Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited

Dqindia

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited

First seen 28 Sep 2026, 18:18 UTC • •82.3

Article Content

1 / 64

Browse articles

ThreatCluster •September 29, 2026 at 16:22 UTC

•CVE-2026-88771 and CVE-2026-88772 are critical zero-day vulnerabilities with CVSS scores of 9.5.
•Both vulnerabilities allow unauthenticated remote code execution on vulnerable NetScaler appliances.
•CISA has issued an urgent patch deadline for federal agencies by September 30, 2026.

Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises from improper input validation, while CVE-2026-88772 is a memory overflow vulnerability that can lead to remote code execution or denial of service. The Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog on September 27, 2026, and set a patch deadline for federal agencies by September 30. Citrix has urged organizations to apply patches immediately and assess for potential compromises before patching. The vulnerabilities were discovered during incident investigations and were exploited before public disclosure. Affected systems are widely used in enterprise environments, making the impact potentially severe.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 4h ago How this analysis works

Timeline

2024-02-06

CVE-2024-0244 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2024-11-12

CVE-2024-8068 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-05-11

CVE-2026-42608 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-06-11

CVE-2026-35273 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-07-27

CVE-2026-63077 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-08-19

CVE-2026-19490 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-07

CVE-2026-86296 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-08

CVE-2026-86510 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-09

CVE-2026-85102 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

2026-09-14

CVE-2026-90898 published

Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.

More articles in this cluster (63)

Following this threat?

Track Clop, Earth Estries and Deed RAT in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits The Joint Cybersecurity Advisory JCSA-20260826-01, released on August 26, 2026, details ongoing activities by the China-linked hacking group QTFY, attributed to Nanjing Xinjiuwei Network Technology Co. Active since 2018, QTFY employs platforms like QScan and QTRouter to exploit vulnerabilities in critical…

ShinyHunters Hack Exposes Sensitive FBI Employee Data On September 23, 2026, the FBI disclosed an investigation into a data breach by the hacking group ShinyHunters, which claims to have stolen sensitive personal information of approximately 38,000 FBI employees and job applicants. The stolen data reportedly includes names, addresses, phone numbers, Social Security…