gateway, both CVSS 9.5.

Status: Exploited as zero-days. Listed in CISA’s Known Exploited Vulnerabilities catalog.

Deadline: Federal civilian agencies must remediate and perform forensic triage by today, September 30, 2026.

Fix: Upgrade to 14.1-73.37 or 13.1-64.23 (FIPS/NDcPP: 13.1-37.279). Then hunt for compromise.

Read the full report on Datawater .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises from improper input validation, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27, 2026, and set a patch deadline for federal agencies by September 30. Citrix has urged organizations to apply patches immediately and assess for potential compromises before patching. The vulnerabilities were discovered during incident investigations and were exploited before public disclosure. Affected systems are widely used in enterprise environments, making the impact potentially severe. 67 sources 82

Extracted Entities

Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.

The full story

Extracted Entities

Attack Types (2)

CVEs (2)

MITRE ATT&CK (1)

Vulnerabilities (1)